git: 81b9fcfa0bbc - main - bhyve: Improve HDA stream descriptor validation

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=81b9fcfa0bbca2f9931a9b9a5e6fde0972f08cfa

commit 81b9fcfa0bbca2f9931a9b9a5e6fde0972f08cfa
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-10-13 19:58:36 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-14 16:00:47 +0000

    bhyve: Improve HDA stream descriptor validation
    
    The length of each block in the stream must be non-zero.  This is
    assumed in hda_transfer(), otherwise an out-of-bounds read or write is
    possible.
    
    Use atomic loads to access stream descriptor fields, since they are
    guest-controlled.  Make sure that the descriptor array is suitably
    aligned so that we can drop the __packed annotation from the structure
    definition; per section 3.3.42 of the HDA spec the BDL pointer is
    supposed to be 128-byte aligned, in fact.
    
    Approved by:    so
    Security:       FreeBSD-SA-26:72.bhyve
    Security:       CVE-2026-101310
    Reported by:    Brian Delgado from Intel using Anthropic Opus 4.8
    Reviewed by:    christos
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D60678
---
 usr.sbin/bhyve/pci_hda.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/usr.sbin/bhyve/pci_hda.c b/usr.sbin/bhyve/pci_hda.c
index 92e347f641d9..5fd6d6f557d4 100644
--- a/usr.sbin/bhyve/pci_hda.c
+++ b/usr.sbin/bhyve/pci_hda.c
@@ -28,6 +28,9 @@
  */
 
 #include <sys/param.h>
+
+#include <machine/atomic.h>
+
 #include <time.h>
 
 #include "pci_hda.h"
@@ -81,7 +84,7 @@ struct hda_bdle {
 	uint32_t addrh;
 	uint32_t len;
 	uint32_t ioc;
-} __packed;
+};
 
 struct hda_bdle_desc {
 	void *addr;
@@ -630,8 +633,9 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 	bdl_paddr = bdpl | (bdpu << 32);
 	bdl_vaddr = hda_dma_get_vaddr(sc, bdl_paddr,
 	    HDA_BDL_ENTRY_LEN * bdl_cnt);
-	if (!bdl_vaddr) {
-		DPRINTF("Fail to get the guest virtual address");
+	if (bdl_vaddr == NULL ||
+	    (uintptr_t)bdl_vaddr % HDA_DMA_ACCESS_LEN != 0) {
+		DPRINTF("Invalid guest virtual address %p", bdl_vaddr);
 		return (-1);
 	}
 
@@ -642,14 +646,14 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 
 	bdle = (struct hda_bdle *)bdl_vaddr;
 	for (size_t i = 0; i < bdl_cnt; i++, bdle++) {
-		bdle_sz = bdle->len;
-		if ((bdle_sz % HDA_DMA_ACCESS_LEN) != 0) {
+		bdle_sz = atomic_load_32(&bdle->len);
+		if (bdle_sz % HDA_DMA_ACCESS_LEN != 0 || bdle_sz == 0) {
 			DPRINTF("Invalid BDLE length: 0x%x", bdle_sz);
 			return (-1);
 		}
 
-		bdle_addrl = bdle->addrl;
-		bdle_addrh = bdle->addrh;
+		bdle_addrl = atomic_load_32(&bdle->addrl);
+		bdle_addrh = atomic_load_32(&bdle->addrh);
 
 		bdle_paddr = bdle_addrl | (bdle_addrh << 32);
 		bdle_vaddr = hda_dma_get_vaddr(sc, bdle_paddr, bdle_sz);
@@ -661,7 +665,7 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 		bdle_desc = &st->bdl[i];
 		bdle_desc->addr = bdle_vaddr;
 		bdle_desc->len = bdle_sz;
-		bdle_desc->ioc = bdle->ioc;
+		bdle_desc->ioc = atomic_load_32(&bdle->ioc);
 
 		DPRINTF("bdle: 0x%zx bdle_sz: 0x%x", i, bdle_sz);
 	}