Re: [PATCH 1/4] virtio-mem: validate device-reported block size
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: 2026-07-15 15:57:09
Also in:
lkml, virtualization
On Wed, Jul 15, 2026 at 04:22:40PM +0200, Hari Mishal wrote:
quoted hunk ↗ jump to hunk
The device_block_size read from the virtio-mem config space is used as a divisor and also in ALIGN_DOWN() further down the code path in the driver without further validation. A zero value leads to a division by zero, and a non-power-of-two value corrupts the ALIGN_DOWN() bitmask arithmetic leading to a misreporting of guest usable guest ram, post crash. Reject both at init time instead of trusting the device. Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal <redacted> --- drivers/virtio/virtio_mem.c | 7 +++++++ 1 file changed, 7 insertions(+)diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c index 11c441501582..43d12ec7c323 100644 --- a/drivers/virtio/virtio_mem.c +++ b/drivers/virtio/virtio_mem.c@@ -2847,6 +2847,13 @@ static int virtio_mem_init(struct virtio_mem *vm) &vm->plugged_size); virtio_cread_le(vm->vdev, struct virtio_mem_config, block_size, &vm->device_block_size); + if (!vm->device_block_size || + !is_power_of_2(vm->device_block_size)) {
0 is not a power of 2, why do we need to check twice?
+ dev_err(&vm->vdev->dev, + "invalid device block size: 0x%llx\n", + (unsigned long long)vm->device_block_size); + return -EINVAL; + } virtio_cread_le(vm->vdev, struct virtio_mem_config, node_id, &node_id); vm->nid = virtio_mem_translate_node_id(vm, node_id); -- 2.43.0