bhyve xhci: Cache the value of MaxPStreams when initializing an endpoint.

[jhb]

Summary

This avoids type confusion where a malicious guest could rewrite the
MaxPStreams field in an endpoint context after the endpoint was
initialized causing the device model to interpret a guest provided
address (stored in ep_ringaddr of the "software" endpoint state) as a
bhyve host process address (ep_sctx_trbs). It also prevents a malicious
guest from triggering overflows of ep_sctx_trbs[] by increasing the
number of streams after the endpoint has been initialized.

Rather than re-reading the MaxPStreams value out of the endpoint context
in guest memory on subsequent operations, cache the value in the software
endpoint state. Possibly the device model should raise errors if the
value of MaxPStreams changes while an endpoint is running. This approach
simply ignores any such changes by the guest.

PR: 264294, 264347
Reported by: Robert Morris <[e-mail]>
Sponsored by: The FreeBSD Foundation

[markj]

usr.sbin/bhyve/pci_xhci.c

173

It'd be helpful to have a comment indicating that this is a shadow of the max_pstreams field of epctx0.

1207

I don't quite understand this line, shouldn't it be adding streamid * sizeof(*sctx) or something like that?

1275

It looks like this code is supposed to be using sctx instead of devep->ep_sctx[streamid].

[jhb]

usr.sbin/bhyve/pci_xhci.c

1207

Hmm, or we should be casting the result of XHCI_GADDR to the right type, yes.

1275

I bet this then is the other half of the bug you found above (or rather, this makes the bug you found above harmless since the incorrect pointer isn't used). I can clean this up though in a followup commit.

[markj]

I still think a comment should explain the new field but the change seems ok to me after some quality time with the XHCI spec.

usr.sbin/bhyve/pci_xhci.c

173

(Also note that ep_maxpstreams might be a more accurate name.)

1275

Thanks. The other half will be caught eventually when we bump WARNS (arithmetic on a void pointer), but this should be cleaned up too.

BTW, I think the other half of the bug is not quite harmless since pci_xhci_find_stream() checks some bits in sctx->qwSctx0, but I guess it happens to work out.

[jhb]

usr.sbin/bhyve/pci_xhci.c

173

I will do both of those. Much of this file is under-commented though and would seem to assume knowledge of the XHCI spec in which case a more properly named field (I agree with ep_maxpstreams or possibly even ep_MaxPStreams to match the spec) is perhaps sufficient? The comment would likely say something like "Cached value of the MaxPStreams field from the endpoint context."

[jhb]

• Rename field and add a comment.