bhyve virtio-scsi: Avoid out of bounds accesses to guest requests.

[jhb]

Summary

• Ignore I/O requests with insufficiently sized input or output buffers (those not containing compete request headers).

• Ignore control requests with improperly sized buffers.

• While here, explicitly zero the output header of an I/O request to avoid leaking malloc garbage from the host if the header is not fully populated.

PR: 264521
Reported by: Robert Morris <[e-mail]>
Sponsored by: The FreeBSD Foundation

[jhb]

I have only compiled this, I have not run-tested it as I don't have a virtio-scsi setup handy.

[mav]

Looks good to me with one comment.

usr.sbin/bhyve/pci_virtio_scsi.c

375

I wonder whether we should be more relaxed here with < ? Can the structure grow in later versions?

[emaste]

usr.sbin/bhyve/pci_virtio_scsi.c

375

There isn't a version in the struct, so I think this is a safe choice. We can always change this if and when we learn about a new/larger struct.

[jhb]

usr.sbin/bhyve/pci_virtio_scsi.c

375

The current 1.1 spec says the payload of both of these commands is a fixed size. I agree that we can relax this in the future if needed.