bhyve: Fix a global buffer overread in the PCI hda device model.

[jhb]

Summary

hda_write did not validate the relative register offset before using
it as an index into the hda_set_reg_table array to lookup a function
pointer to execute after updating the register's value.

PR: 264435
Reported by: Robert Morris <[e-mail]>
Sponsored by: The FreeBSD Foundation

[emaste]

usr.sbin/bhyve/pci_hda.c

716

offset is "enforced" to be < HDA_LAST_OFFSET via an assertion in hda_get_reg_by_offset; (as a subsequent change) should we turn that into an error return?

[corvink]

usr.sbin/bhyve/pci_hda.c

716

I'd prefer that.

[jhb]

usr.sbin/bhyve/pci_hda.c

716

No, the offset is never bigger than that since the BAR is registered as having that size:

static int
pci_hda_init(struct pci_devinst *pi, nvlist_t *nvl)
{
...
	/* allocate one BAR register for the Memory address offsets */
	pci_emul_alloc_bar(pi, 0, PCIBAR_MEM32, HDA_LAST_OFFSET);

The offset should never be larger unless there is a bug in pci_emul.c, so using an assert() rather than an error check in the get/set_reg routines is correct. (If we break generic PCI BAR handling in bhyve, we'd rather get core dumps due to assertion errors, not silently discarded errors.)

[emaste]

OK, assert() is correct.