HomeFreeBSD

bhyve nvme: Check return value of mapped memory

Description

bhyve nvme: Check return value of mapped memory

Fuzzing of bhyve using hyfuzz discovered a way to cause a segmentation
fault in the NVMe emulation. If a guest specifies a physical address in
either the PRP1 or PRP2 field of a command that cannot be mapped from
guest to host, the function paddr_guest2host() returns a NULL pointer.
The NVMe emulation did not check for this error case, which allowed for
the segmentation fault to occur.

Fix is to check for a return value of NULL and indicate an error back to
the guest (Data Transfer error). While in the area, slightly refactor
the write/read blockif function to use a common error exit path.

PR: 256321
Reported by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reviewed by: imp, jhb
Differential Revision: https://reviews.freebsd.org/D35452

Details

Provenance
chuckAuthored on Aug 14 2022, 2:45 PM
Reviewer
imp
Differential Revision
D35452: bhyve nvme: Check return value of mapped memory
Parents
rG8b55a4718c04: Indicate that racoon.8 is in ports/security/ipsec-tools.
Branches
Unknown
Tags
Unknown