Re: [PATCH v5 02/11] pcie_sriov: Validate NumVFs

[Akihiko Odaki]

On 2024/02/19 2:36, Michael S. Tsirkin wrote:
> On Sun, Feb 18, 2024 at 01:56:07PM +0900, Akihiko Odaki wrote:
> > The guest may write NumVFs greater than TotalVFs and that can lead
> > to buffer overflow in VF implementations.
> >
> > Cc: qemu-stable@nongnu.org
> > Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O Virtualization 
> > (SR/IOV)")
> > Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
> > ---
> >   hw/pci/pcie_sriov.c | 3 +++
> >   1 file changed, 3 insertions(+)
> >
> > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > index a1fe65f5d801..da209b7f47fd 100644
> > --- a/hw/pci/pcie_sriov.c
> > +++ b/hw/pci/pcie_sriov.c
> > @@ -176,6 +176,9 @@ static void register_vfs(PCIDevice *dev)
> >   
> >       assert(sriov_cap > 0);
> >       num_vfs = pci_get_word(dev->config + sriov_cap + PCI_SRIOV_NUM_VF);
> > +    if (num_vfs > pci_get_word(dev->config + sriov_cap + PCI_SRIOV_TOTAL_VF)) {
> > +        return;
> > +    }
> >   
> >       dev->exp.sriov_pf.vf = g_new(PCIDevice *, num_vfs);
>
>
> This reminds me: how is this num_vfs value set on migration?

That's a good point... Actually no consideration of migration is made 
and SR-IOV is completely broken with it.