On Wed, Jul 15, 2026 at 04:22:40PM +0200, Hari Mishal wrote: > The device_block_size read from the virtio-mem config space is used > as a divisor and also in ALIGN_DOWN() further down the code path in > the driver without further validation. A zero value leads to a division > by zero, and a non-power-of-two value corrupts the ALIGN_DOWN() bitmask > arithmetic leading to a misreporting of guest usable guest ram, post > crash. Reject both at init time instead of trusting the device. > > Assisted-by: gkh_clanker:t1000 > Signed-off-by: Hari Mishal <[email protected]> > --- > drivers/virtio/virtio_mem.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c > index 11c441501582..43d12ec7c323 100644 > --- a/drivers/virtio/virtio_mem.c > +++ b/drivers/virtio/virtio_mem.c > @@ -2847,6 +2847,13 @@ static int virtio_mem_init(struct virtio_mem *vm) > &vm->plugged_size); > virtio_cread_le(vm->vdev, struct virtio_mem_config, block_size, > &vm->device_block_size); > + if (!vm->device_block_size || > + !is_power_of_2(vm->device_block_size)) {
0 is not a power of 2, why do we need to check twice? > + dev_err(&vm->vdev->dev, > + "invalid device block size: 0x%llx\n", > + (unsigned long long)vm->device_block_size); > + return -EINVAL; > + } > virtio_cread_le(vm->vdev, struct virtio_mem_config, node_id, > &node_id); > vm->nid = virtio_mem_translate_node_id(vm, node_id); > -- > 2.43.0
