CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/09 13:23:55
Modified files:
usr.sbin/vmd : vioblk.c
Log message:
vmd(8): Reject vioblk requests beyond the disk capacity
vioblk_io() converted the guest-controlled sector to a byte offset and
passed it to the backend without comparing it against the disk capacity.
With a raw image on a regular file, pwritev() extends the file, so a
privileged guest could write past the configured size and exhaust the
host filesystem.
Pass the sector number to vioblk_io() as an unsigned value and defer the
conversion to a byte offset until after the bounds check. Once the full
transfer length is known, reject a start beyond capacity or a transfer
that crosses the end, then convert to off_t. The check is done in
unsigned arithmetic; the subtraction order avoids underflow and it never
multiplies the attacker-controlled sector.
>From Acts1631, thanks!
ok dv@
