Changeset 46253 in vbox for trunk/src/VBox/Devices/Storage

Timestamp:

May 24, 2013 9:25:35 AM (12 years ago)

Author:

vboxsync

Message:

Devices/LsiLogic: Limit the amount of memory the guest can allocate for the diagnostic memory to 1MB, prevents malicous guests from DOSing the host my llocating loads of memory

File:

• trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp (modified) (5 diffs)

trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp

@@ -67 +67 @@
 #define LSILOGIC_MAX_ALLOC_TOO_MUCH 20
 
+/** Maximum size of the memory regions (prevents teh guest from DOSing the host by
+ * allocating loadds of memory). */
+#define LSILOGIC_MEMORY_REGIONS_MAX (_1M)
+
 /*******************************************************************************
 *   Structures and Typedefs                                                    *
@@ -337 +341 @@
     /** Current address to read from or write to in the diagnostic memory region. */
     uint32_t                         u32DiagMemAddr;
-
+    /** Current size of the memory regions. */
+    uint32_t                         cbMemRegns;
+
+#if HC_ARCH_BITS ==32
     uint32_t                         u32Padding3;
+#endif
 
     union
@@ -786 +794 @@
         RTMemFree(pIt);
     }
+    pThis->cbMemRegns = 0;
 }
 
@@ -878 +887 @@
             uint32_t cRegionSizeOld = (pRegion->u32AddrEnd - pRegion->u32AddrStart) / 4 + 1;
             uint32_t cRegionSizeNew = cRegionSizeOld + 512;
-            PLSILOGICMEMREGN pRegionNew = (PLSILOGICMEMREGN)RTMemRealloc(pRegion, RT_OFFSETOF(LSILOGICMEMREGN, au32Data[cRegionSizeNew]));
-
-            if (pRegionNew)
+
+            if (pThis->cbMemRegns + 512 * sizeof(uint32_t) < LSILOGIC_MEMORY_REGIONS_MAX)
             {
-                pRegion = pRegionNew;
-                memset(&pRegion->au32Data[cRegionSizeOld], 0, 512 * sizeof(uint32_t));
-                pRegion->au32Data[cRegionSizeOld] = u32Data;
-                pRegion->u32AddrEnd = pRegion->u32AddrStart + (cRegionSizeNew - 1) * sizeof(uint32_t);
-            }
-            /* else: Silently fail, there is nothing we can do here and the guest might work nevertheless. */
-
-            lsilogicR3MemRegionInsert(pThis, pRegion);
-        }
-        else
-        {
-            /* Create completely new. */
-            pRegion = (PLSILOGICMEMREGN)RTMemAllocZ(RT_OFFSETOF(LSILOGICMEMREGN, au32Data[512]));
-            if (pRegion)
-            {
-                pRegion->u32AddrStart = pThis->u32DiagMemAddr;
-                pRegion->u32AddrEnd   = pRegion->u32AddrStart + (512 - 1) * sizeof(uint32_t);
-                pRegion->au32Data[0]  = u32Data;
+                PLSILOGICMEMREGN pRegionNew = (PLSILOGICMEMREGN)RTMemRealloc(pRegion, RT_OFFSETOF(LSILOGICMEMREGN, au32Data[cRegionSizeNew]));
+
+                if (pRegionNew)
+                {
+                    pRegion = pRegionNew;
+                    memset(&pRegion->au32Data[cRegionSizeOld], 0, 512 * sizeof(uint32_t));
+                    pRegion->au32Data[cRegionSizeOld] = u32Data;
+                    pRegion->u32AddrEnd = pRegion->u32AddrStart + (cRegionSizeNew - 1) * sizeof(uint32_t);
+                    pThis->cbMemRegns += 512 * sizeof(uint32_t);
+                }
+                /* else: Silently fail, there is nothing we can do here and the guest might work nevertheless. */
 
                 lsilogicR3MemRegionInsert(pThis, pRegion);
             }
-            /* else: Silently fail, there is nothing we can do here and the guest might work nevertheless. */
+        }
+        else
+        {
+            if (pThis->cbMemRegns + 512 * sizeof(uint32_t) < LSILOGIC_MEMORY_REGIONS_MAX)
+            {
+                /* Create completely new. */
+                pRegion = (PLSILOGICMEMREGN)RTMemAllocZ(RT_OFFSETOF(LSILOGICMEMREGN, au32Data[512]));
+                if (pRegion)
+                {
+                    pRegion->u32AddrStart = pThis->u32DiagMemAddr;
+                    pRegion->u32AddrEnd   = pRegion->u32AddrStart + (512 - 1) * sizeof(uint32_t);
+                    pRegion->au32Data[0]  = u32Data;
+                    pThis->cbMemRegns += 512 * sizeof(uint32_t);
+
+                    lsilogicR3MemRegionInsert(pThis, pRegion);
+                }
+                /* else: Silently fail, there is nothing we can do here and the guest might work nevertheless. */
+            }
         }
 
@@ -4639 +4657 @@
                     SSMR3GetMem(pSSM, &pRegion->au32Data[0], cRegion * sizeof(uint32_t));
                     lsilogicR3MemRegionInsert(pThis, pRegion);
+                    pThis->cbMemRegns += cRegion * sizeof(uint32_t);
                 }
                 else