Changeset 82277 in vbox

Timestamp:

Nov 28, 2019 8:24:13 PM (5 years ago)

Author:

vboxsync

Message:

IOMR0: Table initialization bug in the two function growing the registration tables for MMIO and I/O ports. Would potentially corrupt kernel memory following the allocation. bugref:9218

Location:

trunk/src/VBox/VMM

Files:

• VMMR0/IOMR0IoPort.cpp (modified) (1 diff)
• VMMR0/IOMR0Mmio.cpp (modified) (1 diff)
• VMMR3/IOMR3IoPort.cpp (modified) (5 diffs)

trunk/src/VBox/VMM/VMMR0/IOMR0IoPort.cpp

@@ -206 +206 @@
                 paRing0[i].idxSelf  = (uint16_t)i;
                 paRing0[i].idxStats = UINT16_MAX;
+            }
+            i = cbRing3 / sizeof(*paRing3);
+            while (i-- > cOldEntries)
+            {
                 paRing3[i].idxSelf  = (uint16_t)i;
                 paRing3[i].idxStats = UINT16_MAX;

trunk/src/VBox/VMM/VMMR0/IOMR0Mmio.cpp

@@ -203 +203 @@
                 paRing0[i].idxSelf  = (uint16_t)i;
                 paRing0[i].idxStats = UINT16_MAX;
+            }
+            i = cbRing3 / sizeof(*paRing3);
+            while (i-- > cOldEntries)
+            {
                 paRing3[i].idxSelf  = (uint16_t)i;
                 paRing3[i].idxStats = UINT16_MAX;

trunk/src/VBox/VMM/VMMR3/IOMR3IoPort.cpp

@@ -295 +295 @@
 #endif
     *phIoPorts = idx;
+    LogFlow(("IOMR3IoPortCreate: idx=%#x cPorts=%u %s\n", idx, cPorts, pszDesc));
     return VINF_SUCCESS;
 }
@@ -316 +317 @@
     AssertReturn((uint32_t)uPort + cPorts <= _64K, VERR_OUT_OF_RANGE);
     RTIOPORT const uLastPort = uPort + cPorts - 1;
+    LogFlow(("IOMR3IoPortMap: hIoPorts=%#RX64 %RTiop..%RTiop (%u ports)\n", hIoPorts, uPort, uLastPort, cPorts));
 
     /*
@@ -411 +413 @@
             AssertMsg(paEntries[i].idx < pVM->iom.s.cIoPortRegs, ("%u: %#x %#x\n", i, paEntries[i].idx, pVM->iom.s.cIoPortRegs));
             AssertMsg(uPortPrev < paEntries[i].uFirstPort, ("%u: %#x %#x\n", i, uPortPrev, paEntries[i].uFirstPort));
+            AssertMsg(paEntries[i].uLastPort - paEntries[i].uFirstPort + 1 == pVM->iom.s.paIoPortRegs[paEntries[i].idx].cPorts,
+                      ("%u: %#x %#x..%#x -> %u, expected %u\n", i, uPortPrev, paEntries[i].uFirstPort, paEntries[i].uLastPort,
+                       paEntries[i].uLastPort - paEntries[i].uFirstPort + 1, pVM->iom.s.paIoPortRegs[paEntries[i].idx].cPorts));
             uPortPrev = paEntries[i].uLastPort;
         }
@@ -452 +457 @@
         Assert(pVM->iom.s.cIoPortLookupEntries == cEntries);
         Assert(cEntries > 0);
+        LogFlow(("IOMR3IoPortUnmap: hIoPorts=%#RX64 %RTiop..%RTiop (%u ports)\n", hIoPorts, uPort, uLastPort, pRegEntry->cPorts));
 
         PIOMIOPORTLOOKUPENTRY paEntries = pVM->iom.s.paIoPortLookup;
@@ -521 +527 @@
             AssertMsg(paEntries[i].idx < pVM->iom.s.cIoPortRegs, ("%u: %#x %#x\n", i, paEntries[i].idx, pVM->iom.s.cIoPortRegs));
             AssertMsg(uPortPrev < paEntries[i].uFirstPort, ("%u: %#x %#x\n", i, uPortPrev, paEntries[i].uFirstPort));
+            AssertMsg(paEntries[i].uLastPort - paEntries[i].uFirstPort + 1 == pVM->iom.s.paIoPortRegs[paEntries[i].idx].cPorts,
+                      ("%u: %#x %#x..%#x -> %u, expected %u\n", i, uPortPrev, paEntries[i].uFirstPort, paEntries[i].uLastPort,
+                       paEntries[i].uLastPort - paEntries[i].uFirstPort + 1, pVM->iom.s.paIoPortRegs[paEntries[i].idx].cPorts));
             uPortPrev = paEntries[i].uLastPort;
         }