Repository navigation
[DM/PCI] Validate ivshmem shared memory window - #11993
BernardXiong wants to merge 1 commit into
Conversation
The shared memory address and size in the ivshmem PCI config space (0x40..0x4f) are controlled by the device. ivshmem_pci_probe() used them verbatim as a JailHouse fallback when BAR2 was absent, so a malicious device could make the kernel map an arbitrary physical window and expose it to user space through /dev/ivshmemN. Only use the config space fallback when RT_IVSHMEM_JAILHOUSE is enabled, and validate the window (non-zero size, no overflow and representable by native pointer and size types) before mapping. Read the four config words into 64-bit locals instead of writing through 32-bit aliases of the pointer and size fields, and check the config space read result. Fixes RT-Thread#11992
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-11-06 03:05 CST)
📝 Review Instructions
|
|
Summary
When BAR2 is absent,
ivshmem_pci_probe()takes the JailHouse fallback and copies the shared memory address and size from the device-controlled PCI config words at0x40..0x4f. The PCI core never validates these values, andrt_ioremap()maps whatever physical range it is given. A malicious or ill-formatted ivshmem device can therefore make the kernel map an arbitrary physical window (for example kernel RAM) and expose it to user space through/dev/ivshmemN, giving unprivileged processes arbitrary kernel memory read/write.Changes
RT_IVSHMEM_JAILHOUSEoption is enabled. It defaults ton, and its help text documents that the device must be trusted. Without it, a valid BAR2 is required.rt_ioremap(): non-zero size, no address overflow, and the whole range must be representable with native pointer/size types.shmemandshmem_sizefields (which also corrupted adjacent fields on 32-bit builds).Fixes #11992
Testing
Changed files pass
clang-format22.1.8. The ivshmem driver compiles in both configurations (RT_IVSHMEM_JAILHOUSE=nand=y) forbsp/qemu-virt64-aarch64withRT_USING_PCI,RT_PCI_MSIandRT_USING_IVSHMEMenabled. CI will confirm the full build.