commit 7afebecdb9764c2c1ea3d1419ffc8c00701c4159
author Daniel Verkamp <dverkamp@chromium.org> Mon Nov 21 23:52:48 2022
committer crosvm LUCI <crosvm-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Dec 07 20:58:20 2022
tree be633e349e9c35e82757ed2b2d52033502723bbb
parent 54cee02f5113bef923da5595fcc572b773b02e01

devices: virtio: queue: move queue validation to set_ready()

The Queue::validate() function verified that the descriptor, avail, and
used rings fall within valid guest memory regions. However, this check
was skipped when an IOMMU was enabled, so the Queue::peek() function had
to be robust against out-of-bounds memory addresses already.

Move the integer overflow checks of ring guest addresses into the
`Queue::set_ready()` function, which is called when the driver enables
each queue (and must have already configured the queue addresses). This
allows the checks to be performed once at queue enable time instead of
every time `peek()`/`pop()` is called.

The `GuestMemory::address_in_range()` checks are removed. These are not
necessary to ensure correctness, as all read/write accesses in Queue
functions that operate on guest memory already use helper functions that
ensure out-of-bounds memory accesses are rejected (read_obj_from_addr()
and write_obj_at_addr() via the wrapper functions that handle IOMMU).

BUG=None
TEST=Boot x86-64 Linux in crosvm

Change-Id: I51cca6554c4c5f134082e9326bcf59499f201c1c
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4045044
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>