feat: validate driver set queue size

Add a validation of the queue size set by the guest.

Signed-off-by: Egor Lazarchuk <[email protected]>

Author: ShadowCurse

src/vmm/src/devices/virtio/balloon/device.rs

@@ -606,8 +606,7 @@ impl VirtioDevice for Balloon {
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         self.device_state = DeviceState::Activated(mem);

src/vmm/src/devices/virtio/block/vhost_user/device.rs

@@ -332,8 +332,7 @@ impl<T: VhostUserHandleBackend + Send + 'static> VirtioDevice for VhostUserBlock
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         let start_time = get_time_us(ClockType::Monotonic);

src/vmm/src/devices/virtio/block/virtio/device.rs

@@ -628,8 +628,7 @@ impl VirtioDevice for VirtioBlock {
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         let event_idx = self.has_feature(u64::from(VIRTIO_RING_F_EVENT_IDX));

src/vmm/src/devices/virtio/mod.rs

@@ -72,8 +72,8 @@ pub enum ActivateError {
     VhostUser(vhost_user::VhostUserError),
     /// Setting tap interface offload flags failed: {0}
     TapSetOffload(TapError),
-    /// Error setting pointers in the queue: (0)
-    QueueMemoryError(QueueError),
+    /// Error initializing the queue: (0)
+    QueueError(QueueError),
 }
 
 /// Trait that helps in upcasting an object to Any

src/vmm/src/devices/virtio/net/device.rs

@@ -1000,8 +1000,7 @@ impl VirtioDevice for Net {
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         let event_idx = self.has_feature(u64::from(VIRTIO_RING_F_EVENT_IDX));

src/vmm/src/devices/virtio/queue.rs

@@ -32,6 +32,8 @@ pub enum QueueError {
     DescIndexOutOfBounds(u16),
     /// Failed to write value into the virtio queue used ring: {0}
     MemoryError(#[from] vm_memory::GuestMemoryError),
+    /// Invalid queue size configured by the driver: max: {0} configured: {1}
+    InvalidQueueSize(u16, u16),
     /// Pointer is not aligned properly: {0:#x} not {1}-byte aligned.
     PointerNotAligned(usize, u8),
 }
@@ -322,9 +324,14 @@ impl Queue {
         Ok(slice.ptr_guard_mut().as_ptr())
     }
 
+    /// Do final checks and setup of the queue before it can be usable.
     /// Set up pointers to the queue objects in the guest memory
     /// and mark memory dirty for those objects
     pub fn initialize<M: GuestMemory>(&mut self, mem: &M) -> Result<(), QueueError> {
+        if self.max_size < self.size {
+            return Err(QueueError::InvalidQueueSize(self.max_size, self.size));
+        }
+
         self.desc_table_ptr = self
             .get_slice_ptr(mem, self.desc_table_address, self.desc_table_size())?
             .cast();

src/vmm/src/devices/virtio/rng/device.rs

@@ -294,8 +294,7 @@ impl VirtioDevice for Entropy {
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         self.activate_event.write(1).map_err(|_| {

src/vmm/src/devices/virtio/vsock/device.rs

@@ -331,8 +331,7 @@ where
 
     fn activate(&mut self, mem: GuestMemoryMmap) -> Result<(), ActivateError> {
         for q in self.queues.iter_mut() {
-            q.initialize(&mem)
-                .map_err(ActivateError::QueueMemoryError)?;
+            q.initialize(&mem).map_err(ActivateError::QueueError)?;
         }
 
         if self.queues.len() != defs::VSOCK_NUM_QUEUES {