git: 4a81e501337c - stable/14 - bhyve: avoid updating fbaddr when vm_mmap_memseg fails

The branch stable/14 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=4a81e501337cf160d56af2d638f080983e520654

commit 4a81e501337cf160d56af2d638f080983e520654
Author:     Pierre Pronchery <pierre@freebsdfoundation.org>
AuthorDate: 2024-07-24 20:51:20 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-09-03 14:53:19 +0000

    bhyve: avoid updating fbaddr when vm_mmap_memseg fails
    
    In the function pci_fbuf_baraddr the field sc->fbaddr was set with a
    user-controlled value, even though the call to vm_mmap_memseg failed.
    
    No security risk as currently sc->fbaddr is not really used in the
    source code.
    
    Reported by:    Synacktiv
    Reviewed by:    emaste
    Sponsored by:   Alpha-Omega Project
    Sponsored by:   The FreeBSD Foundation
    Differential revision:  https://reviews.freebsd.org/D46109
    
    (cherry picked from commit 85707cfdaddc179af8bd2623091eb1b8c58fed4a)
---
 usr.sbin/bhyve/pci_fbuf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/usr.sbin/bhyve/pci_fbuf.c b/usr.sbin/bhyve/pci_fbuf.c
index a6bf508a46e6..e2d34cfef639 100644
--- a/usr.sbin/bhyve/pci_fbuf.c
+++ b/usr.sbin/bhyve/pci_fbuf.c
@@ -232,7 +232,8 @@ pci_fbuf_baraddr(struct pci_devinst *pi, int baridx, int enabled,
 		if (vm_mmap_memseg(pi->pi_vmctx, address, VM_FRAMEBUFFER, 0,
 		    FB_SIZE, prot) != 0)
 			EPRINTLN("pci_fbuf: mmap_memseg failed");
-		sc->fbaddr = address;
+		else
+			sc->fbaddr = address;
 	}
 }