bhyve: Improve HDA stream descriptor validation

The length of each block in the stream must be non-zero.  This is
assumed in hda_transfer(), otherwise an out-of-bounds read or write is
possible.

Use atomic loads to access stream descriptor fields, since they are
guest-controlled.  Make sure that the descriptor array is suitably
aligned so that we can drop the __packed annotation from the structure
definition; per section 3.3.42 of the HDA spec the BDL pointer is
supposed to be 128-byte aligned, in fact.

Approved by:	so
Security:	FreeBSD-SA-26:72.bhyve
Security:	CVE-2026-101310
Reported by:	Brian Delgado from Intel using Anthropic Opus 4.8
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D60678

usr.sbin/bhyve/pci_hda.c

@@ -28,6 +28,9 @@
  */
 
 #include <sys/param.h>
+
+#include <machine/atomic.h>
+
 #include <time.h>
 
 #include "pci_hda.h"
@@ -81,7 +84,7 @@ struct hda_bdle {
 	uint32_t addrh;
 	uint32_t len;
 	uint32_t ioc;
-} __packed;
+};
 
 struct hda_bdle_desc {
 	void *addr;
@@ -624,8 +627,9 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 	bdl_paddr = bdpl | (bdpu << 32);
 	bdl_vaddr = hda_dma_get_vaddr(sc, bdl_paddr,
 	    HDA_BDL_ENTRY_LEN * bdl_cnt);
-	if (!bdl_vaddr) {
-		DPRINTF("Fail to get the guest virtual address");
+	if (bdl_vaddr == NULL ||
+	    (uintptr_t)bdl_vaddr % HDA_DMA_ACCESS_LEN != 0) {
+		DPRINTF("Invalid guest virtual address %p", bdl_vaddr);
 		return (-1);
 	}
 
@@ -636,11 +640,14 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 
 	bdle = (struct hda_bdle *)bdl_vaddr;
 	for (size_t i = 0; i < bdl_cnt; i++, bdle++) {
-		bdle_sz = bdle->len;
-		assert(!(bdle_sz % HDA_DMA_ACCESS_LEN));
+		bdle_sz = atomic_load_32(&bdle->len);
+		if (bdle_sz % HDA_DMA_ACCESS_LEN != 0 || bdle_sz == 0) {
+			DPRINTF("Invalid BDLE length: 0x%x", bdle_sz);
+			return (-1);
+		}
 
-		bdle_addrl = bdle->addrl;
-		bdle_addrh = bdle->addrh;
+		bdle_addrl = atomic_load_32(&bdle->addrl);
+		bdle_addrh = atomic_load_32(&bdle->addrh);
 
 		bdle_paddr = bdle_addrl | (bdle_addrh << 32);
 		bdle_vaddr = hda_dma_get_vaddr(sc, bdle_paddr, bdle_sz);
@@ -652,7 +659,7 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 		bdle_desc = &st->bdl[i];
 		bdle_desc->addr = bdle_vaddr;
 		bdle_desc->len = bdle_sz;
-		bdle_desc->ioc = bdle->ioc;
+		bdle_desc->ioc = atomic_load_32(&bdle->ioc);
 
 		DPRINTF("bdle: 0x%zx bdle_sz: 0x%x", i, bdle_sz);
 	}