From nobody Tue May 7 20:52:10 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1542644893908607.0815632184808; Mon, 19 Nov 2018 08:28:13 -0800 (PST) Received: from localhost ([::1]:57607 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gOmP4-0004DL-K1 for importer@patchew.org; Mon, 19 Nov 2018 11:28:02 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55076) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gOmOD-0003ls-SD for qemu-devel@nongnu.org; Mon, 19 Nov 2018 11:27:10 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gOmOB-0007iX-Pe for qemu-devel@nongnu.org; Mon, 19 Nov 2018 11:27:09 -0500 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:52682) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gOmOA-0007gp-6f for qemu-devel@nongnu.org; Mon, 19 Nov 2018 11:27:07 -0500 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1gOmO5-000683-9Y; Mon, 19 Nov 2018 16:27:01 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 19 Nov 2018 16:26:58 +0000 Message-Id: <20181119162658.30358-1-peter.maydell@linaro.org> X-Mailer: git-send-email 2.19.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PATCH for-3.1] hw/xen/xen_pt_graphics: Don't trust the BIOS ROM contents so much X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Anthony Perard , xen-devel@lists.xenproject.org, Stefano Stabellini , patches@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" Coverity (CID 796599) points out that xen_pt_setup_vga() trusts the rom->size field in the BIOS ROM from a PCI passthrough VGA device, and uses it as an index into the memory which contains the BIOS image. A corrupt BIOS ROM could therefore cause us to index off the end of the buffer. Check that the size is within bounds before we use it. We are also trusting the pcioffset field, and assuming that the whole rom_header is present; Coverity doesn't notice these, but check them too. Signed-off-by: Peter Maydell Acked-by: Anthony PERARD --- Disclaimer: compile tested only, as I don't have a Xen setup, let alone one with pass-through PCI graphics. Note that https://xenbits.xen.org/xsa/advisory-124.html defines that bugs which are only exploitable by a malicious piece of hardware that is passed through to the guest are not security vulnerabilities as far as the Xen Project is concerned, and are treated like normal non-security-related bugs. So this is just a bugfix, not a security issue. Marked "for-3.1" because it would let us squash another Coverity issue, and it is a bug fix; on the other hand it's an obscure corner case and has been this way since forever. --- hw/xen/xen_pt_graphics.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/hw/xen/xen_pt_graphics.c b/hw/xen/xen_pt_graphics.c index 135c8df1e72..60d6b4a5563 100644 --- a/hw/xen/xen_pt_graphics.c +++ b/hw/xen/xen_pt_graphics.c @@ -185,8 +185,19 @@ void xen_pt_setup_vga(XenPCIPassthroughState *s, XenHo= stPCIDevice *dev, return; } =20 + if (bios_size < sizeof(struct rom_header)) { + error_setg(errp, "VGA: VBIOS image corrupt (too small)"); + return; + } + /* Currently we fixed this address as a primary. */ rom =3D (struct rom_header *)bios; + + if (rom->pcioffset + sizeof(struct pci_data) > bios_size) { + error_setg(errp, "VGA: VBIOS image corrupt (bad pcioffset field)"); + return; + } + pd =3D (void *)(bios + (unsigned char)rom->pcioffset); =20 /* We may need to fixup Device Identification. */ @@ -194,6 +205,11 @@ void xen_pt_setup_vga(XenPCIPassthroughState *s, XenHo= stPCIDevice *dev, pd->device =3D s->real_device.device_id; =20 len =3D rom->size * 512; + if (len > bios_size) { + error_setg(errp, "VGA: VBIOS image corrupt (bad size field)"); + return; + } + /* Then adjust the bios checksum */ for (c =3D (char *)bios; c < ((char *)bios + len); c++) { checksum +=3D *c; --=20 2.19.1