From nobody Tue May 7 01:57:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1542739388690906.3998189220849; Tue, 20 Nov 2018 10:43:08 -0800 (PST) Received: from localhost ([::1]:35389 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gPAzH-0002iO-LZ for importer@patchew.org; Tue, 20 Nov 2018 13:43:03 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56875) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gPAyH-000286-5H for qemu-devel@nongnu.org; Tue, 20 Nov 2018 13:42:03 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gPAyF-0007oL-5l for qemu-devel@nongnu.org; Tue, 20 Nov 2018 13:42:01 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51152) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gPAy9-0007fi-A2; Tue, 20 Nov 2018 13:41:53 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 65EFA3082B45; Tue, 20 Nov 2018 18:41:51 +0000 (UTC) Received: from donizetti.redhat.com (ovpn-112-62.ams2.redhat.com [10.36.112.62]) by smtp.corp.redhat.com (Postfix) with ESMTP id 6A1A7100164A; Tue, 20 Nov 2018 18:41:49 +0000 (UTC) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 20 Nov 2018 19:41:48 +0100 Message-Id: <20181120184148.22501-1-pbonzini@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Tue, 20 Nov 2018 18:41:51 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] nvme: fix out-of-bounds access to the CMB X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, Keith Busch , Li Qiang , qemu-block@nongnu.org, mreitz@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch Cc: qemu-block@nongnu.org Reported-by: Li Qiang Reviewed-by: Li Qiang Tested-by: Li Qiang Signed-off-by: Paolo Bonzini Reviewed-by: Philippe Mathieu-Daud=C3=A9 Tested-by: Philippe Mathieu-Daud=C3=A9 --- hw/block/nvme.c | 2 +- tests/Makefile.include | 2 +- tests/nvme-test.c | 68 +++++++++++++++++++++++++++++++++++------- 3 files changed, 60 insertions(+), 12 deletions(-) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index d0226e7fdc..ef046bbc54 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -1199,7 +1199,7 @@ static const MemoryRegionOps nvme_cmb_ops =3D { .write =3D nvme_cmb_write, .endianness =3D DEVICE_LITTLE_ENDIAN, .impl =3D { - .min_access_size =3D 2, + .min_access_size =3D 1, .max_access_size =3D 8, }, }; diff --git a/tests/Makefile.include b/tests/Makefile.include index 613242bc6e..fb0b449c02 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -730,7 +730,7 @@ tests/test-hmp$(EXESUF): tests/test-hmp.o tests/machine-none-test$(EXESUF): tests/machine-none-test.o tests/drive_del-test$(EXESUF): tests/drive_del-test.o $(libqos-virtio-obj-= y) tests/qdev-monitor-test$(EXESUF): tests/qdev-monitor-test.o $(libqos-pc-ob= j-y) -tests/nvme-test$(EXESUF): tests/nvme-test.o +tests/nvme-test$(EXESUF): tests/nvme-test.o $(libqos-pc-obj-y) tests/pvpanic-test$(EXESUF): tests/pvpanic-test.o tests/i82801b11-test$(EXESUF): tests/i82801b11-test.o tests/ac97-test$(EXESUF): tests/ac97-test.o diff --git a/tests/nvme-test.c b/tests/nvme-test.c index 7674a446e4..2700ba838a 100644 --- a/tests/nvme-test.c +++ b/tests/nvme-test.c @@ -8,25 +8,73 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/units.h" #include "libqtest.h" +#include "libqos/libqos-pc.h" + +static QOSState *qnvme_start(const char *extra_opts) +{ + QOSState *qs; + const char *arch =3D qtest_get_arch(); + const char *cmd =3D "-drive id=3Ddrv0,if=3Dnone,file=3Dnull-co://,form= at=3Draw " + "-device nvme,addr=3D0x4.0,serial=3Dfoo,drive=3Ddrv0= %s"; + + if (strcmp(arch, "i386") =3D=3D 0 || strcmp(arch, "x86_64") =3D=3D 0) { + qs =3D qtest_pc_boot(cmd, extra_opts ? : ""); + global_qtest =3D qs->qts; + return qs; + } + + g_printerr("nvme tests are only available on x86\n"); + exit(EXIT_FAILURE); +} + +static void qnvme_stop(QOSState *qs) +{ + qtest_shutdown(qs); +} =20 -/* Tests only initialization so far. TODO: Replace with functional tests */ static void nop(void) { + QOSState *qs; + + qs =3D qnvme_start(NULL); + qnvme_stop(qs); } =20 -int main(int argc, char **argv) +static void nvmetest_cmb_test(void) { - int ret; + const int cmb_bar_size =3D 2 * MiB; + QOSState *qs; + QPCIDevice *pdev; + QPCIBar bar; =20 - g_test_init(&argc, &argv, NULL); - qtest_add_func("/nvme/nop", nop); + qs =3D qnvme_start("-global nvme.cmb_size_mb=3D2"); + pdev =3D qpci_device_find(qs->pcibus, QPCI_DEVFN(4,0)); + g_assert(pdev !=3D NULL); + + qpci_device_enable(pdev); + bar =3D qpci_iomap(pdev, 2, NULL); + + qpci_io_writel(pdev, bar, 0, 0xccbbaa99); + g_assert_cmpint(qpci_io_readb(pdev, bar, 0), =3D=3D, 0x99); + g_assert_cmpint(qpci_io_readw(pdev, bar, 0), =3D=3D, 0xaa99); + + /* Test partially out-of-bounds accesses. */ + qpci_io_writel(pdev, bar, cmb_bar_size - 1, 0x44332211); + g_assert_cmpint(qpci_io_readb(pdev, bar, cmb_bar_size - 1), =3D=3D, 0x= 11); + g_assert_cmpint(qpci_io_readw(pdev, bar, cmb_bar_size - 1), !=3D, 0x22= 11); + g_assert_cmpint(qpci_io_readl(pdev, bar, cmb_bar_size - 1), !=3D, 0x44= 332211); + g_free(pdev); =20 - qtest_start("-drive id=3Ddrv0,if=3Dnone,file=3Dnull-co://,format=3Draw= " - "-device nvme,drive=3Ddrv0,serial=3Dfoo"); - ret =3D g_test_run(); + qnvme_stop(qs); +} =20 - qtest_end(); +int main(int argc, char **argv) +{ + g_test_init(&argc, &argv, NULL); + qtest_add_func("/nvme/nop", nop); + qtest_add_func("/nvme/cmb_test", nvmetest_cmb_test); =20 - return ret; + return g_test_run(); } --=20 2.19.1