From nobody Thu Mar 28 09:35:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1544099371942908.2053057241683; Thu, 6 Dec 2018 04:29:31 -0800 (PST) Received: from localhost ([::1]:40471 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUsmY-0006bG-Lz for importer@patchew.org; Thu, 06 Dec 2018 07:29:30 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47555) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUsgX-0000y7-03 for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:23:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gUse3-0006fU-9p for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:20:49 -0500 Received: from mx1.redhat.com ([209.132.183.28]:56262) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gUse3-0006ee-3W for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:20:43 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 586782D804; Thu, 6 Dec 2018 12:20:42 +0000 (UTC) Received: from localhost.localdomain (unknown [10.33.36.3]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 998A310018FB; Thu, 6 Dec 2018 12:20:34 +0000 (UTC) From: P J P To: Qemu Developers Date: Thu, 6 Dec 2018 17:48:30 +0530 Message-Id: <20181206121830.6177-1-ppandit@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 06 Dec 2018 12:20:42 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v1] i2c: pm_smbus: check smb_index before block transfer write X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Prasad J Pandit , "Michael S . Tsirkin" , Michael Hanselmann , Igor Mammedov , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Prasad J Pandit While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann Signed-off-by: Prasad J Pandit Reviewed-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/i2c/pm_smbus.c | 3 +++ 1 file changed, 3 insertions(+) Update v1: add note about issue being introduced after 3.0 release -> https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01115.html diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c index 685a2378ed..03062740cc 100644 --- a/hw/i2c/pm_smbus.c +++ b/hw/i2c/pm_smbus.c @@ -240,6 +240,9 @@ static void smb_ioport_writeb(void *opaque, hwaddr addr= , uint64_t val, uint8_t read =3D s->smb_addr & 0x01; =20 s->smb_index++; + if (s->smb_index >=3D PM_SMBUS_MAX_MSG_SIZE) { + s->smb_index =3D 0; + } if (!read && s->smb_index =3D=3D s->smb_data0) { uint8_t prot =3D (s->smb_ctl >> 2) & 0x07; uint8_t cmd =3D s->smb_cmd; --=20 2.19.2