From nobody Fri May 17 09:38:14 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1587191477; cv=none; d=zohomail.com; s=zohoarc; b=Bm7X/zrpueMdIbGQsTaAMvdZg9KxUK9wdlJ5Xi1DVY9TkybelXVzIRx20ToGlvnMWXNnrtN4Dt8HWuVngqcElKXDZWyo+DTU8ZQKP9FuX+/+6CJwIWZoPh7kVRpmN8XY6UTVUPou3uMt0UDTHyuMCWEJAYbaNyrWCfbngn81F4Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1587191477; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=ruMjsCdp6XIYYcEjdI8titJDCNQb6PeOU2j4eKSmmEs=; b=QC4Qmi6+ve4fk+NxllWY8X3HqWUB1sDI6yZyIZhruDg+X6Wfn63njhrjAgExlNkvagM4fHT8khtCfgqKuj4Ku0J/cmJAW7rGzhPBuKtGncbmm/Svv+i3QdUjxlLYDuKFHMVMkAngRpRRMcc9LXW5RvGpd5g41lPQ/C+WnHFIIe0= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1587191477405338.39530943130524; Fri, 17 Apr 2020 23:31:17 -0700 (PDT) Received: from localhost ([::1]:55222 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jPh0T-0002wj-Qq for importer@patchew.org; Sat, 18 Apr 2020 02:31:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39148) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jPgwO-00026r-R2 for qemu-devel@nongnu.org; Sat, 18 Apr 2020 02:27:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jPgwM-0006TS-Fx for qemu-devel@nongnu.org; Sat, 18 Apr 2020 02:26:59 -0400 Received: from szxga04-in.huawei.com ([45.249.212.190]:3673 helo=huawei.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jPgwE-0004N2-Tu; Sat, 18 Apr 2020 02:26:51 -0400 Received: from DGGEMS404-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id A998E56E407A6C3971DD; Sat, 18 Apr 2020 14:26:32 +0800 (CST) Received: from huawei.com (10.133.205.93) by DGGEMS404-HUB.china.huawei.com (10.3.19.204) with Microsoft SMTP Server id 14.3.487.0; Sat, 18 Apr 2020 14:26:23 +0800 From: Chen Qun To: , Subject: [PATCH] block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb Date: Sat, 18 Apr 2020 14:26:02 +0800 Message-ID: <20200418062602.10776-1-kuhn.chenqun@huawei.com> X-Mailer: git-send-email 2.21.0.windows.1 MIME-Version: 1.0 X-Originating-IP: [10.133.205.93] X-CFilter-Loop: Reflected Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 45.249.212.190 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , zhang.zhanghailiang@huawei.com, qemu-block@nongnu.org, "Michael S . Tsirkin" , Peter Lieven , Prasad J Pandit , Paolo Bonzini , Stefan Hajnoczi , Euler Robot , Chen Qun , Max Reitz , Ronnie Sahlberg Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" There is an overflow, the source 'datain.data[2]' is 100 bytes, but the 'ss' is 252 bytes.This may cause a security issue because we can access a lot of unrelated memory data. The len for sbp copy data should take the minimum of mx_sb_len and sb_len_wr, not the maximum. If we use iscsi device for VM backend storage, ASAN show stack: READ of size 252 at 0xfffd149dcfc4 thread T0 #0 0xaaad433d0d34 in __asan_memcpy (aarch64-softmmu/qemu-system-aarch64= +0x2cb0d34) #1 0xaaad45f9d6d0 in iscsi_aio_ioctl_cb /qemu/block/iscsi.c:996:9 #2 0xfffd1af0e2dc (/usr/lib64/iscsi/libiscsi.so.8+0xe2dc) #3 0xfffd1af0d174 (/usr/lib64/iscsi/libiscsi.so.8+0xd174) #4 0xfffd1af19fac (/usr/lib64/iscsi/libiscsi.so.8+0x19fac) #5 0xaaad45f9acc8 in iscsi_process_read /qemu/block/iscsi.c:403:5 #6 0xaaad4623733c in aio_dispatch_handler /qemu/util/aio-posix.c:467:9 #7 0xaaad4622f350 in aio_dispatch_handlers /qemu/util/aio-posix.c:510:20 #8 0xaaad4622f350 in aio_dispatch /qemu/util/aio-posix.c:520 #9 0xaaad46215944 in aio_ctx_dispatch /qemu/util/async.c:298:5 #10 0xfffd1bed12f4 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+= 0x512f4) #11 0xaaad46227de0 in glib_pollfds_poll /qemu/util/main-loop.c:219:9 #12 0xaaad46227de0 in os_host_main_loop_wait /qemu/util/main-loop.c:242 #13 0xaaad46227de0 in main_loop_wait /qemu/util/main-loop.c:518 #14 0xaaad43d9d60c in qemu_main_loop /qemu/softmmu/vl.c:1662:9 #15 0xaaad4607a5b0 in main /qemu/softmmu/main.c:49:5 #16 0xfffd1a460b9c in __libc_start_main (/lib64/libc.so.6+0x20b9c) #17 0xaaad43320740 in _start (aarch64-softmmu/qemu-system-aarch64+0x2c0= 0740) 0xfffd149dcfc4 is located 0 bytes to the right of 100-byte region [0xfffd14= 9dcf60,0xfffd149dcfc4) allocated by thread T0 here: #0 0xaaad433d1e70 in __interceptor_malloc (aarch64-softmmu/qemu-system-= aarch64+0x2cb1e70) #1 0xfffd1af0e254 (/usr/lib64/iscsi/libiscsi.so.8+0xe254) #2 0xfffd1af0d174 (/usr/lib64/iscsi/libiscsi.so.8+0xd174) #3 0xfffd1af19fac (/usr/lib64/iscsi/libiscsi.so.8+0x19fac) #4 0xaaad45f9acc8 in iscsi_process_read /qemu/block/iscsi.c:403:5 #5 0xaaad4623733c in aio_dispatch_handler /qemu/util/aio-posix.c:467:9 #6 0xaaad4622f350 in aio_dispatch_handlers /qemu/util/aio-posix.c:510:20 #7 0xaaad4622f350 in aio_dispatch /qemu/util/aio-posix.c:520 #8 0xaaad46215944 in aio_ctx_dispatch /qemu/util/async.c:298:5 #9 0xfffd1bed12f4 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0= x512f4) #10 0xaaad46227de0 in glib_pollfds_poll /qemu/util/main-loop.c:219:9 #11 0xaaad46227de0 in os_host_main_loop_wait /qemu/util/main-loop.c:242 #12 0xaaad46227de0 in main_loop_wait /qemu/util/main-loop.c:518 #13 0xaaad43d9d60c in qemu_main_loop /qemu/softmmu/vl.c:1662:9 #14 0xaaad4607a5b0 in main /qemu/softmmu/main.c:49:5 #15 0xfffd1a460b9c in __libc_start_main (/lib64/libc.so.6+0x20b9c) #16 0xaaad43320740 in _start (aarch64-softmmu/qemu-system-aarch64+0x2c0= 0740) Reported-by: Euler Robot Signed-off-by: Chen Qun Reviewed-by: Stefan Hajnoczi Reviewed-by: Daniel P. Berrang=C3=A9 --- v1->v2: Use MIN() macro for mx_sb_len and sb_len_wr. (Base comments from Michael S. Tsirkin, Stefan Hajnoczi, Kevin Wolf) Cc: Stefan Hajnoczi Cc: Kevin Wolf Cc: Michael S. Tsirkin Cc: Prasad J Pandit Cc: Max Reitz Cc: Paolo Bonzini Cc: Peter Lieven Cc: Ronnie Sahlberg Cc: qemu-block@nongnu.org --- block/iscsi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/block/iscsi.c b/block/iscsi.c index 4e216bd8aa..0b4b7210df 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -991,8 +991,7 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int sta= tus, acb->ioh->driver_status |=3D SG_ERR_DRIVER_SENSE; =20 acb->ioh->sb_len_wr =3D acb->task->datain.size - 2; - ss =3D (acb->ioh->mx_sb_len >=3D acb->ioh->sb_len_wr) ? - acb->ioh->mx_sb_len : acb->ioh->sb_len_wr; + ss =3D MIN(acb->ioh->mx_sb_len, acb->ioh->sb_len_wr); memcpy(acb->ioh->sbp, &acb->task->datain.data[2], ss); } =20 --=20 2.23.0