From nobody Sun Nov 16 07:41:05 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=163.com ARC-Seal: i=1; a=rsa-sha256; t=1599063828; cv=none; d=zohomail.com; s=zohoarc; b=SXdJhiHAHvVPDe1SvdLGucHu06dytAwI9bcUWmPIlHxloeVqKxR3CsE91wC1e3Mt+tJieAdEvKsGi2JyPZ4GTFtgJbafUuYdVX1Wj06wunoSBkQ8TS/XkwdfHGG+PfV1tF12GdbrJ6+Jnf3sl/z3Vinffs9UdvrBHRYAQjpzdGs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1599063828; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=qCEdw/S4IrIs/afZWIaYzQk1WsGow2KZ0FANMJCyoOQ=; b=PHTfDR3A7pxGnqHI4Ib9xrwzVJwG9oZBtg57BqSR5moAmR4tAGAczUjY7VLWbzwS3DeYv3J7chGGLCUh8jNVO4U8pf88QRIaYXfyDvcjQ7KlA7ehiwNf/l/r1H//6hsnsU44xbEzLAcNfBzw119O5xU3PjwXG8NCvJwSm7cv2pc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1599063828320341.3839545811528; Wed, 2 Sep 2020 09:23:48 -0700 (PDT) Received: from localhost ([::1]:47428 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kDVY3-0004E2-Jx for importer@patchew.org; Wed, 02 Sep 2020 12:23:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:35246) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kDVWw-0002wV-TD for qemu-devel@nongnu.org; Wed, 02 Sep 2020 12:22:38 -0400 Received: from mail-m971.mail.163.com ([123.126.97.1]:43446) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kDVWt-0002vA-DG for qemu-devel@nongnu.org; Wed, 02 Sep 2020 12:22:38 -0400 Received: from localhost.localdomain (unknown [183.134.168.235]) by smtp1 (Coremail) with SMTP id GdxpCgAXbyO1xk9fAIYUAQ--.82S6; Thu, 03 Sep 2020 00:22:21 +0800 (CST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id; bh=qCEdw/S4IrIs/afZWI aYzQk1WsGow2KZ0FANMJCyoOQ=; b=MHMJuaQEigh+oLRlL5wycuh91eBxrmyLBS BKG6IFYZ/M6+p9Cw5ARtXB/NF9AlwMnKbds7XBzTcZT1nf3EzGZQB+2Btj+0WaQY lGweTRpH42+BS4sUJEx9IxtZK3miQtHeZwl5Wnj3xsdaICvrTn1lLobhJ2ROG5f4 ySh4D1gZ4= From: Li Qiang To: mst@redhat.com, kraxel@redhat.com, dmitry.fleytman@gmail.com, jasowang@redhat.com, alxndr@bu.edu, peter.maydell@linaro.org, pbonzini@redhat.com Subject: [RFC 2/3] xhci: make the IO handler reentrant Date: Wed, 2 Sep 2020 09:22:05 -0700 Message-Id: <20200902162206.101872-3-liq3ea@163.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200902162206.101872-1-liq3ea@163.com> References: <20200902162206.101872-1-liq3ea@163.com> X-CM-TRANSID: GdxpCgAXbyO1xk9fAIYUAQ--.82S6 X-Coremail-Antispam: 1Uf129KBjvJXoWxuFWrur4kWrWxCw4kCrW7Jwb_yoW7tr4rpF W0y34qgF4ftFsFgFs3J3yDAr15Grs7JF93Jr9xtryjvF4kAr9Ik3WayrWUtrsxWFy8G3yj 9F4DZFyYkrnIyaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UdGYJUUUUU= X-Originating-IP: [183.134.168.235] X-CM-SenderInfo: 5oltjvrd6rljoofrz/1tbiKR2TbVXlxi+gwAAAsz Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=123.126.97.1; envelope-from=liq3ea@163.com; helo=mail-m971.mail.163.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/09/02 12:22:24 X-ACL-Warn: Detected OS = Linux 3.1-3.10 X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Li Qiang , liq3ea@gmail.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @163.com) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The guest can program the xhci DMA address to its MMIO. This will cause an UAF issue. Following is the reproducer: cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ -trace usb\* -device usb-audio -device usb-storage,drive=3Dmydrive \ -drive id=3Dmydrive,file=3Dnull-co://,size=3D2M,format=3Draw,if=3Dnone \ -nodefaults -nographic -qtest stdio outl 0xcf8 0x80001010 outl 0xcfc 0xc0202 outl 0xcf8 0x80001004 outl 0xcfc 0x1c77695e writel 0xc0040 0xffffd855 writeq 0xc2000 0xff05140100000000 write 0x1d 0x1 0x27 write 0x2d 0x1 0x2e write 0x17232 0x1 0x03 write 0x17254 0x1 0x05 write 0x17276 0x1 0x72 write 0x17278 0x1 0x02 write 0x3d 0x1 0x27 write 0x40 0x1 0x2e write 0x41 0x1 0x72 write 0x42 0x1 0x01 write 0x4d 0x1 0x2e write 0x4f 0x1 0x01 write 0x2007c 0x1 0xc7 writeq 0xc2000 0x5c05140100000000 write 0x20070 0x1 0x80 write 0x20078 0x1 0x08 write 0x2007c 0x1 0xfe write 0x2007d 0x1 0x08 write 0x20081 0x1 0xff write 0x20082 0x1 0x0b write 0x20089 0x1 0x8c write 0x2008d 0x1 0x04 write 0x2009d 0x1 0x10 writeq 0xc2000 0x2505ef019e092f00 EOF This patch avoid this by adding a 'in_io' in XHCIState to indicate it is in= IO processing. Buglink: https://bugs.launchpad.net/qemu/+bug/1891354 Reported-by: Alexander Bulekov Signed-off-by: Li Qiang --- hw/usb/hcd-xhci.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++ hw/usb/hcd-xhci.h | 1 + 2 files changed, 61 insertions(+) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 46a2186d91..06cd235123 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -2738,6 +2738,11 @@ static uint64_t xhci_cap_read(void *ptr, hwaddr reg,= unsigned size) XHCIState *xhci =3D ptr; uint32_t ret; =20 + if (xhci->in_io) { + return 0; + } + xhci->in_io =3D true; + switch (reg) { case 0x00: /* HCIVERSION, CAPLENGTH */ ret =3D 0x01000000 | LEN_CAP; @@ -2805,6 +2810,9 @@ static uint64_t xhci_cap_read(void *ptr, hwaddr reg, = unsigned size) } =20 trace_usb_xhci_cap_read(reg, ret); + + xhci->in_io =3D false; + return ret; } =20 @@ -2813,6 +2821,11 @@ static uint64_t xhci_port_read(void *ptr, hwaddr reg= , unsigned size) XHCIPort *port =3D ptr; uint32_t ret; =20 + if (port->xhci->in_io) { + return 0; + } + port->xhci->in_io =3D true; + switch (reg) { case 0x00: /* PORTSC */ ret =3D port->portsc; @@ -2828,6 +2841,9 @@ static uint64_t xhci_port_read(void *ptr, hwaddr reg,= unsigned size) } =20 trace_usb_xhci_port_read(port->portnr, reg, ret); + + port->xhci->in_io =3D false; + return ret; } =20 @@ -2837,6 +2853,11 @@ static void xhci_port_write(void *ptr, hwaddr reg, XHCIPort *port =3D ptr; uint32_t portsc, notify; =20 + if (port->xhci->in_io) { + return; + } + port->xhci->in_io =3D true; + trace_usb_xhci_port_write(port->portnr, reg, val); =20 switch (reg) { @@ -2896,6 +2917,7 @@ static void xhci_port_write(void *ptr, hwaddr reg, default: trace_usb_xhci_unimplemented("port write", reg); } + port->xhci->in_io =3D false; } =20 static uint64_t xhci_oper_read(void *ptr, hwaddr reg, unsigned size) @@ -2903,6 +2925,11 @@ static uint64_t xhci_oper_read(void *ptr, hwaddr reg= , unsigned size) XHCIState *xhci =3D ptr; uint32_t ret; =20 + if (xhci->in_io) { + return 0; + } + xhci->in_io =3D true; + switch (reg) { case 0x00: /* USBCMD */ ret =3D xhci->usbcmd; @@ -2937,6 +2964,9 @@ static uint64_t xhci_oper_read(void *ptr, hwaddr reg,= unsigned size) } =20 trace_usb_xhci_oper_read(reg, ret); + + xhci->in_io =3D false; + return ret; } =20 @@ -2946,6 +2976,11 @@ static void xhci_oper_write(void *ptr, hwaddr reg, XHCIState *xhci =3D ptr; DeviceState *d =3D DEVICE(ptr); =20 + if (xhci->in_io) { + return; + } + xhci->in_io =3D true; + trace_usb_xhci_oper_write(reg, val); =20 switch (reg) { @@ -3008,6 +3043,7 @@ static void xhci_oper_write(void *ptr, hwaddr reg, default: trace_usb_xhci_unimplemented("oper write", reg); } + xhci->in_io =3D false; } =20 static uint64_t xhci_runtime_read(void *ptr, hwaddr reg, @@ -3016,6 +3052,11 @@ static uint64_t xhci_runtime_read(void *ptr, hwaddr = reg, XHCIState *xhci =3D ptr; uint32_t ret =3D 0; =20 + if (xhci->in_io) { + return 0; + } + xhci->in_io =3D true; + if (reg < 0x20) { switch (reg) { case 0x00: /* MFINDEX */ @@ -3054,6 +3095,9 @@ static uint64_t xhci_runtime_read(void *ptr, hwaddr r= eg, } =20 trace_usb_xhci_runtime_read(reg, ret); + + xhci->in_io =3D false; + return ret; } =20 @@ -3063,10 +3107,17 @@ static void xhci_runtime_write(void *ptr, hwaddr re= g, XHCIState *xhci =3D ptr; int v =3D (reg - 0x20) / 0x20; XHCIInterrupter *intr =3D &xhci->intr[v]; + + if (xhci->in_io) { + return; + } + xhci->in_io =3D true; + trace_usb_xhci_runtime_write(reg, val); =20 if (reg < 0x20) { trace_usb_xhci_unimplemented("runtime write", reg); + xhci->in_io =3D false; return; } =20 @@ -3121,6 +3172,7 @@ static void xhci_runtime_write(void *ptr, hwaddr reg, default: trace_usb_xhci_unimplemented("oper write", reg); } + xhci->in_io =3D false; } =20 static uint64_t xhci_doorbell_read(void *ptr, hwaddr reg, @@ -3137,10 +3189,17 @@ static void xhci_doorbell_write(void *ptr, hwaddr r= eg, XHCIState *xhci =3D ptr; unsigned int epid, streamid; =20 + if (xhci->in_io) { + return; + } + + xhci->in_io =3D true; + trace_usb_xhci_doorbell_write(reg, val); =20 if (!xhci_running(xhci)) { DPRINTF("xhci: wrote doorbell while xHC stopped or paused\n"); + xhci->in_io =3D false; return; } =20 @@ -3165,6 +3224,7 @@ static void xhci_doorbell_write(void *ptr, hwaddr reg, xhci_kick_ep(xhci, reg, epid, streamid); } } + xhci->in_io =3D false; } =20 static void xhci_cap_write(void *opaque, hwaddr addr, uint64_t val, diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h index 946af51fc2..ed16232c96 100644 --- a/hw/usb/hcd-xhci.h +++ b/hw/usb/hcd-xhci.h @@ -227,6 +227,7 @@ struct XHCIState { XHCIRing cmd_ring; =20 bool nec_quirks; + bool in_io; }; =20 #endif --=20 2.17.1