[PATCH v7 06/22] hvf: Fix OOB write in RDTSCP instruction decode

Philippe Mathieu-Daudé posted 22 patches 3 years, 11 months ago
Maintainers: "Alex Bennée" <alex.bennee@linaro.org>, "Philippe Mathieu-Daudé" <f4bug@amsat.org>, Thomas Huth <thuth@redhat.com>, Wainer dos Santos Moschetta <wainersm@redhat.com>, Beraldo Leal <bleal@redhat.com>, Gerd Hoffmann <kraxel@redhat.com>, Christian Schoenebeck <qemu_oss@crudebyte.com>, Akihiko Odaki <akihiko.odaki@gmail.com>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>, Eric Blake <eblake@redhat.com>, Markus Armbruster <armbru@redhat.com>, Cameron Esfahani <dirty@apple.com>, Roman Bolshakov <r.bolshakov@yadro.com>, Aurelien Jarno <aurelien@aurel32.net>, Peter Maydell <peter.maydell@linaro.org>
[PATCH v7 06/22] hvf: Fix OOB write in RDTSCP instruction decode
Posted by Philippe Mathieu-Daudé 3 years, 11 months ago
From: Cameron Esfahani <dirty@apple.com>

A guest could craft a specific stream of instructions that will have QEMU
write 0xF9 to inappropriate locations in memory.  Add additional asserts
to check for this.  Generate a #UD if there are more than 14 prefix bytes.

Found by Julian Stecklina <julian.stecklina@cyberus-technology.de>

Signed-off-by: Cameron Esfahani <dirty@apple.com>
Message-Id: <20220219063831.35356-1-dirty@apple.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/i386/hvf/x86_decode.c | 12 ++++++++++--
 target/i386/hvf/x86hvf.c     |  8 ++++++++
 target/i386/hvf/x86hvf.h     |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/target/i386/hvf/x86_decode.c b/target/i386/hvf/x86_decode.c
index 062713b1a4..5d051252b4 100644
--- a/target/i386/hvf/x86_decode.c
+++ b/target/i386/hvf/x86_decode.c
@@ -24,8 +24,10 @@
 #include "vmx.h"
 #include "x86_mmu.h"
 #include "x86_descr.h"
+#include "x86hvf.h"
 
 #define OPCODE_ESCAPE   0xf
+#define X86_MAX_INSN_PREFIX_LENGTH (14)
 
 static void decode_invalid(CPUX86State *env, struct x86_decode *decode)
 {
@@ -541,7 +543,8 @@ static void decode_lidtgroup(CPUX86State *env, struct x86_decode *decode)
     };
     decode->cmd = group[decode->modrm.reg];
     if (0xf9 == decode->modrm.modrm) {
-        decode->opcode[decode->len++] = decode->modrm.modrm;
+        VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
+        decode->opcode[decode->opcode_len++] = decode->modrm.modrm;
         decode->cmd = X86_DECODE_CMD_RDTSCP;
     }
 }
@@ -1847,7 +1850,8 @@ void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
 
 static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
 {
-    while (1) {
+    /* At most X86_MAX_INSN_PREFIX_LENGTH prefix bytes. */
+    for (int i = 0; i < X86_MAX_INSN_PREFIX_LENGTH; i++) {
         /*
          * REX prefix must come after legacy prefixes.
          * REX before legacy is ignored.
@@ -1892,6 +1896,8 @@ static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
             return;
         }
     }
+    /* Too many prefixes!  Generate #UD. */
+    hvf_inject_ud(env);
 }
 
 void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
@@ -2090,11 +2096,13 @@ static void decode_opcodes(CPUX86State *env, struct x86_decode *decode)
     uint8_t opcode;
 
     opcode = decode_byte(env, decode);
+    VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
     decode->opcode[decode->opcode_len++] = opcode;
     if (opcode != OPCODE_ESCAPE) {
         decode_opcode_1(env, decode, opcode);
     } else {
         opcode = decode_byte(env, decode);
+        VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
         decode->opcode[decode->opcode_len++] = opcode;
         decode_opcode_2(env, decode, opcode);
     }
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index bec9fc5814..a338c207b7 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -423,6 +423,14 @@ bool hvf_inject_interrupts(CPUState *cpu_state)
             & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR));
 }
 
+void hvf_inject_ud(CPUX86State *env)
+{
+    env->exception_nr = EXCP06_ILLOP;
+    env->exception_injected = 1;
+    env->has_error_code = false;
+    env->error_code = 0;
+}
+
 int hvf_process_events(CPUState *cpu_state)
 {
     X86CPU *cpu = X86_CPU(cpu_state);
diff --git a/target/i386/hvf/x86hvf.h b/target/i386/hvf/x86hvf.h
index db6003d6bd..427cdc1c13 100644
--- a/target/i386/hvf/x86hvf.h
+++ b/target/i386/hvf/x86hvf.h
@@ -22,6 +22,7 @@
 
 int hvf_process_events(CPUState *);
 bool hvf_inject_interrupts(CPUState *);
+void hvf_inject_ud(CPUX86State *);
 void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr);
 void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg);
-- 
2.34.1


Re: [PATCH v7 06/22] hvf: Fix OOB write in RDTSCP instruction decode
Posted by Philippe Mathieu-Daudé 3 years, 11 months ago
Hi Paolo,

I forgot to Cc you. Could you Ack this patch?

On 7/3/22 00:17, Philippe Mathieu-Daudé wrote:
> From: Cameron Esfahani <dirty@apple.com>
> 
> A guest could craft a specific stream of instructions that will have QEMU
> write 0xF9 to inappropriate locations in memory.  Add additional asserts
> to check for this.  Generate a #UD if there are more than 14 prefix bytes.
> 
> Found by Julian Stecklina <julian.stecklina@cyberus-technology.de>
> 
> Signed-off-by: Cameron Esfahani <dirty@apple.com>
> Message-Id: <20220219063831.35356-1-dirty@apple.com>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>   target/i386/hvf/x86_decode.c | 12 ++++++++++--
>   target/i386/hvf/x86hvf.c     |  8 ++++++++
>   target/i386/hvf/x86hvf.h     |  1 +
>   3 files changed, 19 insertions(+), 2 deletions(-)
> 
> diff --git a/target/i386/hvf/x86_decode.c b/target/i386/hvf/x86_decode.c
> index 062713b1a4..5d051252b4 100644
> --- a/target/i386/hvf/x86_decode.c
> +++ b/target/i386/hvf/x86_decode.c
> @@ -24,8 +24,10 @@
>   #include "vmx.h"
>   #include "x86_mmu.h"
>   #include "x86_descr.h"
> +#include "x86hvf.h"
>   
>   #define OPCODE_ESCAPE   0xf
> +#define X86_MAX_INSN_PREFIX_LENGTH (14)
>   
>   static void decode_invalid(CPUX86State *env, struct x86_decode *decode)
>   {
> @@ -541,7 +543,8 @@ static void decode_lidtgroup(CPUX86State *env, struct x86_decode *decode)
>       };
>       decode->cmd = group[decode->modrm.reg];
>       if (0xf9 == decode->modrm.modrm) {
> -        decode->opcode[decode->len++] = decode->modrm.modrm;
> +        VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
> +        decode->opcode[decode->opcode_len++] = decode->modrm.modrm;
>           decode->cmd = X86_DECODE_CMD_RDTSCP;
>       }
>   }
> @@ -1847,7 +1850,8 @@ void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
>   
>   static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
>   {
> -    while (1) {
> +    /* At most X86_MAX_INSN_PREFIX_LENGTH prefix bytes. */
> +    for (int i = 0; i < X86_MAX_INSN_PREFIX_LENGTH; i++) {
>           /*
>            * REX prefix must come after legacy prefixes.
>            * REX before legacy is ignored.
> @@ -1892,6 +1896,8 @@ static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
>               return;
>           }
>       }
> +    /* Too many prefixes!  Generate #UD. */
> +    hvf_inject_ud(env);
>   }
>   
>   void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
> @@ -2090,11 +2096,13 @@ static void decode_opcodes(CPUX86State *env, struct x86_decode *decode)
>       uint8_t opcode;
>   
>       opcode = decode_byte(env, decode);
> +    VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
>       decode->opcode[decode->opcode_len++] = opcode;
>       if (opcode != OPCODE_ESCAPE) {
>           decode_opcode_1(env, decode, opcode);
>       } else {
>           opcode = decode_byte(env, decode);
> +        VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
>           decode->opcode[decode->opcode_len++] = opcode;
>           decode_opcode_2(env, decode, opcode);
>       }
> diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
> index bec9fc5814..a338c207b7 100644
> --- a/target/i386/hvf/x86hvf.c
> +++ b/target/i386/hvf/x86hvf.c
> @@ -423,6 +423,14 @@ bool hvf_inject_interrupts(CPUState *cpu_state)
>               & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR));
>   }
>   
> +void hvf_inject_ud(CPUX86State *env)
> +{
> +    env->exception_nr = EXCP06_ILLOP;
> +    env->exception_injected = 1;
> +    env->has_error_code = false;
> +    env->error_code = 0;
> +}
> +
>   int hvf_process_events(CPUState *cpu_state)
>   {
>       X86CPU *cpu = X86_CPU(cpu_state);
> diff --git a/target/i386/hvf/x86hvf.h b/target/i386/hvf/x86hvf.h
> index db6003d6bd..427cdc1c13 100644
> --- a/target/i386/hvf/x86hvf.h
> +++ b/target/i386/hvf/x86hvf.h
> @@ -22,6 +22,7 @@
>   
>   int hvf_process_events(CPUState *);
>   bool hvf_inject_interrupts(CPUState *);
> +void hvf_inject_ud(CPUX86State *);
>   void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
>                        SegmentCache *qseg, bool is_tr);
>   void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg);


Re: [PATCH v7 06/22] hvf: Fix OOB write in RDTSCP instruction decode
Posted by Peter Maydell 3 years, 11 months ago
On Wed, 9 Mar 2022 at 10:20, Philippe Mathieu-Daudé
<philippe.mathieu.daude@gmail.com> wrote:
>
> Hi Paolo,
>
> I forgot to Cc you. Could you Ack this patch?

I had review comments on the version of this patch in v5 which
still need to be addressed:

https://lore.kernel.org/qemu-devel/CAFEAcA8yaBOD3KXc-DY94oqzC5wkCENPkePgVCybqR=9NmdQFQ@mail.gmail.com/

thanks
-- PMM
Re: [PATCH v7 06/22] hvf: Fix OOB write in RDTSCP instruction decode
Posted by Philippe Mathieu-Daudé 3 years, 11 months ago
On 15/3/22 13:58, Peter Maydell wrote:
> On Wed, 9 Mar 2022 at 10:20, Philippe Mathieu-Daudé
> <philippe.mathieu.daude@gmail.com> wrote:
>>
>> Hi Paolo,
>>
>> I forgot to Cc you. Could you Ack this patch?
> 
> I had review comments on the version of this patch in v5 which
> still need to be addressed:
> 
> https://lore.kernel.org/qemu-devel/CAFEAcA8yaBOD3KXc-DY94oqzC5wkCENPkePgVCybqR=9NmdQFQ@mail.gmail.com/

Thanks for pointing at your comments, I totally missed them.

I'll let Cameron address them.

Regards,

Phil.