From nobody Tue Feb 10 15:29:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=linux.alibaba.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1668068934442646.4628887641015; Thu, 10 Nov 2022 00:28:54 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ot2uv-00007M-T6; Thu, 10 Nov 2022 03:28:09 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ot2ut-00005p-Vg for qemu-devel@nongnu.org; Thu, 10 Nov 2022 03:28:08 -0500 Received: from out30-132.freemail.mail.aliyun.com ([115.124.30.132]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ot2ur-0000fl-HL for qemu-devel@nongnu.org; Thu, 10 Nov 2022 03:28:07 -0500 Received: from localhost(mailfrom:xuanzhuo@linux.alibaba.com fp:SMTPD_---0VUSBVN3_1668068876) by smtp.aliyun-inc.com; Thu, 10 Nov 2022 16:27:57 +0800 X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R181e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=ay29a033018046049; MF=xuanzhuo@linux.alibaba.com; NM=1; PH=DS; RN=3; SR=0; TI=SMTPD_---0VUSBVN3_1668068876; From: Xuan Zhuo To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , Jason Wang Subject: [PATCH] virtio-net: fix for heap-buffer-overflow Date: Thu, 10 Nov 2022 16:27:55 +0800 Message-Id: <20221110082755.12372-1-xuanzhuo@linux.alibaba.com> X-Mailer: git-send-email 2.32.0.3.g01195cf9f MIME-Version: 1.0 X-Git-Hash: 2d8e08a6ae Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=115.124.30.132; envelope-from=xuanzhuo@linux.alibaba.com; helo=out30-132.freemail.mail.aliyun.com X-Spam_score_int: -98 X-Spam_score: -9.9 X-Spam_bar: --------- X-Spam_report: (-9.9 / 5.0 requ) BAYES_00=-1.9, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, USER_IN_DEF_SPF_WL=-7.5 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1668068936783100001 Content-Type: text/plain; charset="utf-8" Run shell script: cat << EOF | valgrind qemu-system-i386 -display none -machine accel=3Dq= test, -m \ 512M -M q35 -nodefaults -device virtio-net,netdev=3Dnet0 -netdev \ user,id=3Dnet0 -qtest stdio outl 0xcf8 0x80000810 outl 0xcfc 0xc000 outl 0xcf8 0x80000804 outl 0xcfc 0x01 outl 0xc00d 0x0200 outl 0xcf8 0x80000890 outb 0xcfc 0x4 outl 0xcf8 0x80000889 outl 0xcfc 0x1c000000 outl 0xcf8 0x80000893 outw 0xcfc 0x100 EOF Got: =3D=3D68666=3D=3D Invalid read of size 8 =3D=3D68666=3D=3D at 0x688536: virtio_net_queue_enable (virtio-net.c= :575) =3D=3D68666=3D=3D by 0x6E31AE: memory_region_write_accessor (memory.= c:492) =3D=3D68666=3D=3D by 0x6E098D: access_with_adjusted_size (memory.c:5= 54) =3D=3D68666=3D=3D by 0x6E4DB3: memory_region_dispatch_write (memory.= c:1521) =3D=3D68666=3D=3D by 0x6E31AE: memory_region_write_accessor (memory.= c:492) =3D=3D68666=3D=3D by 0x6E098D: access_with_adjusted_size (memory.c:5= 54) =3D=3D68666=3D=3D by 0x6E4DB3: memory_region_dispatch_write (memory.= c:1521) =3D=3D68666=3D=3D by 0x6EBCD3: flatview_write_continue (physmem.c:28= 20) =3D=3D68666=3D=3D by 0x6EBFBF: flatview_write (physmem.c:2862) =3D=3D68666=3D=3D by 0x6EF5E7: address_space_write (physmem.c:2958) =3D=3D68666=3D=3D by 0x6DFDEC: cpu_outw (ioport.c:70) =3D=3D68666=3D=3D by 0x6F6DF0: qtest_process_command (qtest.c:480) =3D=3D68666=3D=3D Address 0x29087fe8 is 24 bytes after a block of size= 416 in arena "client" That is reported by Alexander Bulekov. https://gitlab.com/qemu-project/qemu= /-/issues/1309 Here, the queue_index is the index of the cvq, but cvq does not have the corresponding NetClientState, so overflow appears. I add a check here, ignore illegal queue_index and cvq queue_index. Signed-off-by: Xuan Zhuo --- hw/net/virtio-net.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 975bbc22f9..88f25709d6 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -549,7 +549,14 @@ static RxFilterInfo *virtio_net_query_rxfilter(NetClie= ntState *nc) static void virtio_net_queue_reset(VirtIODevice *vdev, uint32_t queue_inde= x) { VirtIONet *n =3D VIRTIO_NET(vdev); - NetClientState *nc =3D qemu_get_subqueue(n->nic, vq2q(queue_index)); + NetClientState *nc; + + /* validate queue_index and skip for cvq */ + if (queue_index >=3D n->max_queue_pairs * 2) { + return; + } + + nc =3D qemu_get_subqueue(n->nic, vq2q(queue_index)); =20 if (!nc->peer) { return; @@ -566,9 +573,16 @@ static void virtio_net_queue_reset(VirtIODevice *vdev,= uint32_t queue_index) static void virtio_net_queue_enable(VirtIODevice *vdev, uint32_t queue_ind= ex) { VirtIONet *n =3D VIRTIO_NET(vdev); - NetClientState *nc =3D qemu_get_subqueue(n->nic, vq2q(queue_index)); + NetClientState *nc; int r; =20 + /* validate queue_index and skip for cvq */ + if (queue_index >=3D n->max_queue_pairs * 2) { + return; + } + + nc =3D qemu_get_subqueue(n->nic, vq2q(queue_index)); + if (!nc->peer || !vdev->vhost_started) { return; } --=20 2.32.0.3.g01195cf9f