scsi: validate ADDITIONAL LENGTH alignment from READ KEYS

[PATCH] scsi: validate ADDITIONAL LENGTH alignment from READ KEYS

Stefan Hajnoczi posted 1 patch 1 month, 2 weeks ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260611200409.236980-1-stefanha@redhat.com

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Fam Zheng <fam@euphon.net>

hw/scsi/scsi-generic.c | 7 +++++++
1 file changed, 7 insertions(+)

Expand all Fold all

[PATCH] scsi: validate ADDITIONAL LENGTH alignment from READ KEYS

Posted by Stefan Hajnoczi 1 month, 2 weeks ago

A malicious host SCSI device could report a bogus ADDITIONAL LENGTH
value, causing a memcmp() up to 7 bytes beyond the end of the heap
buffer.

This does not seem to be a practical way to extract the contents of
QEMU's memory since it only happens once per live migration and each
migration destination is a new QEMU process. It doesn't hurt to protect
against it though.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/scsi-generic.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 8999f3b720..fb4e3c0f85 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -522,6 +522,13 @@ static bool scsi_generic_pr_key_registered(SCSIDevice *s, uint64_t key,
         memcpy(&additional_length, &buf[4], sizeof(additional_length));
         be32_to_cpus(&additional_length);
 
+        /* The reservation key list consists of 8-byte elements */
+        if (additional_length % sizeof(key_be)) {
+            error_setg(errp, "got misaligned ADDITIONAL LENGTH %" PRIu32
+                       " from READ KEYS", additional_length);
+            return false;
+        }
+
         /*
          * The parameter data's ADDITIONAL LENGTH must not overflow the CDB's
          * 16-bit ALLOCATION LENGTH field since the next loop iteration will
-- 
2.54.0