From nobody Fri Jul 24 05:26:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1784772922; cv=none; d=zohomail.com; s=zohoarc; b=TVNfzy4Sn9NUW5ikWvoEXFaRO+35FaO8UxXWT3X8N519WFb5RBDYLT7UQVb1Mc0+9R3KAqiMT3fIowSOohzuKwDcNaPgzf1Q2LGDyerodbD0SSFb91DHZJxPsWz8AYwO25EcSTLN2DuTIbUqXV4Zo1I2ozmSc9GEQB65beBNMlY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784772922; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=o766GxEhV3PGRBXOiHXJb69DGsBYL5EaUQhlyW7i0BA=; b=j6LUQoc1uFMVWOaPWGT+A5fIjT/hXM3A8J/Zut1+vq94zG8hSs0cXB+0je58xbhdm1uwfXT4LcgFhhTYO5AGf8MlJH2sLWbFbdLOIso3pYz1vppq0C8SccNPIiyPd2pjRZku4VMosXHE1K8bRNhlnTD+aNOnXVSfGw/NKTagyD8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784772922961572.1204582425511; Wed, 22 Jul 2026 19:15:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wmixQ-0007cH-HD; Wed, 22 Jul 2026 22:14:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmixP-0007bN-Id for qemu-devel@nongnu.org; Wed, 22 Jul 2026 22:14:43 -0400 Received: from mail-pj2-x03.google.com ([2607:f8b0:4864:39::3]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wmixN-0001MX-U8 for qemu-devel@nongnu.org; Wed, 22 Jul 2026 22:14:43 -0400 Received: by mail-pj2-x03.google.com with SMTP id 98e67ed59e1d1-38111ea8a88so81827a91.1 for ; Wed, 22 Jul 2026 19:14:41 -0700 (PDT) Received: from VM-210-252-ubuntu.. ([14.116.239.39]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38ecad34d41sm66860a91.9.2026.07.22.19.14.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 19:14:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784772880; x=1785377680; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=o766GxEhV3PGRBXOiHXJb69DGsBYL5EaUQhlyW7i0BA=; b=YomiUgTkExByLS6Rb+vrWmS/n3505phM0Ekpni9j+c7CV7niUHwfO8CD184FLtiB42 Z2C9shGGuje5dIf9uGyEBuxJkGKrZ+PCa21ejOa2hDgQH1Uj8O+eEWUUFNCi7oscP181 0YsfEEQDRmqX0r7cn3rQzTWTiLytd0uN6kRFeYVhEwYp1PSLe8kleq2Kq5aFF6muGd4h EBgpYDs4WCc84vTF73ONpL6BHjBDJEJimeQQGPEklNEkBg5X6GUjQhH97Zcf6RVDWo1N 2cYI/mRd6qibOhna+8nFqRk5H7md2kHznEFBrJRyXdQZXuXWoYs/8Dwq2+QhWyO7ow5K oSig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784772880; x=1785377680; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=o766GxEhV3PGRBXOiHXJb69DGsBYL5EaUQhlyW7i0BA=; b=GnLuBSsUntIWjkMTtNbY3M7evlN4zCS1O8U5h8mbN+EzC9ro8PYMegLYQwCjNraf4G muYaA+OeFp0LbGFnqFhU69ctpfmr4OnkOBKpy2eAgD4DPWUYjLUXU+oV1ojOg5X2S+7c 8W4n9bQe10z1RPS2WsvxpvMxGNCoE2y6/l+QdPoN2QMyW5ELLohR7DhHMuU57sbaIgnJ X0x/0Qdt4tb9Y3Ycz3WMr6nwnnp6KWZnOO3+uNa/RtMNGMYkEd6f21MrqjketiBNip1g J12JHIpURSaDagGw+yk7qo8kxfhZHX/A93zajotGxX50ypoaScCimSJrTwX+dNdo2CSq Ovzw== X-Gm-Message-State: AOJu0YwhwU+vrvZ2igOaAfk5otL9+urapfJK7sESbbhv867bTA9CL6e+ yTeZjqQCO+utjkMUXNPI77vPfEs+4gobenxN0zM7cDIIh3CRgIsApUwgp2/F0Vk9K/c/bw== X-Gm-Gg: AR+sD11bmKGxLTzO3NQnJdRaJ4pH3aj5Ez4i90rMzqwfhakfm388Z9xFJGeNzgUgRrh rzqZMWX78nakO6mGBRz1xF77J8liuGec95jrVIZlrMFPMqq0+Ob7cdSNme97ln69eYwhdtGjdmL fw4v0p3uCqMIioIdsjJNHlQlDX4w/LgdMKN853wjYvOhEGk3oY8VLrAq7mbKRm5BNMRKUahIgFJ g1xKJ8/kzYoyGZYd78SZQQyTafkdvG/1EwixHhjSp9FdtrVeIxVDdTkimkKT6l52L/7rK+a9hlL ECQhzSego/k94r8JfVAXg3ygjvONfMSAh7Qv6L2JbpBOkFwak6GtScHs8wEWuzLc+5NtS9pi9Ik cZL7TqIwgf+gDLZkw2yiKANaH5aimtqRnWjIFbkWFKI9LU/wj4MCz55CipDLJlSHchr7yCmik6A yxPmldSC/857z9OwX45IeaTJnz0xilr12mKjpbLJdZD8dyHyjdkgW6jq68gDlDrjwJlxdoB/HoX aMjnVn/pnczEM0mi0BIPVkLFzIBAA== X-Received: by 2002:a17:90b:4c0e:b0:38e:6aa7:68ad with SMTP id 98e67ed59e1d1-38ec648ac8amr1123522a91.5.1784772879979; Wed, 22 Jul 2026 19:14:39 -0700 (PDT) From: jianghaotian.sunday@gmail.com To: qemu-devel@nongnu.org Cc: kraxel@redhat.com, Haotian Jiang , qemu-stable@nongnu.org Subject: [PATCH] hw/audio/intel-hda: restrict all DMA engine paths to memories Date: Thu, 23 Jul 2026 10:14:12 +0800 Message-Id: <20260723021412.377244-1-jianghaotian.sunday@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2607:f8b0:4864:39::3; envelope-from=jianghaotian.sunday@gmail.com; helo=mail-pj2-x03.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1784772925402158500 Content-Type: text/plain; charset="utf-8" From: Haotian Jiang CVE-2021-3611 (commit 79fa99831d) restricted the DMA engine to memories by setting attrs.memory=3Dtrue, but only applied this to intel_hda_response. Three other DMA engine access points still use MEMTXATTRS_UNSPECIFIED, allowing a malicious guest to trigger DMA-to-self-MMIO reentry: - intel_hda_xfer (line 398): called from the audio timer callback (hda_codec_xfer -> bus->xfer), so the MemReentrancyGuard does not fire (engaged_in_io is false outside MMIO dispatch). A guest that points a BDL entry at the HDA controller's own MMIO BAR can write audio samples to device registers, triggering whandler side effects such as starting/stopping streams or injecting codec commands via CORBWP. - intel_hda_parse_bdl (line 478): uses pci_dma_read which hardcodes MEMTXATTRS_UNSPECIFIED. A guest-controlled BDL base address can point at controller MMIO, allowing the DMA engine to read device registers as BDL descriptors. - intel_hda_corb_run (line 333): ldl_le_pci_dma reads the CORB ring with MEMTXATTRS_UNSPECIFIED, allowing the DMA engine to read controller MMIO as CORB entries. Fix all three by passing {.memory =3D true} explicitly, matching the fix already applied to intel_hda_response. For intel_hda_parse_bdl, replace pci_dma_read with pci_dma_rw to pass the controlled attrs. Fixes: 79fa99831d ("hw/audio/intel-hda: Restrict DMA engine to memories (no= t MMIO devices)") Reported-by: Haotian Jiang of Tencent Security (Yunding Lab) Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org --- hw/audio/intel-hda.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index d7c2c3c2fd..3d361a4976 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -305,6 +305,7 @@ static int intel_hda_send_command(IntelHDAState *d, uin= t32_t verb) =20 static void intel_hda_corb_run(IntelHDAState *d) { + const MemTxAttrs attrs =3D { .memory =3D true }; hwaddr addr; uint32_t rp, verb; =20 @@ -330,7 +331,7 @@ static void intel_hda_corb_run(IntelHDAState *d) =20 rp =3D (d->corb_rp + 1) & 0xff; addr =3D intel_hda_addr(d->corb_lbase, d->corb_ubase); - ldl_le_pci_dma(&d->pci, addr + 4 * rp, &verb, MEMTXATTRS_UNSPECIFI= ED); + ldl_le_pci_dma(&d->pci, addr + 4 * rp, &verb, attrs); d->corb_rp =3D rp; =20 dprint(d, 2, "%s: [rp 0x%x] verb 0x%08x\n", __func__, rp, verb); @@ -395,7 +396,7 @@ static void intel_hda_response(HDACodecDevice *dev, boo= l solicited, uint32_t res static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, uint8_t *buf, uint32_t len) { - const MemTxAttrs attrs =3D MEMTXATTRS_UNSPECIFIED; + const MemTxAttrs attrs =3D { .memory =3D true }; HDACodecBus *bus =3D HDA_BUS(dev->qdev.parent_bus); IntelHDAState *d =3D container_of(bus, IntelHDAState, codecs); hwaddr addr; @@ -466,6 +467,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_= t stnr, bool output, =20 static void intel_hda_parse_bdl(IntelHDAState *d, IntelHDAStream *st) { + const MemTxAttrs attrs =3D { .memory =3D true }; hwaddr addr; uint8_t buf[16]; uint32_t i; @@ -475,7 +477,8 @@ static void intel_hda_parse_bdl(IntelHDAState *d, Intel= HDAStream *st) g_free(st->bpl); st->bpl =3D g_new(bpl, st->bentries); for (i =3D 0; i < st->bentries; i++, addr +=3D 16) { - pci_dma_read(&d->pci, addr, buf, 16); + pci_dma_rw(&d->pci, addr, buf, 16, + DMA_DIRECTION_TO_DEVICE, attrs); st->bpl[i].addr =3D le64_to_cpu(*(uint64_t *)buf); st->bpl[i].len =3D le32_to_cpu(*(uint32_t *)(buf + 8)); st->bpl[i].flags =3D le32_to_cpu(*(uint32_t *)(buf + 12)); --=20 2.34.1