[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 11/17] lsi53c895a: check message length value is vali
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 11/17] lsi53c895a: check message length value is valid |
Date: |
Tue, 6 Nov 2018 22:37:57 +0100 |
From: Prasad J Pandit <address@hidden>
While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.
Discovered by Deja vu Security. Reported by Oracle.
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi/lsi53c895a.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index d1e6534..3f207f6 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -861,10 +861,11 @@ static void lsi_do_status(LSIState *s)
static void lsi_do_msgin(LSIState *s)
{
- int len;
+ uint8_t len;
trace_lsi_do_msgin(s->dbc, s->msg_len);
s->sfbr = s->msg[0];
len = s->msg_len;
+ assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
if (len > s->dbc)
len = s->dbc;
pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
@@ -1705,8 +1706,10 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset)
break;
case 0x58: /* SBDL */
/* Some drivers peek at the data bus during the MSG IN phase. */
- if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
+ if ((s->sstat1 & PHASE_MASK) == PHASE_MI) {
+ assert(s->msg_len > 0);
return s->msg[0];
+ }
ret = 0;
break;
case 0x59: /* SBDL high */
@@ -2103,11 +2106,23 @@ static int lsi_pre_save(void *opaque)
return 0;
}
+static int lsi_post_load(void *opaque, int version_id)
+{
+ LSIState *s = opaque;
+
+ if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) {
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static const VMStateDescription vmstate_lsi_scsi = {
.name = "lsiscsi",
.version_id = 0,
.minimum_version_id = 0,
.pre_save = lsi_pre_save,
+ .post_load = lsi_post_load,
.fields = (VMStateField[]) {
VMSTATE_PCI_DEVICE(parent_obj, LSIState),
--
1.8.3.1
- [Qemu-devel] [PULL 00/17] Misc patches for QEMU 3.1 hard freeze (?), Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 03/17] i386: clarify that the Q35 machine type implements a P35 chipset, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 13/17] scsi-generic: avoid out-of-bounds access to VPD page list, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 01/17] icount: fix deadlock when all cpus are sleeping, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 16/17] include/qemu/thread.h: Document qemu_thread_atexit* API, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 14/17] scsi-generic: avoid invalid access to struct when emulating block limits, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 05/17] MAINTAINERS: remove or downgrade myself to reviewer from some subsystems, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 17/17] util/qemu-thread-posix: Fix qemu_thread_atexit* for OSX, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 02/17] x86: hv_evmcs CPU flag support, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 12/17] scsi-generic: keep VPD page list sorted, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 11/17] lsi53c895a: check message length value is valid,
Paolo Bonzini <=
- [Qemu-devel] [PULL 15/17] scsi-generic: do not do VPD emulation for sense other than ILLEGAL_REQUEST, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 04/17] ivshmem: fix memory backend leak, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 10/17] scripts/dump-guest-memory: Synchronize with guest_phys_blocks_region_add, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 09/17] memory-mapping: skip non-volatile memory regions in GuestPhysBlockList, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 06/17] target/i386: Clear RF on SYSCALL instruction, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 08/17] nvdimm: set non-volatile on the memory region, Paolo Bonzini, 2018/11/06
- [Qemu-devel] [PULL 07/17] memory: learn about non-volatile memory region, Paolo Bonzini, 2018/11/06
- Re: [Qemu-devel] [PULL 00/17] Misc patches for QEMU 3.1 hard freeze (?), Peter Maydell, 2018/11/06
- Re: [Qemu-devel] [PULL 00/17] Misc patches for QEMU 3.1 hard freeze (?), Peter Maydell, 2018/11/08