[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL for-6.1 09/11] hw/nvme: fix out-of-bounds reads
From: |
Klaus Jensen |
Subject: |
[PULL for-6.1 09/11] hw/nvme: fix out-of-bounds reads |
Date: |
Mon, 26 Jul 2021 21:18:59 +0200 |
From: Klaus Jensen <k.jensen@samsung.com>
Peter noticed that mmio access may read into the NvmeParams member in
the NvmeCtrl struct.
Fix the bounds check.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/nvme/ctrl.c | 27 +++++++++++++++------------
1 file changed, 15 insertions(+), 12 deletions(-)
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 23ff71f65c0e..10c2363c1d4d 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -5969,23 +5969,26 @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr
addr, unsigned size)
/* should RAZ, fall through for now */
}
- if (addr < sizeof(n->bar)) {
- /*
- * When PMRWBM bit 1 is set then read from
- * from PMRSTS should ensure prior writes
- * made it to persistent media
- */
- if (addr == NVME_REG_PMRSTS &&
- (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
- memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
- }
- memcpy(&val, ptr + addr, size);
- } else {
+ if (addr > sizeof(n->bar) - size) {
NVME_GUEST_ERR(pci_nvme_ub_mmiord_invalid_ofs,
"MMIO read beyond last register,"
" offset=0x%"PRIx64", returning 0", addr);
+
+ return 0;
}
+ /*
+ * When PMRWBM bit 1 is set then read from
+ * from PMRSTS should ensure prior writes
+ * made it to persistent media
+ */
+ if (addr == NVME_REG_PMRSTS &&
+ (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
+ memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
+ }
+
+ memcpy(&val, ptr + addr, size);
+
return val;
}
--
2.32.0
- [PULL for-6.1 00/11] hw/nvme fixes, Klaus Jensen, 2021/07/26
- [PULL for-6.1 01/11] hw/nvme: remove NvmeCtrl parameter from ns setup/check functions, Klaus Jensen, 2021/07/26
- [PULL for-6.1 02/11] hw/nvme: mark nvme-subsys non-hotpluggable, Klaus Jensen, 2021/07/26
- [PULL for-6.1 03/11] hw/nvme: unregister controller with subsystem at exit, Klaus Jensen, 2021/07/26
- [PULL for-6.1 04/11] hw/nvme: error handling for too many mappings, Klaus Jensen, 2021/07/26
- [PULL for-6.1 05/11] tests/qtest/nvme-test: add persistent memory region test, Klaus Jensen, 2021/07/26
- [PULL for-6.1 06/11] hw/nvme: fix controller hot unplugging, Klaus Jensen, 2021/07/26
- [PULL for-6.1 07/11] hw/nvme: split pmrmsc register into upper and lower, Klaus Jensen, 2021/07/26
- [PULL for-6.1 08/11] hw/nvme: use symbolic names for registers, Klaus Jensen, 2021/07/26
- [PULL for-6.1 09/11] hw/nvme: fix out-of-bounds reads,
Klaus Jensen <=
- [PULL for-6.1 10/11] hw/nvme: fix mmio read, Klaus Jensen, 2021/07/26
- [PULL for-6.1 11/11] tests/qtest/nvme-test: add mmio read test, Klaus Jensen, 2021/07/26
- Re: [PULL for-6.1 00/11] hw/nvme fixes, Peter Maydell, 2021/07/27