Re: [PATCH v2 1/2] ait-vga: check address before reading configuration bytes

[P J P]

  Hello Phil,

+-- On Thu, 4 Jun 2020, Philippe Mathieu-Daudé wrote --+
| >> @@ -1381,6 +1381,8 @@ uint32_t pci_default_read_config(PCIDevice *d,
| >> +    assert(address + len <= pci_config_size(d));
| 
| Yes, maybe I was not clear while reviewing v1, we need to audit the
| callers and fix them first, then we can safely add the assert here.

That's an elaborate task. Could we please make that into another patch series?

+-- On Thu, 4 Jun 2020, Daniel P. Berrangé wrote --+
| On Thu, Jun 04, 2020 at 01:52:50AM +0530, P J P wrote:
| > While reading PCI configuration bytes, a guest may send an
| > address towards the end of the configuration space. It may lead
| > to an OOB access issue. Add check to ensure 'address + size' is
| > within PCI configuration space.
| 
| Please include a CVE number for this security flaw if there is
| one.

Yes. For now I'll send a revised patch to fix this ati-vga OOB access issue.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D