From patchwork Thu Dec 6 12:18:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Prasad Pandit X-Patchwork-Id: 10715907 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C8005109C for ; Thu, 6 Dec 2018 12:29:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B57FB2DE14 for ; Thu, 6 Dec 2018 12:29:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A53CB2DE0E; Thu, 6 Dec 2018 12:29:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id DF5482DE0E for ; Thu, 6 Dec 2018 12:29:01 +0000 (UTC) Received: from localhost ([::1]:40471 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUsm5-0006bG-5R for patchwork-qemu-devel@patchwork.kernel.org; Thu, 06 Dec 2018 07:29:01 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47555) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gUsgX-0000y7-03 for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:23:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gUse3-0006fU-9p for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:20:49 -0500 Received: from mx1.redhat.com ([209.132.183.28]:56262) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gUse3-0006ee-3W for qemu-devel@nongnu.org; Thu, 06 Dec 2018 07:20:43 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 586782D804; Thu, 6 Dec 2018 12:20:42 +0000 (UTC) Received: from localhost.localdomain (unknown [10.33.36.3]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 998A310018FB; Thu, 6 Dec 2018 12:20:34 +0000 (UTC) From: P J P To: Qemu Developers Date: Thu, 6 Dec 2018 17:48:30 +0530 Message-Id: <20181206121830.6177-1-ppandit@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 06 Dec 2018 12:20:42 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v1] i2c: pm_smbus: check smb_index before block transfer write X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Prasad J Pandit , "Michael S . Tsirkin" , Michael Hanselmann , Igor Mammedov , Paolo Bonzini Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann Signed-off-by: Prasad J Pandit Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Michael S. Tsirkin --- hw/i2c/pm_smbus.c | 3 +++ 1 file changed, 3 insertions(+) Update v1: add note about issue being introduced after 3.0 release -> https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01115.html diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c index 685a2378ed..03062740cc 100644 --- a/hw/i2c/pm_smbus.c +++ b/hw/i2c/pm_smbus.c @@ -240,6 +240,9 @@ static void smb_ioport_writeb(void *opaque, hwaddr addr, uint64_t val, uint8_t read = s->smb_addr & 0x01; s->smb_index++; + if (s->smb_index >= PM_SMBUS_MAX_MSG_SIZE) { + s->smb_index = 0; + } if (!read && s->smb_index == s->smb_data0) { uint8_t prot = (s->smb_ctl >> 2) & 0x07; uint8_t cmd = s->smb_cmd;