From patchwork Fri Nov 2 01:22:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Qiang X-Patchwork-Id: 10664873 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EE98217DB for ; Fri, 2 Nov 2018 01:28:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CFCB02BADD for ; Fri, 2 Nov 2018 01:28:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BF4A52BAEA; Fri, 2 Nov 2018 01:28:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5EF9F2BADD for ; Fri, 2 Nov 2018 01:28:40 +0000 (UTC) Received: from localhost ([::1]:48639 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gIOGN-0003fa-2d for patchwork-qemu-devel@patchwork.kernel.org; Thu, 01 Nov 2018 21:28:39 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51004) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gIOFi-0002Yn-5n for qemu-devel@nongnu.org; Thu, 01 Nov 2018 21:27:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gIOFf-0004tk-1I for qemu-devel@nongnu.org; Thu, 01 Nov 2018 21:27:58 -0400 Received: from mail-pf1-x441.google.com ([2607:f8b0:4864:20::441]:35211) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gIOAk-00032y-OM; Thu, 01 Nov 2018 21:22:50 -0400 Received: by mail-pf1-x441.google.com with SMTP id z2-v6so214663pfe.2; Thu, 01 Nov 2018 18:22:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=TzPHHm64GyW5UNe9HFMELeRvczqXk1MiwEwEZYBLdtg=; b=CTIpQZ3qqRxe3JfBqu58GOfGP6RYcARR1bZF+SeVZBys6Ex/35ZqSFRB3VBcW8DstU 0G37ewFpdAR4fX4Pep3mm4GiLs3j84CpaCtuGLF8S6FvzclEsxJ7cI/MjaKidSzdtFNH CWjKJu6d7GzT2dSH+/jDS6jSNhEAfVA1YDRwV50il6rdpkLBHz4vpFcQW1i/SXRDchaB tMyPTB1gq7SYvzxfBvorGkGIMYHigSMwoIYeWVnvzWAJpCPuB6OptcABybADmS3a0sJB T+f2IZeQNhU/ilzpox2xc1z5SSnJeFj+aAJHdtxGSzVejLj4grcR/wwzRtzgqTgEp6q+ v93w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=TzPHHm64GyW5UNe9HFMELeRvczqXk1MiwEwEZYBLdtg=; b=I1kLJyX8TuevB0HwqCK7e4z3xqkUCeQrJ9uh6g90Eu+13W0yBwzxVs5VeItaPCE9Mv Atjs1Yz8hZB1tMF9LdFlTL0wgbK88K2H/n+DELI55mORkjuKdeyVZIo6F1q1bdN8UETv M40fH2aU1tIo4M+e87AOvdnsPfOLtPkM8PApkmKJbzDvAeR7K70E+RNVVOoaZTxwzOYJ 4opC6lyfUpy4kyMCbqxphAmNyLsHqTrC5ERgRpS5+FV3Izz21D5ykrrDnZQdbY4lRXQ7 2LYBigaeoVwyVdJFcpKq2tLp/rAdN+CTRHrYNcEF857zbk2Vs5X80xDzkNqgW0/OkQ3q f6Ww== X-Gm-Message-State: AGRZ1gKAwFX7dp6Hv6kmNG+Epk9ojrYFaKaILn6/ItLky6radUSq8ooD PW4eTSmoKsypz050Z6dfWnE= X-Google-Smtp-Source: AJdET5fVQXjX38zS7nfPDererTMMfPzpD+O6iwfa+T+88/Dp2b27j5ILjMqTlABOlqcWcPNejRblgA== X-Received: by 2002:a65:51c6:: with SMTP id i6-v6mr9003707pgq.227.1541121769574; Thu, 01 Nov 2018 18:22:49 -0700 (PDT) Received: from localhost.localdomain.localdomain ([103.65.40.101]) by smtp.gmail.com with ESMTPSA id s30-v6sm25294820pga.57.2018.11.01.18.22.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Nov 2018 18:22:49 -0700 (PDT) From: Li Qiang To: keith.busch@intel.com, kwolf@redhat.com, mreitz@redhat.com Date: Thu, 1 Nov 2018 18:22:43 -0700 Message-Id: <1541121763-3277-1-git-send-email-liq3ea@gmail.com> X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::441 Subject: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847) X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: pbonzini@redhat.com, Li Qiang , qemu-devel@nongnu.org, qemu-block@nongnu.org, ppandit@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP Currently, the nvme_cmb_ops mr doesn't check the addr and size. This can lead an oob access issue. This is triggerable in the guest. Add check to avoid this issue. Fixes CVE-2018-16847. Reported-by: Li Qiang Reviewed-by: Paolo Bonzini Signed-off-by: Li Qiang --- hw/block/nvme.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index fc7dacb..d097add 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -1175,6 +1175,10 @@ static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data, unsigned size) { NvmeCtrl *n = (NvmeCtrl *)opaque; + + if (addr + size > NVME_CMBSZ_GETSIZE(n->bar.cmbsz)) { + return; + } memcpy(&n->cmbuf[addr], &data, size); } @@ -1183,6 +1187,9 @@ static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size) uint64_t val; NvmeCtrl *n = (NvmeCtrl *)opaque; + if (addr + size > NVME_CMBSZ_GETSIZE(n->bar.cmbsz)) { + return 0; + } memcpy(&val, &n->cmbuf[addr], size); return val; }