[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 10/10] lsi53c895a: check message length value is vali
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 10/10] lsi53c895a: check message length value is valid |
Date: |
Tue, 30 Oct 2018 20:50:11 +0100 |
From: Prasad J Pandit <address@hidden>
While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.
Discovered by Deja vu Security. Reported by Oracle.
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi/lsi53c895a.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index d1e6534..3f207f6 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -861,10 +861,11 @@ static void lsi_do_status(LSIState *s)
static void lsi_do_msgin(LSIState *s)
{
- int len;
+ uint8_t len;
trace_lsi_do_msgin(s->dbc, s->msg_len);
s->sfbr = s->msg[0];
len = s->msg_len;
+ assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
if (len > s->dbc)
len = s->dbc;
pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
@@ -1705,8 +1706,10 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset)
break;
case 0x58: /* SBDL */
/* Some drivers peek at the data bus during the MSG IN phase. */
- if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
+ if ((s->sstat1 & PHASE_MASK) == PHASE_MI) {
+ assert(s->msg_len > 0);
return s->msg[0];
+ }
ret = 0;
break;
case 0x59: /* SBDL high */
@@ -2103,11 +2106,23 @@ static int lsi_pre_save(void *opaque)
return 0;
}
+static int lsi_post_load(void *opaque, int version_id)
+{
+ LSIState *s = opaque;
+
+ if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) {
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static const VMStateDescription vmstate_lsi_scsi = {
.name = "lsiscsi",
.version_id = 0,
.minimum_version_id = 0,
.pre_save = lsi_pre_save,
+ .post_load = lsi_post_load,
.fields = (VMStateField[]) {
VMSTATE_PCI_DEVICE(parent_obj, LSIState),
--
1.8.3.1
- [Qemu-devel] [PULL 00/10] Misc patches for 2018-10-30, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 08/10] memory-mapping: skip non-volatile memory regions in GuestPhysBlockList, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 05/10] target/i386: Clear RF on SYSCALL instruction, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 04/10] MAINTAINERS: remove or downgrade myself to reviewer from some subsystems, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 02/10] x86: hv_evmcs CPU flag support, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 01/10] icount: fix deadlock when all cpus are sleeping, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 10/10] lsi53c895a: check message length value is valid,
Paolo Bonzini <=
- [Qemu-devel] [PULL 07/10] nvdimm: set non-volatile on the memory region, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 03/10] i386: clarify that the Q35 machine type implements a P35 chipset, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 06/10] memory: learn about non-volatile memory region, Paolo Bonzini, 2018/10/30
- [Qemu-devel] [PULL 09/10] scripts/dump-guest-memory: Synchronize with guest_phys_blocks_region_add, Paolo Bonzini, 2018/10/30