motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-25 02:52:06 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/include/hw/virtio
History
Xuan Zhuo f47af0af0d virtio-net: fix for heap-buffer-overflow 
Run shell script:

    cat << EOF | valgrind qemu-system-i386 -display none -machine accel=qtest, -m \
    512M -M q35 -nodefaults -device virtio-net,netdev=net0 -netdev \
    user,id=net0 -qtest stdio
    outl 0xcf8 0x80000810
    outl 0xcfc 0xc000
    outl 0xcf8 0x80000804
    outl 0xcfc 0x01
    outl 0xc00d 0x0200
    outl 0xcf8 0x80000890
    outb 0xcfc 0x4
    outl 0xcf8 0x80000889
    outl 0xcfc 0x1c000000
    outl 0xcf8 0x80000893
    outw 0xcfc 0x100
    EOF

Got:
    ==68666== Invalid read of size 8
    ==68666==    at 0x688536: virtio_net_queue_enable (virtio-net.c:575)
    ==68666==    by 0x6E31AE: memory_region_write_accessor (memory.c:492)
    ==68666==    by 0x6E098D: access_with_adjusted_size (memory.c:554)
    ==68666==    by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
    ==68666==    by 0x6E31AE: memory_region_write_accessor (memory.c:492)
    ==68666==    by 0x6E098D: access_with_adjusted_size (memory.c:554)
    ==68666==    by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
    ==68666==    by 0x6EBCD3: flatview_write_continue (physmem.c:2820)
    ==68666==    by 0x6EBFBF: flatview_write (physmem.c:2862)
    ==68666==    by 0x6EF5E7: address_space_write (physmem.c:2958)
    ==68666==    by 0x6DFDEC: cpu_outw (ioport.c:70)
    ==68666==    by 0x6F6DF0: qtest_process_command (qtest.c:480)
    ==68666==  Address 0x29087fe8 is 24 bytes after a block of size 416 in arena "client"

That is reported by Alexander Bulekov. https://gitlab.com/qemu-project/qemu/-/issues/1309

Here, the queue_index is the index of the cvq, but in some cases cvq
does not have the corresponding NetClientState, so overflow appears.

I add a check here, ignore illegal queue_index and cvq queue_index.

Note the queue_index is below the VIRTIO_QUEUE_MAX but greater or equal
than cvq index could hit this. Other devices are similar.

Fixes: 7f863302 ("virtio-net: support queue_enable")
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1309
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Message-Id: <20221110095739.130393-1-xuanzhuo@linux.alibaba.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-11-10 10:18:55 -05:00
..
vhost-backend.h vhost: add method vhost_set_vring_err 2022-06-27 18:53:18 -04:00
vhost-scsi-common.h vhost-scsi: support inflight io track 2020-09-30 19:09:20 +02:00
vhost-scsi.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
vhost-user-blk.h vhost-user-blk: make 'config_wce' part of 'host_features' 2022-10-07 09:41:51 -04:00
vhost-user-fs.h Clean up ill-advised or unusual header guards 2022-05-11 16:50:01 +02:00
vhost-user-gpio.h hw/virtio: add boilerplate for vhost-user-gpio device 2022-10-07 09:41:51 -04:00
vhost-user-i2c.h Clean up ill-advised or unusual header guards 2022-05-11 16:50:01 +02:00
vhost-user-rng.h Clean up ill-advised or unusual header guards 2022-05-11 16:50:01 +02:00
vhost-user-scsi.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
vhost-user-vsock.h Clean up ill-advised or unusual header guards 2022-05-11 16:50:01 +02:00
vhost-user.h virtio/vhost-user: dynamically assign VhostUserHostNotifiers 2022-05-16 04:38:40 -04:00
vhost-vdpa.h vdpa: Delete CVQ migration blocker 2022-09-02 10:22:39 +08:00
vhost-vsock-common.h virtio: drop name parameter for virtio_init() 2022-05-16 04:38:40 -04:00
vhost-vsock.h vhost-vsock: handle common features in vhost-vsock-common 2021-10-05 17:30:57 -04:00
vhost.h vhost: expose vhost_virtqueue_stop() 2022-11-07 13:12:20 -05:00
virtio-access.h Replace TARGET_WORDS_BIGENDIAN 2022-04-06 10:50:37 +02:00
virtio-balloon.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
virtio-blk-common.h virtio-blk: move config size params to virtio-blk-common 2022-10-07 09:41:51 -04:00
virtio-blk.h virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint 2022-10-26 14:56:42 -04:00
virtio-bus.h virtio-bus: introduce iommu_enabled() 2021-09-04 16:35:17 -04:00
virtio-crypto.h crypto: Introduce RSA algorithm 2022-06-16 12:54:58 -04:00
virtio-gpu-bswap.h Replace config-time define HOST_WORDS_BIGENDIAN 2022-04-06 10:50:37 +02:00
virtio-gpu-pci.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
virtio-gpu-pixman.h virtio-gpu: add a pixman helper header 2019-05-29 06:29:07 +02:00
virtio-gpu.h virtio-gpu: Respect UI refresh rate for EDID 2022-06-14 10:34:37 +02:00
virtio-input.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
virtio-iommu.h virtio-iommu: Use recursive lock to avoid deadlock 2022-06-16 12:54:58 -04:00
virtio-mem.h virtio-mem: Support VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE 2022-01-07 19:30:13 -05:00
virtio-mmio.h hw/virtio: enable ioeventfd configuring for mmio 2021-05-14 10:26:18 -04:00
virtio-net.h virtio-net: Expose ctrl virtqueue logic 2022-07-20 16:58:08 +08:00
virtio-pci.h virtio-pci: support queue reset 2022-11-07 13:12:20 -05:00
virtio-pmem.h qapi: Restrict device memory commands to machine code 2020-09-29 15:41:36 +02:00
virtio-rng.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
virtio-scsi.h virtio-scsi: move request-related items from .h to .c 2022-05-09 10:45:04 +01:00
virtio-serial.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
virtio.h virtio-net: fix for heap-buffer-overflow 2022-11-10 10:18:55 -05:00