f7e6c9d33c
- qga-win: Fix guest-get-fsinfo multi-disks collection - hw/timer: fix systick trace message - virtio-net: correctly copy vnet header when flushing TX (CVE-2023-6693) - ui/clipboard: mark type as not available when there is no data (CVE-2023-6683) - esp: restrict non-DMA transfer length to that of available data (CVE-2024-24474) - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) - net: Update MemReentrancyGuard for NIC (CVE-2023-3019) - net: Provide MemReentrancyGuard * to qemu_new_nic() Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 18db08e0e64d982b88ad7f29ccd49b19e8c656f0)
125 lines
4.8 KiB
Diff
125 lines
4.8 KiB
Diff
From ef9a2635bf418f2a625e2421d3bfe1fe58ac0bec Mon Sep 17 00:00:00 2001
|
|
From: Thomas Huth <thuth@redhat.com>
|
|
Date: Mon, 22 May 2023 11:10:11 +0200
|
|
Subject: [PATCH] hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI
|
|
controller (CVE-2023-0330)
|
|
|
|
We cannot use the generic reentrancy guard in the LSI code, so
|
|
we have to manually prevent endless reentrancy here. The problematic
|
|
lsi_execute_script() function has already a way to detect whether
|
|
too many instructions have been executed - we just have to slightly
|
|
change the logic here that it also takes into account if the function
|
|
has been called too often in a reentrant way.
|
|
|
|
The code in fuzz-lsi53c895a-test.c has been taken from an earlier
|
|
patch by Mauro Matteo Cascella.
|
|
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563
|
|
Message-Id: <20230522091011.1082574-1-thuth@redhat.com>
|
|
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
|
|
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
Signed-off-by: liuxiangdong <liuxiangdong5@huawei.com>
|
|
---
|
|
hw/scsi/lsi53c895a.c | 23 +++++++++++++++------
|
|
tests/qtest/fuzz-lsi53c895a-test.c | 32 ++++++++++++++++++++++++++++++
|
|
2 files changed, 49 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
|
|
index b9c9eb0dac..f7559051c5 100644
|
|
--- a/hw/scsi/lsi53c895a.c
|
|
+++ b/hw/scsi/lsi53c895a.c
|
|
@@ -1134,15 +1134,24 @@ static void lsi_execute_script(LSIState *s)
|
|
uint32_t addr, addr_high;
|
|
int opcode;
|
|
int insn_processed = 0;
|
|
+ static int reentrancy_level;
|
|
+
|
|
+ reentrancy_level++;
|
|
|
|
s->istat1 |= LSI_ISTAT1_SRUN;
|
|
again:
|
|
- if (++insn_processed > LSI_MAX_INSN) {
|
|
- /* Some windows drivers make the device spin waiting for a memory
|
|
- location to change. If we have been executed a lot of code then
|
|
- assume this is the case and force an unexpected device disconnect.
|
|
- This is apparently sufficient to beat the drivers into submission.
|
|
- */
|
|
+ /*
|
|
+ * Some windows drivers make the device spin waiting for a memory location
|
|
+ * to change. If we have executed more than LSI_MAX_INSN instructions then
|
|
+ * assume this is the case and force an unexpected device disconnect. This
|
|
+ * is apparently sufficient to beat the drivers into submission.
|
|
+ *
|
|
+ * Another issue (CVE-2023-0330) can occur if the script is programmed to
|
|
+ * trigger itself again and again. Avoid this problem by stopping after
|
|
+ * being called multiple times in a reentrant way (8 is an arbitrary value
|
|
+ * which should be enough for all valid use cases).
|
|
+ */
|
|
+ if (++insn_processed > LSI_MAX_INSN || reentrancy_level > 8) {
|
|
if (!(s->sien0 & LSI_SIST0_UDC)) {
|
|
qemu_log_mask(LOG_GUEST_ERROR,
|
|
"lsi_scsi: inf. loop with UDC masked");
|
|
@@ -1596,6 +1605,8 @@ again:
|
|
}
|
|
}
|
|
trace_lsi_execute_script_stop();
|
|
+
|
|
+ reentrancy_level--;
|
|
}
|
|
|
|
static uint8_t lsi_reg_readb(LSIState *s, int offset)
|
|
diff --git a/tests/qtest/fuzz-lsi53c895a-test.c b/tests/qtest/fuzz-lsi53c895a-test.c
|
|
index 0f968024c8..9c50958796 100644
|
|
--- a/tests/qtest/fuzz-lsi53c895a-test.c
|
|
+++ b/tests/qtest/fuzz-lsi53c895a-test.c
|
|
@@ -8,6 +8,36 @@
|
|
#include "qemu/osdep.h"
|
|
#include "libqos/libqtest.h"
|
|
|
|
+/*
|
|
+ * This used to trigger a DMA reentrancy issue
|
|
+ * leading to memory corruption bugs like stack
|
|
+ * overflow or use-after-free
|
|
+ * https://gitlab.com/qemu-project/qemu/-/issues/1563
|
|
+ */
|
|
+static void test_lsi_dma_reentrancy(void)
|
|
+{
|
|
+ QTestState *s;
|
|
+
|
|
+ s = qtest_init("-M q35 -m 512M -nodefaults "
|
|
+ "-blockdev driver=null-co,node-name=null0 "
|
|
+ "-device lsi53c810 -device scsi-cd,drive=null0");
|
|
+
|
|
+ qtest_outl(s, 0xcf8, 0x80000804); /* PCI Command Register */
|
|
+ qtest_outw(s, 0xcfc, 0x7); /* Enables accesses */
|
|
+ qtest_outl(s, 0xcf8, 0x80000814); /* Memory Bar 1 */
|
|
+ qtest_outl(s, 0xcfc, 0xff100000); /* Set MMIO Address*/
|
|
+ qtest_outl(s, 0xcf8, 0x80000818); /* Memory Bar 2 */
|
|
+ qtest_outl(s, 0xcfc, 0xff000000); /* Set RAM Address*/
|
|
+ qtest_writel(s, 0xff000000, 0xc0000024);
|
|
+ qtest_writel(s, 0xff000114, 0x00000080);
|
|
+ qtest_writel(s, 0xff00012c, 0xff000000);
|
|
+ qtest_writel(s, 0xff000004, 0xff000114);
|
|
+ qtest_writel(s, 0xff000008, 0xff100014);
|
|
+ qtest_writel(s, 0xff10002f, 0x000000ff);
|
|
+
|
|
+ qtest_quit(s);
|
|
+}
|
|
+
|
|
/*
|
|
* This used to trigger a UAF in lsi_do_msgout()
|
|
* https://gitlab.com/qemu-project/qemu/-/issues/972
|
|
@@ -121,6 +151,8 @@ int main(int argc, char **argv)
|
|
test_lsi_do_dma_empty_queue);
|
|
qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
|
|
test_lsi_do_msgout_cancel_req);
|
|
+ qtest_add_func("fuzz/lsi53c895a/lsi_dma_reentrancy",
|
|
+ test_lsi_dma_reentrancy);
|
|
}
|
|
|
|
return g_test_run();
|
|
--
|
|
2.27.0
|
|
|