Emulation/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-06-02 20:18:25 -04:00
Code Issues Packages Projects Releases Wiki Activity
xemu/include
History
Xuan Zhuo f47af0af0d virtio-net: fix for heap-buffer-overflow 
Run shell script:

    cat << EOF | valgrind qemu-system-i386 -display none -machine accel=qtest, -m \
    512M -M q35 -nodefaults -device virtio-net,netdev=net0 -netdev \
    user,id=net0 -qtest stdio
    outl 0xcf8 0x80000810
    outl 0xcfc 0xc000
    outl 0xcf8 0x80000804
    outl 0xcfc 0x01
    outl 0xc00d 0x0200
    outl 0xcf8 0x80000890
    outb 0xcfc 0x4
    outl 0xcf8 0x80000889
    outl 0xcfc 0x1c000000
    outl 0xcf8 0x80000893
    outw 0xcfc 0x100
    EOF

Got:
    ==68666== Invalid read of size 8
    ==68666==    at 0x688536: virtio_net_queue_enable (virtio-net.c:575)
    ==68666==    by 0x6E31AE: memory_region_write_accessor (memory.c:492)
    ==68666==    by 0x6E098D: access_with_adjusted_size (memory.c:554)
    ==68666==    by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
    ==68666==    by 0x6E31AE: memory_region_write_accessor (memory.c:492)
    ==68666==    by 0x6E098D: access_with_adjusted_size (memory.c:554)
    ==68666==    by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
    ==68666==    by 0x6EBCD3: flatview_write_continue (physmem.c:2820)
    ==68666==    by 0x6EBFBF: flatview_write (physmem.c:2862)
    ==68666==    by 0x6EF5E7: address_space_write (physmem.c:2958)
    ==68666==    by 0x6DFDEC: cpu_outw (ioport.c:70)
    ==68666==    by 0x6F6DF0: qtest_process_command (qtest.c:480)
    ==68666==  Address 0x29087fe8 is 24 bytes after a block of size 416 in arena "client"

That is reported by Alexander Bulekov. https://gitlab.com/qemu-project/qemu/-/issues/1309

Here, the queue_index is the index of the cvq, but in some cases cvq
does not have the corresponding NetClientState, so overflow appears.

I add a check here, ignore illegal queue_index and cvq queue_index.

Note the queue_index is below the VIRTIO_QUEUE_MAX but greater or equal
than cvq index could hit this. Other devices are similar.

Fixes: 7f863302 ("virtio-net: support queue_enable")
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1309
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Message-Id: <20221110095739.130393-1-xuanzhuo@linux.alibaba.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-11-10 10:18:55 -05:00
..
authz Prefer 'on' | 'off' over 'yes' | 'no' for bool options 2021-01-29 17:07:53 +00:00
block Block layer patches 2022-10-30 15:15:12 -04:00
chardev chardev: src buffer const for write functions 2022-09-29 14:38:05 +04:00
crypto crypto: Support export akcipher to pkcs8 2022-11-02 06:56:32 -04:00
disas target/loongarch: Add disassembler 2022-06-06 18:09:03 +00:00
exec pci,pc,virtio: features, tests, fixes, cleanups 2022-11-07 18:43:56 -05:00
fpu fpu: Add rebias bool, value and operation 2022-08-31 14:08:05 -03:00
hw virtio-net: fix for heap-buffer-overflow 2022-11-10 10:18:55 -05:00
io io/command: implement support for win32 2022-10-12 19:22:01 +04:00
libdecnumber Replace config-time define HOST_WORDS_BIGENDIAN 2022-04-06 10:50:37 +02:00
migration migration: Remove load_state_old and minimum_version_id_old 2022-03-02 18:20:45 +00:00
monitor monitor: add missing coroutine_fn annotation 2022-10-27 20:14:11 +02:00
net vhost-net: vhost-kernel: introduce vhost_net_virtqueue_restart() 2022-11-07 13:12:20 -05:00
qapi qerror: QERR_PERMISSION_DENIED is no longer used, drop 2022-10-27 07:57:18 +02:00
qemu display: include dependencies explicitly 2022-11-10 10:17:18 -05:00
qom qom/object: Remove circular include dependency 2022-06-28 10:53:32 +02:00
scsi scsi-disk: add SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE quirk for Macintosh 2022-07-13 16:58:58 +02:00
semihosting semihosting: Allow optional use of semihosting from userspace 2022-09-13 17:18:21 +01:00
standard-headers m68k: rework BI_VIRT_RNG_SEED as BI_RNG_SEED 2022-10-21 20:46:10 +02:00
sysemu cryptodev: Add a lkcf-backend for cryptodev 2022-11-02 06:56:32 -04:00
tcg accel/tcg: Introduce tb_pc and log_pc 2022-10-04 12:13:12 -07:00
ui ui/console: Get tab completion working again in the SDL monitor vc 2022-09-23 13:42:09 +02:00
user misc: fix commonly doubled up words 2022-08-01 11:58:02 +02:00
elf.h include/elf.h: add s390x note types 2022-10-26 12:54:59 +04:00
glib-compat.h compiler.h: replace QEMU_NORETURN with G_NORETURN 2022-04-21 17:03:51 +04:00
qemu-io.h
qemu-main.h ui/cocoa: Run qemu_init in the main thread 2022-09-23 14:36:33 +02:00