From: Alexander Bulekov <alxndr@bu.edu>
To: P J P <ppandit@redhat.com>
Cc: "Fam Zheng" <fam@euphon.net>,
"Prasad J Pandit" <pjp@fedoraproject.org>,
"QEMU Developers" <qemu-devel@nongnu.org>,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
"Ding Ren" <rding@gatech.edu>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Philippe Mathieu-Daudé" <philmd@redhat.com>,
"Hanqing Zhao" <hanqing@gatech.edu>
Subject: Re: [PATCH v2 1/3] megasas: use unsigned type for reply_queue_head and check index
Date: Wed, 13 May 2020 16:31:05 -0400 [thread overview]
Message-ID: <20200513203105.qjdby3s55kt6c7li@mozz.bu.edu> (raw)
In-Reply-To: <20200513192540.1583887-2-ppandit@redhat.com>
Hi Prasad,
On 200514 0055, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> A guest user may set 'reply_queue_head' field of MegasasState to
> a negative value. Later in 'megasas_lookup_frame' it is used to
> index into s->frames[] array. Use unsigned type to avoid OOB
> access issue.
>
> Also check that 'index' value stays within s->frames[] bounds
> through the while() loop in 'megasas_lookup_frame' to avoid OOB
> access.
>
> Reported-by: Ren Ding <rding@gatech.edu>
> Reported-by: Hanqing Zhao <hanqing@gatech.edu>
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
Acked-by: Alexander Bulekov <alxndr@bu.edu>
I applied these patches and could not reproduce the heap-overflow, or
LP1878259
Thanks
-Alex
> hw/scsi/megasas.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> Update v1 -> v2: fix OOB access when index > MEGASAS_MAX_FRAMES(=2048)
> -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html
>
> diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> index af18c88b65..6ce598cd69 100644
> --- a/hw/scsi/megasas.c
> +++ b/hw/scsi/megasas.c
> @@ -112,7 +112,7 @@ typedef struct MegasasState {
> uint64_t reply_queue_pa;
> void *reply_queue;
> int reply_queue_len;
> - int reply_queue_head;
> + uint16_t reply_queue_head;
> int reply_queue_tail;
> uint64_t consumer_pa;
> uint64_t producer_pa;
> @@ -445,7 +445,7 @@ static MegasasCmd *megasas_lookup_frame(MegasasState *s,
>
> index = s->reply_queue_head;
>
> - while (num < s->fw_cmds) {
> + while (num < s->fw_cmds && index < MEGASAS_MAX_FRAMES) {
> if (s->frames[index].pa && s->frames[index].pa == frame) {
> cmd = &s->frames[index];
> break;
> --
> 2.25.4
>
next prev parent reply other threads:[~2020-05-13 20:32 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-13 19:25 [PATCH v2 0/3] Megasas: fix OOB access and NULL dereference issues P J P
2020-05-13 19:25 ` [PATCH v2 1/3] megasas: use unsigned type for reply_queue_head and check index P J P
2020-05-13 20:31 ` Alexander Bulekov [this message]
2020-05-14 13:19 ` Darren Kenny
2020-05-14 16:10 ` P J P
2020-05-13 19:25 ` [PATCH v2 2/3] megasas: avoid NULL pointer dereference P J P
2020-05-13 20:20 ` Alexander Bulekov
2020-05-14 13:19 ` Darren Kenny
2020-05-21 15:34 ` Paolo Bonzini
2020-05-26 7:18 ` P J P
2020-05-26 7:49 ` Paolo Bonzini
2020-05-13 19:25 ` [PATCH v2 3/3] megasas: use unsigned type for positive numeric fields P J P
2020-05-14 13:28 ` Darren Kenny
2020-05-21 15:35 ` [PATCH v2 0/3] Megasas: fix OOB access and NULL dereference issues Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200513203105.qjdby3s55kt6c7li@mozz.bu.edu \
--to=alxndr@bu.edu \
--cc=fam@euphon.net \
--cc=hanqing@gatech.edu \
--cc=marcandre.lureau@redhat.com \
--cc=pbonzini@redhat.com \
--cc=philmd@redhat.com \
--cc=pjp@fedoraproject.org \
--cc=ppandit@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rding@gatech.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.