All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alexander Bulekov <alxndr@bu.edu>
To: qemu-devel@nongnu.org
Cc: bonzini@redhat.com, peter.maydell@linaro.org,
	"Philippe Mathieu-Daudé" <philmd@redhat.com>,
	"Darren Kenny" <darren.kenny@oracle.com>,
	"Alexander Bulekov" <alxndr@bu.edu>
Subject: [PULL v3 1/8] fuzz: fix sparse memory access in the DMA callback
Date: Wed,  1 Sep 2021 07:49:57 -0400	[thread overview]
Message-ID: <20210901115004.34768-2-alxndr@bu.edu> (raw)
In-Reply-To: <20210901115004.34768-1-alxndr@bu.edu>

The code mistakenly relied on address_space_translate to store the
length remaining until the next memory-region. We care about this
because when there is RAM or sparse-memory neighboring on an MMIO
region, we should only write up to the border, to prevent inadvertently
invoking MMIO handlers within the DMA callback.

However address_space_translate_internal only stores the length until
the end of the MemoryRegion if memory_region_is_ram(mr). Otherwise
the *len is left unmodified. This caused some false-positive issues,
where the fuzzer found a way to perform a nested MMIO write through a
DMA callback on an [address, length] that started within sparse memory
and spanned some device MMIO regions.

To fix this, write to sparse memory in small chunks of
memory_access_size (similar to the underlying address_space_write code),
which will prevent accidentally hitting MMIO handlers through large
writes.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 tests/qtest/fuzz/generic_fuzz.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index 6c67522717..0ea47298b7 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -240,10 +240,17 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
                                       addr, &addr1, &l, true,
                                       MEMTXATTRS_UNSPECIFIED);
 
-        if (!(memory_region_is_ram(mr1) ||
-              memory_region_is_romd(mr1)) && mr1 != sparse_mem_mr) {
+        /*
+         *  If mr1 isn't RAM, address_space_translate doesn't update l. Use
+         *  memory_access_size to identify the number of bytes that it is safe
+         *  to write without accidentally writing to another MemoryRegion.
+         */
+        if (!memory_region_is_ram(mr1)) {
             l = memory_access_size(mr1, l, addr1);
-        } else {
+        }
+        if (memory_region_is_ram(mr1) ||
+            memory_region_is_romd(mr1) ||
+            mr1 == sparse_mem_mr) {
             /* ROM/RAM case */
             if (qtest_log_enabled) {
                 /*
-- 
2.30.2



  reply	other threads:[~2021-09-01 11:54 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-01 11:49 [PULL v3 0/8] Fuzzing Patches for 2021-09-01 Alexander Bulekov
2021-09-01 11:49 ` Alexander Bulekov [this message]
2021-09-01 11:49 ` [PULL v3 2/8] fuzz: adjust timeout to allow for longer inputs Alexander Bulekov
2021-09-01 11:49 ` [PULL v3 3/8] fuzz: make object-name matching case-insensitive Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 4/8] fuzz: add an instrumentation filter Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 5/8] fuzz: use ITIMER_REAL for timeouts Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 6/8] fuzz: unblock SIGALRM so the timeout works Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 7/8] MAINTAINERS: Add myself as a reviewer for Device Fuzzing Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 8/8] MAINTAINERS: add fuzzing reviewer Alexander Bulekov
2021-09-03  7:26 ` [PULL v3 0/8] Fuzzing Patches for 2021-09-01 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210901115004.34768-2-alxndr@bu.edu \
    --to=alxndr@bu.edu \
    --cc=bonzini@redhat.com \
    --cc=darren.kenny@oracle.com \
    --cc=peter.maydell@linaro.org \
    --cc=philmd@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --subject='Re: [PULL v3 1/8] fuzz: fix sparse memory access in the DMA callback' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.