Re: [Qemu-devel] [Qemu-block] [QEMU-SECURITY] ide: fix assertion in ide_dma_cb() to prevent qemu DoS from quest

From: John Snow <jsnow@redhat.com>
To: Kevin Wolf <kwolf@redhat.com>, Alexander Popov <alex.popov@linux.com>
Cc: sstabellini@kernel.org, pmatouse@redhat.com,
	mdroth@linux.vnet.ibm.com, qemu-block@nongnu.org, mst@redhat.com,
	qemu-devel@nongnu.org, qemu-stable@nongnu.org, pjp@redhat.com
Subject: Re: [Qemu-devel] [Qemu-block] [QEMU-SECURITY] ide: fix assertion in ide_dma_cb() to prevent qemu DoS from quest
Date: Tue, 16 Jul 2019 10:57:14 -0400	[thread overview]
Message-ID: <52979901-15a7-ee2c-80d7-4cbbc99f461c@redhat.com> (raw)
In-Reply-To: <20190716112535.GB7297@linux.fritz.box>

On 7/16/19 7:25 AM, Kevin Wolf wrote:
> Am 15.07.2019 um 13:24 hat Alexander Popov geschrieben:
>> On 05.07.2019 17:07, Alexander Popov wrote:
>>> This assertion was introduced in the commit a718978ed58a in July 2015.
>>> It implies that the size of successful DMA transfers handled in
>>> ide_dma_cb() should be multiple of 512 (the size of a sector).
>>>
>>> But guest systems can initiate DMA transfers that don't fit this
>>> requirement. Let's improve the assertion to prevent qemu DoS from quests.
>>
>> Hello!
>>
>> Just a friendly ping.
>>
>> Could you have a look at this patch?
> 
> John, I think this is for you.
> 
> I haven't reviewed this yet, but if we put an assertion there that the
> request is aligned, we probably rely on this fact somewhere in the code.
> So I suspect that just changing the assertion without changing other
> code, too, might not be enough.
> 
> Kevin
> 

Right; I'm aware of the patch. It's on the list to investigate today.

I have the same concern that the assertion intuits a bug elsewhere, so I
wanted to give this one a thorough investigation before inclusion for rc1.

Sorry for the delay, it IS on my list, but I also feel that a privileged
DOS by a guest of a legacy device is actually low priority
security-wise, unless we can demonstrate that there are side effects
that can be exploited.

--js