qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: P J P <ppandit@redhat.com>
To: John Snow <jsnow@redhat.com>
Cc: Gaoning Pan <pgn@zju.edu.cn>,
	QEMU Developers <qemu-devel@nongnu.org>,
	Prasad J Pandit <pjp@fedoraproject.org>
Subject: [PATCH] fdc: check drive block device before usage (CVE-2021-20196)
Date: Sat, 23 Jan 2021 15:33:45 +0530	[thread overview]
Message-ID: <20210123100345.642933-1-ppandit@redhat.com> (raw)

From: Prasad J Pandit <pjp@fedoraproject.org>

While processing ioport command in 'fdctrl_write_dor', device
controller may select a drive which is not initialised with a
block device. This may result in a NULL pointer dereference.
Add checks to avoid it.

Fixes: CVE-2021-20196
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Buglink: https://bugs.launchpad.net/qemu/+bug/1912780
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/block/fdc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 3636874432..13a9470d19 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -1429,7 +1429,9 @@ static void fdctrl_write_dor(FDCtrl *fdctrl, uint32_t value)
         }
     }
     /* Selected drive */
-    fdctrl->cur_drv = value & FD_DOR_SELMASK;
+    if (fdctrl->drives[value & FD_DOR_SELMASK].blk) {
+        fdctrl->cur_drv = value & FD_DOR_SELMASK;
+    }
 
     fdctrl->dor = value;
 }
@@ -1894,6 +1896,10 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
     uint32_t pos;
 
     cur_drv = get_cur_drv(fdctrl);
+    if (!cur_drv->blk) {
+        FLOPPY_DPRINTF("No drive connected\n");
+        return 0;
+    }
     fdctrl->dsr &= ~FD_DSR_PWRDOWN;
     if (!(fdctrl->msr & FD_MSR_RQM) || !(fdctrl->msr & FD_MSR_DIO)) {
         FLOPPY_DPRINTF("error: controller not ready for reading\n");
@@ -2420,7 +2426,8 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
         if (pos == FD_SECTOR_LEN - 1 ||
             fdctrl->data_pos == fdctrl->data_len) {
             cur_drv = get_cur_drv(fdctrl);
-            if (blk_pwrite(cur_drv->blk, fd_offset(cur_drv), fdctrl->fifo,
+            if (cur_drv->blk == NULL
+                || blk_pwrite(cur_drv->blk, fd_offset(cur_drv), fdctrl->fifo,
                            BDRV_SECTOR_SIZE, 0) < 0) {
                 FLOPPY_DPRINTF("error writing sector %d\n",
                                fd_sector(cur_drv));
-- 
2.29.2



             reply	other threads:[~2021-01-23 10:07 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-23 10:03 P J P [this message]
2021-01-23 17:47 ` Alexander Bulekov
2021-01-23 17:52   ` Alexander Bulekov
2021-05-17 19:41     ` John Snow
2021-01-30 13:35 ` P J P
2021-05-14 19:23 ` Thomas Huth
2021-05-14 19:26   ` John Snow
2021-05-15  8:49     ` Philippe Mathieu-Daudé
2021-05-17 11:12       ` P J P
2021-05-17 17:14         ` John Snow
2021-05-17 17:56         ` Philippe Mathieu-Daudé
2021-05-17 22:39 ` John Snow
2021-05-18  9:01   ` P J P
2021-05-18 14:18     ` John Snow
2021-05-18 17:24     ` John Snow
2021-05-19  7:32       ` P J P

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210123100345.642933-1-ppandit@redhat.com \
    --to=ppandit@redhat.com \
    --cc=jsnow@redhat.com \
    --cc=pgn@zju.edu.cn \
    --cc=pjp@fedoraproject.org \
    --cc=qemu-devel@nongnu.org \
    --subject='Re: [PATCH] fdc: check drive block device before usage (CVE-2021-20196)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).