qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Peter Maydell <peter.maydell@linaro.org>
To: qemu-devel@nongnu.org
Subject: [PULL 15/21] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
Date: Tue,  2 Feb 2021 17:55:11 +0000	[thread overview]
Message-ID: <20210202175517.28729-16-peter.maydell@linaro.org> (raw)
In-Reply-To: <20210202175517.28729-1-peter.maydell@linaro.org>

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the ARM Generic Interrupt Controller Architecture specification
(document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit,
not 10:

  - 4.3 Distributor register descriptions
  - 4.3.15 Software Generated Interrupt Register, GICD_SG

    - Table 4-21 GICD_SGIR bit assignments

    The Interrupt ID of the SGI to forward to the specified CPU
    interfaces. The value of this field is the Interrupt ID, in
    the range 0-15, for example a value of 0b0011 specifies
    Interrupt ID 3.

Correct the irq mask to fix an undefined behavior (which eventually
lead to a heap-buffer-overflow, see [Buglink]):

   $ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio
   [I 1612088147.116987] OPENED
  [R +0.278293] writel 0x8000f00 0xff4affb0
  ../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]'
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13

This fixes a security issue when running with KVM on Arm with
kernel-irqchip=off. (The default is kernel-irqchip=on, which is
unaffected, and which is also the correct choice for performance.)

Cc: qemu-stable@nongnu.org
Fixes: 9ee6e8bb853 ("ARMv7 support.")
Buglink: https://bugs.launchpad.net/qemu/+bug/1913916
Buglink: https://bugs.launchpad.net/qemu/+bug/1913917
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210131103401.217160-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index c33b1c8c4bc..a994b1f0245 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -1477,7 +1477,7 @@ static void gic_dist_writel(void *opaque, hwaddr offset,
         int target_cpu;
 
         cpu = gic_get_current_cpu(s);
-        irq = value & 0x3ff;
+        irq = value & 0xf;
         switch ((value >> 24) & 3) {
         case 0:
             mask = (value >> 16) & ALL_CPU_MASK;
-- 
2.20.1



  parent reply	other threads:[~2021-02-02 18:20 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-02 17:54 [PULL 00/21] target-arm queue Peter Maydell
2021-02-02 17:54 ` [PULL 01/21] hw/intc/arm_gic: Allow to use QTest without crashing Peter Maydell
2021-02-02 17:54 ` [PULL 02/21] hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled Peter Maydell
2021-02-02 17:54 ` [PULL 03/21] hw/char/exynos4210_uart: Fix missing call to report ready for input Peter Maydell
2021-02-02 17:55 ` [PULL 04/21] hw/arm/smmuv3: Fix addr_mask for range-based invalidation Peter Maydell
2021-02-02 17:55 ` [PULL 05/21] hw/ssi: imx_spi: Use a macro for number of chip selects supported Peter Maydell
2021-02-02 17:55 ` [PULL 06/21] hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset() Peter Maydell
2021-02-02 17:55 ` [PULL 07/21] hw/ssi: imx_spi: Remove pointless variable initialization Peter Maydell
2021-02-02 17:55 ` [PULL 08/21] hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value Peter Maydell
2021-02-02 17:55 ` [PULL 09/21] hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled Peter Maydell
2021-02-02 17:55 ` [PULL 10/21] hw/ssi: imx_spi: Rework imx_spi_write() " Peter Maydell
2021-02-02 17:55 ` [PULL 11/21] hw/ssi: imx_spi: Disable chip selects when controller is disabled Peter Maydell
2021-02-02 17:55 ` [PULL 12/21] hw/ssi: imx_spi: Round up the burst length to be multiple of 8 Peter Maydell
2021-02-02 17:55 ` [PULL 13/21] hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic Peter Maydell
2021-02-02 17:55 ` [PULL 14/21] hw/ssi: imx_spi: Correct tx and rx fifo endianness Peter Maydell
2021-02-02 17:55 ` Peter Maydell [this message]
2021-02-02 17:55 ` [PULL 16/21] hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ Peter Maydell
2021-02-02 17:55 ` [PULL 17/21] hw/arm/exynos4210: " Peter Maydell
2021-02-02 17:55 ` [PULL 18/21] hw/arm/xlnx-versal: Versal SoC requires ZDMA Peter Maydell
2021-02-02 17:55 ` [PULL 19/21] hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals Peter Maydell
2021-02-02 17:55 ` [PULL 20/21] hw/net/can: ZynqMP CAN device requires PTIMER Peter Maydell
2021-02-02 17:55 ` [PULL 21/21] hw/arm: Display CPU type in machine description Peter Maydell
2021-02-03  9:22 ` [PULL 00/21] target-arm queue Philippe Mathieu-Daudé
2021-02-03 10:12   ` P J P

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210202175517.28729-16-peter.maydell@linaro.org \
    --to=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).