From: "Philippe Mathieu-Daudé" <philmd@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Mauro Matteo Cascella" <mcascell@redhat.com>,
qemu-block@nongnu.org, qemu-stable@nongnu.org,
"Qiuhao Li" <Qiuhao.Li@outlook.com>,
"Klaus Jensen" <its@irrelevant.dk>,
"Keith Busch" <kbusch@kernel.org>,
"Philippe Mathieu-Daudé" <philmd@redhat.com>
Subject: [PATCH-for-6.2] hw/nvme/ctrl: Fix buffer overrun (CVE-2021-3947)
Date: Thu, 11 Nov 2021 16:31:25 +0100 [thread overview]
Message-ID: <20211111153125.2258176-1-philmd@redhat.com> (raw)
Both 'buf_len' and 'off' arguments are under guest control.
Since nvme_c2h() doesn't check out of boundary access, the
caller must check for eventual buffer overrun on 'trans_len'.
Cc: qemu-stable@nongnu.org
Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Fixes: f432fdfa121 ("support changed namespace asynchronous event")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
hw/nvme/ctrl.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 6a571d18cfa..634b290e069 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -4072,7 +4072,8 @@ static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
NvmeNamespace *ns;
time_t current_ms;
- if (off >= sizeof(smart)) {
+ trans_len = MIN(sizeof(smart) - off, buf_len);
+ if (trans_len >= sizeof(smart)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
@@ -4094,7 +4095,6 @@ static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
}
}
- trans_len = MIN(sizeof(smart) - off, buf_len);
smart.critical_warning = n->smart_critical_warning;
smart.data_units_read[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_read,
@@ -4130,12 +4130,12 @@ static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off,
.afi = 0x1,
};
- if (off >= sizeof(fw_log)) {
+ trans_len = MIN(sizeof(fw_log) - off, buf_len);
+ if (trans_len >= sizeof(fw_log)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' ');
- trans_len = MIN(sizeof(fw_log) - off, buf_len);
return nvme_c2h(n, (uint8_t *) &fw_log + off, trans_len, req);
}
@@ -4146,7 +4146,8 @@ static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
uint32_t trans_len;
NvmeErrorLog errlog;
- if (off >= sizeof(errlog)) {
+ trans_len = MIN(sizeof(errlog) - off, buf_len);
+ if (trans_len >= sizeof(trans_len)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
@@ -4155,7 +4156,6 @@ static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
}
memset(&errlog, 0x0, sizeof(errlog));
- trans_len = MIN(sizeof(errlog) - off, buf_len);
return nvme_c2h(n, (uint8_t *)&errlog, trans_len, req);
}
@@ -4168,8 +4168,11 @@ static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
int i = 0;
uint32_t nsid;
- memset(nslist, 0x0, sizeof(nslist));
trans_len = MIN(sizeof(nslist) - off, buf_len);
+ if (trans_len >= sizeof(nslist)) {
+ return NVME_INVALID_FIELD | NVME_DNR;
+ }
+ memset(nslist, 0x0, sizeof(nslist));
while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=
NVME_CHANGED_NSID_SIZE) {
@@ -4209,7 +4212,8 @@ static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len,
const uint32_t *src_iocs = NULL;
uint32_t trans_len;
- if (off >= sizeof(log)) {
+ trans_len = MIN(sizeof(log) - off, buf_len);
+ if (trans_len >= sizeof(log)) {
trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(log));
return NVME_INVALID_FIELD | NVME_DNR;
}
@@ -4237,8 +4241,6 @@ static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len,
memcpy(log.iocs, src_iocs, sizeof(log.iocs));
}
- trans_len = MIN(sizeof(log) - off, buf_len);
-
return nvme_c2h(n, ((uint8_t *)&log) + off, trans_len, req);
}
--
2.31.1
next reply other threads:[~2021-11-11 15:33 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-11 15:31 Philippe Mathieu-Daudé [this message]
2021-11-11 18:08 ` [PATCH-for-6.2] hw/nvme/ctrl: Fix buffer overrun (CVE-2021-3947) Klaus Jensen
2021-11-11 18:46 ` Philippe Mathieu-Daudé
2021-11-11 20:42 ` Klaus Jensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211111153125.2258176-1-philmd@redhat.com \
--to=philmd@redhat.com \
--cc=Qiuhao.Li@outlook.com \
--cc=its@irrelevant.dk \
--cc=kbusch@kernel.org \
--cc=mcascell@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).