From: Michael Tokarev <mjt@tls.msk.ru>
To: qemu-devel@nongnu.org
Cc: qemu-stable@nongnu.org, Jeuk Kim <jeuk20.kim@samsung.com>,
Zheyu Ma <zheyuma97@gmail.com>, Michael Tokarev <mjt@tls.msk.ru>
Subject: [Stable-8.2.4 12/16] hw/ufs: Fix buffer overflow bug
Date: Tue, 7 May 2024 11:42:11 +0300 [thread overview]
Message-ID: <20240507084226.1026455-12-mjt@tls.msk.ru> (raw)
In-Reply-To: <qemu-stable-8.2.4-20240506205855@cover.tls.msk.ru>
From: Jeuk Kim <jeuk20.kim@samsung.com>
It fixes the buffer overflow vulnerability in the ufs device.
The bug was detected by sanitizers.
You can reproduce it by:
cat << EOF |\
qemu-system-x86_64 \
-display none -machine accel=qtest -m 512M -M q35 -nodefaults -drive \
file=null-co://,if=none,id=disk0 -device ufs,id=ufs_bus -device \
ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio
outl 0xcf8 0x80000810
outl 0xcfc 0xe0000000
outl 0xcf8 0x80000804
outw 0xcfc 0x06
write 0xe0000058 0x1 0xa7
write 0xa 0x1 0x50
EOF
Resolves: #2299
Fixes: 329f16624499 ("hw/ufs: Support for Query Transfer Requests")
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
(cherry picked from commit f2c8aeb1afefcda92054c448b21fc59cdd99db30)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index eccdb852a0..bac78a32bb 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -126,6 +126,10 @@ static MemTxResult ufs_dma_read_req_upiu(UfsRequest *req)
copy_size = sizeof(UtpUpiuHeader) + UFS_TRANSACTION_SPECIFIC_FIELD_SIZE +
data_segment_length;
+ if (copy_size > sizeof(req->req_upiu)) {
+ copy_size = sizeof(req->req_upiu);
+ }
+
ret = ufs_addr_read(u, req_upiu_base_addr, &req->req_upiu, copy_size);
if (ret) {
trace_ufs_err_dma_read_req_upiu(req->slot, req_upiu_base_addr);
@@ -225,6 +229,10 @@ static MemTxResult ufs_dma_write_rsp_upiu(UfsRequest *req)
copy_size = rsp_upiu_byte_len;
}
+ if (copy_size > sizeof(req->rsp_upiu)) {
+ copy_size = sizeof(req->rsp_upiu);
+ }
+
ret = ufs_addr_write(u, rsp_upiu_base_addr, &req->rsp_upiu, copy_size);
if (ret) {
trace_ufs_err_dma_write_rsp_upiu(req->slot, rsp_upiu_base_addr);
--
2.39.2
next prev parent reply other threads:[~2024-05-07 8:44 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-07 8:41 [Stable-8.2.4 00/16] Patch Round-up for stable 8.2.4 (planned for 2024-05-12) Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 01/16] target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 02/16] target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 03/16] target/riscv/kvm: change timer regs size " Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 04/16] migration/colo: Fix bdrv_graph_rdlock_main_loop: Assertion `!qemu_in_coroutine()' failed Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 05/16] linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 06/16] nbd/server: do not poll within a coroutine context Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 07/16] nbd/server: Mark negotiation functions as coroutine_fn Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 08/16] backends/cryptodev-builtin: Fix local_error leaks Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 09/16] target/loongarch/cpu.c: typo fix: expection Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 10/16] tests/avocado: update sunxi kernel from armbian to 6.6.16 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 11/16] .gitlab-ci.d/cirrus.yml: Shorten the runtime of the macOS and FreeBSD jobs Michael Tokarev
2024-05-07 8:42 ` Michael Tokarev [this message]
2024-05-07 8:42 ` [Stable-8.2.4 13/16] hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 14/16] hw/arm/npcm7xx: Store derivative OTP fuse key in little endian Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 15/16] target/sh4: Fix ADDV opcode Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 16/16] target/sh4: Fix SUBV opcode Michael Tokarev
2024-05-07 8:45 ` [Stable-8.2.4 00/16] Patch Round-up for stable 8.2.4 (planned for 2024-05-10) Michael Tokarev
2024-05-10 15:05 ` Michael Tokarev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240507084226.1026455-12-mjt@tls.msk.ru \
--to=mjt@tls.msk.ru \
--cc=jeuk20.kim@samsung.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=zheyuma97@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).