From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kiszka Subject: [PATCH uq/master] kvmvapic: Prevent reading beyond the end of guest RAM Date: Mon, 30 Sep 2013 12:35:13 +0200 Message-ID: <524953E1.6000105@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: qemu-devel , kvm , "Michael S. Tsirkin" To: Gleb Natapov , Paolo Bonzini Return-path: Received: from david.siemens.de ([192.35.17.14]:34034 "EHLO david.siemens.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756361Ab3I3KfV (ORCPT ); Mon, 30 Sep 2013 06:35:21 -0400 Sender: kvm-owner@vger.kernel.org List-ID: rom_state_paddr is guest provided (caller address of outw(VAPIC_PORT) + writen 16-bit value) and can be influenced to point beyond the end of the host memory backing the guest's RAM. Make sure we do not use this pointer to actually read beyond the limits. Reading arbitrary guest bytes is harmless, the guest kernel has to manage access to this I/O port anyway. Signed-off-by: Jan Kiszka --- hw/i386/kvmvapic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index 1c2dbf5..2d87600 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -596,6 +596,9 @@ static int vapic_map_rom_writable(VAPICROMState *s) section = memory_region_find(as, 0, 1); /* read ROM size from RAM region */ + if (rom_paddr + 2 >= memory_region_size(section.mr)) { + return -1; + } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0) { -- 1.8.1.1.298.ge7eed54 From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48384) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VQap2-0004eB-99 for qemu-devel@nongnu.org; Mon, 30 Sep 2013 06:35:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VQaov-0005SP-Tx for qemu-devel@nongnu.org; Mon, 30 Sep 2013 06:35:24 -0400 Received: from david.siemens.de ([192.35.17.14]:23923) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VQaov-0005R6-KE for qemu-devel@nongnu.org; Mon, 30 Sep 2013 06:35:17 -0400 Message-ID: <524953E1.6000105@siemens.com> Date: Mon, 30 Sep 2013 12:35:13 +0200 From: Jan Kiszka MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH uq/master] kvmvapic: Prevent reading beyond the end of guest RAM List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gleb Natapov , Paolo Bonzini Cc: qemu-devel , kvm , "Michael S. Tsirkin" rom_state_paddr is guest provided (caller address of outw(VAPIC_PORT) + writen 16-bit value) and can be influenced to point beyond the end of the host memory backing the guest's RAM. Make sure we do not use this pointer to actually read beyond the limits. Reading arbitrary guest bytes is harmless, the guest kernel has to manage access to this I/O port anyway. Signed-off-by: Jan Kiszka --- hw/i386/kvmvapic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index 1c2dbf5..2d87600 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -596,6 +596,9 @@ static int vapic_map_rom_writable(VAPICROMState *s) section = memory_region_find(as, 0, 1); /* read ROM size from RAM region */ + if (rom_paddr + 2 >= memory_region_size(section.mr)) { + return -1; + } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0) { -- 1.8.1.1.298.ge7eed54