* [Qemu-devel] [PATCH v3] net: ne2000: fix bounds check in ioport operations
@ 2015-12-31 11:35 P J P
2016-01-04 7:46 ` Jason Wang
0 siblings, 1 reply; 3+ messages in thread
From: P J P @ 2015-12-31 11:35 UTC (permalink / raw)
To: Jason Wang; +Cc: Prasad J Pandit, QEMU Developers, Ling Liu
From: Prasad J Pandit <pjp@fedoraproject.org>
While doing ioport r/w operations, ne2000 device emulation suffers
from OOB r/w errors. Update respective array bounds check to avoid
OOB access.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/net/ne2000.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
Updated as per review in
-> https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04863.html
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 010f9ef..9dd0c67 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -467,8 +467,9 @@ static inline void ne2000_mem_writel(NE2000State *s, uint32_t addr,
uint32_t val)
{
addr &= ~1; /* XXX: check exact behaviour if not even */
- if (addr < 32 ||
- (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+ if (addr < 32
+ || (addr >= NE2000_PMEM_START
+ && addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE)) {
stl_le_p(s->mem + addr, val);
}
}
@@ -497,8 +498,9 @@ static inline uint32_t ne2000_mem_readw(NE2000State *s, uint32_t addr)
static inline uint32_t ne2000_mem_readl(NE2000State *s, uint32_t addr)
{
addr &= ~1; /* XXX: check exact behaviour if not even */
- if (addr < 32 ||
- (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+ if (addr < 32
+ || (addr >= NE2000_PMEM_START
+ && addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE)) {
return ldl_le_p(s->mem + addr);
} else {
return 0xffffffff;
--
2.4.3
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH v3] net: ne2000: fix bounds check in ioport operations
2015-12-31 11:35 [Qemu-devel] [PATCH v3] net: ne2000: fix bounds check in ioport operations P J P
@ 2016-01-04 7:46 ` Jason Wang
2016-01-04 9:06 ` P J P
0 siblings, 1 reply; 3+ messages in thread
From: Jason Wang @ 2016-01-04 7:46 UTC (permalink / raw)
To: P J P; +Cc: Prasad J Pandit, QEMU Developers, Ling Liu
On 12/31/2015 07:35 PM, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> While doing ioport r/w operations, ne2000 device emulation suffers
> from OOB r/w errors. Update respective array bounds check to avoid
> OOB access.
>
> Reported-by: Ling Liu <liuling-it@360.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
> hw/net/ne2000.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> Updated as per review in
> -> https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04863.html
>
> diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
> index 010f9ef..9dd0c67 100644
> --- a/hw/net/ne2000.c
> +++ b/hw/net/ne2000.c
> @@ -467,8 +467,9 @@ static inline void ne2000_mem_writel(NE2000State *s, uint32_t addr,
> uint32_t val)
> {
> addr &= ~1; /* XXX: check exact behaviour if not even */
> - if (addr < 32 ||
> - (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
> + if (addr < 32
> + || (addr >= NE2000_PMEM_START
> + && addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE)) {
> stl_le_p(s->mem + addr, val);
> }
> }
> @@ -497,8 +498,9 @@ static inline uint32_t ne2000_mem_readw(NE2000State *s, uint32_t addr)
> static inline uint32_t ne2000_mem_readl(NE2000State *s, uint32_t addr)
> {
> addr &= ~1; /* XXX: check exact behaviour if not even */
> - if (addr < 32 ||
> - (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
> + if (addr < 32
> + || (addr >= NE2000_PMEM_START
> + && addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE)) {
> return ldl_le_p(s->mem + addr);
> } else {
> return 0xffffffff;
Applied to my -net with minor tweaks:
Change "addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE" to "addr +
sizeof(uint32_t) <= NE2000_MEM_SIZE".
Thanks
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH v3] net: ne2000: fix bounds check in ioport operations
2016-01-04 7:46 ` Jason Wang
@ 2016-01-04 9:06 ` P J P
0 siblings, 0 replies; 3+ messages in thread
From: P J P @ 2016-01-04 9:06 UTC (permalink / raw)
To: Jason Wang; +Cc: QEMU Developers, Ling Liu
+-- On Mon, 4 Jan 2016, Jason Wang wrote --+
| > + if (addr < 32
| > + || (addr >= NE2000_PMEM_START
| > + && addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE)) {
| > return ldl_le_p(s->mem + addr);
| > } else {
| > return 0xffffffff;
|
| Applied to my -net with minor tweaks:
|
| Change "addr + sizeof(uint32_t) - 1 < NE2000_MEM_SIZE" to "addr +
| sizeof(uint32_t) <= NE2000_MEM_SIZE".
Okay, thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-01-04 9:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-12-31 11:35 [Qemu-devel] [PATCH v3] net: ne2000: fix bounds check in ioport operations P J P
2016-01-04 7:46 ` Jason Wang
2016-01-04 9:06 ` P J P
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).