From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:42597)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <amit.shah@redhat.com>) id 1WUujQ-0001qq-7H
	for qemu-devel@nongnu.org; Tue, 01 Apr 2014 05:11:50 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <amit.shah@redhat.com>) id 1WUujK-0005DP-2c
	for qemu-devel@nongnu.org; Tue, 01 Apr 2014 05:11:44 -0400
Date: Tue, 1 Apr 2014 14:40:10 +0530
From: Amit Shah <amit.shah@redhat.com>
Message-ID: <20140401091010.GC27036@grmbl.mre>
References: <1396275242-10810-1-git-send-email-mst@redhat.com>
	<1396275242-10810-19-git-send-email-mst@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1396275242-10810-19-git-send-email-mst@redhat.com>
Subject: Re: [Qemu-devel] [PATCH v4 18/30] virtio: validate num_sg when
 mapping
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: mdroth@linux.vnet.ibm.com, Anthony Liguori <aliguori@amazon.com>, qemu-devel@nongnu.org, dgilbert@redhat.com, qemu-stable@nongnu.org

On (Mon) 31 Mar 2014 [17:17:05], Michael S. Tsirkin wrote:
> CVE-2013-4535
> CVE-2013-4536
> 
> Both virtio-block and virtio-serial read,
> VirtQueueElements are read in as buffers, and passed to
> virtqueue_map_sg(), where num_sg is taken from the wire and can force
> writes to indicies beyond VIRTQUEUE_MAX_SIZE.
> 
> To fix, validate num_sg.
> 
> Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>  hw/virtio/virtio.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index bcbfbb2..003b6ad 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -430,6 +430,12 @@ void virtqueue_map_sg(struct iovec *sg, hwaddr *addr,
>      unsigned int i;
>      hwaddr len;
>  
> +    if (num_sg >= VIRTQUEUE_MAX_SIZE) {
> +        error_report("virtio: map attempt out of bounds: %d > %d",
> +                     num_sg, VIRTQUEUE_MAX_SIZE);
> +        exit(1);

Doesn't compile; needs to be %zd because num_sg is size_t

		Amit