From: P J P <ppandit@redhat.com>
To: John Snow <jsnow@redhat.com>
Cc: Wenxiang Qian <leonwxqian@gmail.com>,
QEMU Developers <qemu-devel@nongnu.org>,
Prasad J Pandit <pjp@fedoraproject.org>
Subject: [PATCH] ide:atapi: check io_buffer_index in ide_atapi_cmd_reply_end
Date: Wed, 18 Nov 2020 19:57:45 +0530 [thread overview]
Message-ID: <20201118142745.112579-1-ppandit@redhat.com> (raw)
From: Prasad J Pandit <pjp@fedoraproject.org>
During data transfer via packet command in 'ide_atapi_cmd_reply_end'
's->io_buffer_index' could exceed the 's->io_buffer' length, leading
to OOB access issue. Add check to avoid it.
...
#9 ahci_pio_transfer ../hw/ide/ahci.c:1383
#10 ide_transfer_start_norecurse ../hw/ide/core.c:553
#11 ide_atapi_cmd_reply_end ../hw/ide/atapi.c:284
#12 ide_atapi_cmd_read_pio ../hw/ide/atapi.c:329
#13 ide_atapi_cmd_read ../hw/ide/atapi.c:442
#14 cmd_read ../hw/ide/atapi.c:988
#15 ide_atapi_cmd ../hw/ide/atapi.c:1352
#16 ide_transfer_start ../hw/ide/core.c:561
#17 cmd_packet ../hw/ide/core.c:1729
#18 ide_exec_cmd ../hw/ide/core.c:2107
#19 handle_reg_h2d_fis ../hw/ide/ahci.c:1267
#20 handle_cmd ../hw/ide/ahci.c:1318
#21 check_cmd ../hw/ide/ahci.c:592
#22 ahci_port_write ../hw/ide/ahci.c:373
#23 ahci_mem_write ../hw/ide/ahci.c:513
Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/ide/atapi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
index 14a2b0bb2f..b991947c5c 100644
--- a/hw/ide/atapi.c
+++ b/hw/ide/atapi.c
@@ -276,6 +276,9 @@ void ide_atapi_cmd_reply_end(IDEState *s)
s->packet_transfer_size -= size;
s->elementary_transfer_size -= size;
s->io_buffer_index += size;
+ if (s->io_buffer_index > s->io_buffer_total_len) {
+ return;
+ }
/* Some adapters process PIO data right away. In that case, we need
* to avoid mutual recursion between ide_transfer_start
--
2.28.0
next reply other threads:[~2020-11-18 14:32 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-18 14:27 P J P [this message]
2020-11-27 13:57 ` [PATCH] ide:atapi: check io_buffer_index in ide_atapi_cmd_reply_end P J P
2020-12-01 11:51 ` Paolo Bonzini
2020-12-01 15:00 ` P J P
2020-12-01 15:23 ` Philippe Mathieu-Daudé
2020-12-01 15:30 ` Peter Maydell
2020-12-01 15:42 ` Paolo Bonzini
2020-12-01 15:30 ` Paolo Bonzini
2020-12-01 15:30 ` Paolo Bonzini
2020-12-02 7:07 ` Markus Armbruster
2020-12-02 13:17 ` P J P
2020-12-02 13:33 ` Paolo Bonzini
2020-12-02 13:36 ` Philippe Mathieu-Daudé
2020-12-03 9:48 ` P J P
2020-12-11 8:23 ` Wenxiang Qian
2020-12-11 8:32 ` Wenxiang Qian
2020-12-11 11:46 ` Paolo Bonzini
2020-12-11 11:45 ` Paolo Bonzini
2020-12-11 14:16 ` P J P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201118142745.112579-1-ppandit@redhat.com \
--to=ppandit@redhat.com \
--cc=jsnow@redhat.com \
--cc=leonwxqian@gmail.com \
--cc=pjp@fedoraproject.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).