* [PATCH v2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
@ 2022-07-11 12:33 Mauro Matteo Cascella
2022-07-12 0:09 ` Alexander Bulekov
0 siblings, 1 reply; 2+ messages in thread
From: Mauro Matteo Cascella @ 2022-07-11 12:33 UTC (permalink / raw)
To: qemu-devel; +Cc: mcascell, pbonzini, fam, thuth, alxndr
Set current_req to NULL to prevent reusing a free'd buffer in case of repeated
SCSI cancel requests. Thanks to Thomas Huth for suggesting the first version of
the patch and Alexander Bulekov for providing a reproducer.
Fixes: CVE-2022-0216
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
---
v2:
- handle CLEAR QUEUE and BUS DEVICE RESET messages
- new qtest: test_lsi_do_msgout_cancel_req
hw/scsi/lsi53c895a.c | 2 +
tests/qtest/fuzz-lsi53c895a-test.c | 71 ++++++++++++++++++++++++++++++
2 files changed, 73 insertions(+)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index c8773f73f7..6934040c59 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -1030,6 +1030,7 @@ static void lsi_do_msgout(LSIState *s)
trace_lsi_do_msgout_abort(current_tag);
if (current_req) {
scsi_req_cancel(current_req->req);
+ current_req = NULL;
}
lsi_disconnect(s);
break;
@@ -1055,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s)
/* clear the current I/O process */
if (s->current) {
scsi_req_cancel(s->current->req);
+ current_req = NULL;
}
/* As the current implemented devices scsi_disk and scsi_generic
diff --git a/tests/qtest/fuzz-lsi53c895a-test.c b/tests/qtest/fuzz-lsi53c895a-test.c
index 2e8e67859e..6872c70d3a 100644
--- a/tests/qtest/fuzz-lsi53c895a-test.c
+++ b/tests/qtest/fuzz-lsi53c895a-test.c
@@ -8,6 +8,74 @@
#include "qemu/osdep.h"
#include "libqtest.h"
+/*
+ * This used to trigger a UAF in lsi_do_msgout()
+ * https://gitlab.com/qemu-project/qemu/-/issues/972
+ */
+static void test_lsi_do_msgout_cancel_req(void)
+{
+ QTestState *s;
+
+ s = qtest_init("-M q35 -m 4G -display none -nodefaults "
+ "-device lsi53c895a,id=scsi "
+ "-device scsi-hd,drive=disk0 "
+ "-drive file=null-co://,id=disk0,if=none,format=raw");
+
+ qtest_outl(s, 0xcf8, 0x80000810);
+ qtest_outl(s, 0xcf8, 0xc000);
+ qtest_outl(s, 0xcf8, 0x80000810);
+ qtest_outw(s, 0xcfc, 0x7);
+ qtest_outl(s, 0xcf8, 0x80000810);
+ qtest_outl(s, 0xcfc, 0xc000);
+ qtest_outl(s, 0xcf8, 0x80000804);
+ qtest_outw(s, 0xcfc, 0x05);
+ qtest_writeb(s, 0x69736c10, 0x08);
+ qtest_writeb(s, 0x69736c13, 0x58);
+ qtest_writeb(s, 0x69736c1a, 0x01);
+ qtest_writeb(s, 0x69736c1b, 0x06);
+ qtest_writeb(s, 0x69736c22, 0x01);
+ qtest_writeb(s, 0x69736c23, 0x07);
+ qtest_writeb(s, 0x69736c2b, 0x02);
+ qtest_writeb(s, 0x69736c48, 0x08);
+ qtest_writeb(s, 0x69736c4b, 0x58);
+ qtest_writeb(s, 0x69736c52, 0x04);
+ qtest_writeb(s, 0x69736c53, 0x06);
+ qtest_writeb(s, 0x69736c5b, 0x02);
+ qtest_outl(s, 0xc02d, 0x697300);
+ qtest_writeb(s, 0x5a554662, 0x01);
+ qtest_writeb(s, 0x5a554663, 0x07);
+ qtest_writeb(s, 0x5a55466a, 0x10);
+ qtest_writeb(s, 0x5a55466b, 0x22);
+ qtest_writeb(s, 0x5a55466c, 0x5a);
+ qtest_writeb(s, 0x5a55466d, 0x5a);
+ qtest_writeb(s, 0x5a55466e, 0x34);
+ qtest_writeb(s, 0x5a55466f, 0x5a);
+ qtest_writeb(s, 0x5a345a5a, 0x77);
+ qtest_writeb(s, 0x5a345a5b, 0x55);
+ qtest_writeb(s, 0x5a345a5c, 0x51);
+ qtest_writeb(s, 0x5a345a5d, 0x27);
+ qtest_writeb(s, 0x27515577, 0x41);
+ qtest_outl(s, 0xc02d, 0x5a5500);
+ qtest_writeb(s, 0x364001d0, 0x08);
+ qtest_writeb(s, 0x364001d3, 0x58);
+ qtest_writeb(s, 0x364001da, 0x01);
+ qtest_writeb(s, 0x364001db, 0x26);
+ qtest_writeb(s, 0x364001dc, 0x0d);
+ qtest_writeb(s, 0x364001dd, 0xae);
+ qtest_writeb(s, 0x364001de, 0x41);
+ qtest_writeb(s, 0x364001df, 0x5a);
+ qtest_writeb(s, 0x5a41ae0d, 0xf8);
+ qtest_writeb(s, 0x5a41ae0e, 0x36);
+ qtest_writeb(s, 0x5a41ae0f, 0xd7);
+ qtest_writeb(s, 0x5a41ae10, 0x36);
+ qtest_writeb(s, 0x36d736f8, 0x0c);
+ qtest_writeb(s, 0x36d736f9, 0x80);
+ qtest_writeb(s, 0x36d736fa, 0x0d);
+ qtest_outl(s, 0xc02d, 0x364000);
+
+ qtest_quit(s);
+}
+
/*
* This used to trigger the assert in lsi_do_dma()
* https://bugs.launchpad.net/qemu/+bug/697510
@@ -44,5 +112,8 @@ int main(int argc, char **argv)
qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
test_lsi_do_dma_empty_queue);
+ qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
+ test_lsi_do_msgout_cancel_req);
+
return g_test_run();
}
--
2.35.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
2022-07-11 12:33 [PATCH v2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) Mauro Matteo Cascella
@ 2022-07-12 0:09 ` Alexander Bulekov
0 siblings, 0 replies; 2+ messages in thread
From: Alexander Bulekov @ 2022-07-12 0:09 UTC (permalink / raw)
To: Mauro Matteo Cascella; +Cc: qemu-devel, pbonzini, fam, thuth
On 220711 1433, Mauro Matteo Cascella wrote:
> Set current_req to NULL to prevent reusing a free'd buffer in case of repeated
> SCSI cancel requests. Thanks to Thomas Huth for suggesting the first version of
> the patch and Alexander Bulekov for providing a reproducer.
>
> Fixes: CVE-2022-0216
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Thank you - With this, the fuzzer isn't finding any more heap-related
crashes.
Tested-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> v2:
> - handle CLEAR QUEUE and BUS DEVICE RESET messages
> - new qtest: test_lsi_do_msgout_cancel_req
>
> hw/scsi/lsi53c895a.c | 2 +
> tests/qtest/fuzz-lsi53c895a-test.c | 71 ++++++++++++++++++++++++++++++
> 2 files changed, 73 insertions(+)
>
> diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
> index c8773f73f7..6934040c59 100644
> --- a/hw/scsi/lsi53c895a.c
> +++ b/hw/scsi/lsi53c895a.c
> @@ -1030,6 +1030,7 @@ static void lsi_do_msgout(LSIState *s)
> trace_lsi_do_msgout_abort(current_tag);
> if (current_req) {
> scsi_req_cancel(current_req->req);
> + current_req = NULL;
> }
> lsi_disconnect(s);
> break;
> @@ -1055,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s)
> /* clear the current I/O process */
> if (s->current) {
> scsi_req_cancel(s->current->req);
> + current_req = NULL;
> }
>
> /* As the current implemented devices scsi_disk and scsi_generic
> diff --git a/tests/qtest/fuzz-lsi53c895a-test.c b/tests/qtest/fuzz-lsi53c895a-test.c
> index 2e8e67859e..6872c70d3a 100644
> --- a/tests/qtest/fuzz-lsi53c895a-test.c
> +++ b/tests/qtest/fuzz-lsi53c895a-test.c
> @@ -8,6 +8,74 @@
> #include "qemu/osdep.h"
> #include "libqtest.h"
>
> +/*
> + * This used to trigger a UAF in lsi_do_msgout()
> + * https://gitlab.com/qemu-project/qemu/-/issues/972
> + */
> +static void test_lsi_do_msgout_cancel_req(void)
> +{
> + QTestState *s;
> +
> + s = qtest_init("-M q35 -m 4G -display none -nodefaults "
> + "-device lsi53c895a,id=scsi "
> + "-device scsi-hd,drive=disk0 "
> + "-drive file=null-co://,id=disk0,if=none,format=raw");
> +
> + qtest_outl(s, 0xcf8, 0x80000810);
> + qtest_outl(s, 0xcf8, 0xc000);
> + qtest_outl(s, 0xcf8, 0x80000810);
> + qtest_outw(s, 0xcfc, 0x7);
> + qtest_outl(s, 0xcf8, 0x80000810);
> + qtest_outl(s, 0xcfc, 0xc000);
> + qtest_outl(s, 0xcf8, 0x80000804);
> + qtest_outw(s, 0xcfc, 0x05);
> + qtest_writeb(s, 0x69736c10, 0x08);
> + qtest_writeb(s, 0x69736c13, 0x58);
> + qtest_writeb(s, 0x69736c1a, 0x01);
> + qtest_writeb(s, 0x69736c1b, 0x06);
> + qtest_writeb(s, 0x69736c22, 0x01);
> + qtest_writeb(s, 0x69736c23, 0x07);
> + qtest_writeb(s, 0x69736c2b, 0x02);
> + qtest_writeb(s, 0x69736c48, 0x08);
> + qtest_writeb(s, 0x69736c4b, 0x58);
> + qtest_writeb(s, 0x69736c52, 0x04);
> + qtest_writeb(s, 0x69736c53, 0x06);
> + qtest_writeb(s, 0x69736c5b, 0x02);
> + qtest_outl(s, 0xc02d, 0x697300);
> + qtest_writeb(s, 0x5a554662, 0x01);
> + qtest_writeb(s, 0x5a554663, 0x07);
> + qtest_writeb(s, 0x5a55466a, 0x10);
> + qtest_writeb(s, 0x5a55466b, 0x22);
> + qtest_writeb(s, 0x5a55466c, 0x5a);
> + qtest_writeb(s, 0x5a55466d, 0x5a);
> + qtest_writeb(s, 0x5a55466e, 0x34);
> + qtest_writeb(s, 0x5a55466f, 0x5a);
> + qtest_writeb(s, 0x5a345a5a, 0x77);
> + qtest_writeb(s, 0x5a345a5b, 0x55);
> + qtest_writeb(s, 0x5a345a5c, 0x51);
> + qtest_writeb(s, 0x5a345a5d, 0x27);
> + qtest_writeb(s, 0x27515577, 0x41);
> + qtest_outl(s, 0xc02d, 0x5a5500);
> + qtest_writeb(s, 0x364001d0, 0x08);
> + qtest_writeb(s, 0x364001d3, 0x58);
> + qtest_writeb(s, 0x364001da, 0x01);
> + qtest_writeb(s, 0x364001db, 0x26);
> + qtest_writeb(s, 0x364001dc, 0x0d);
> + qtest_writeb(s, 0x364001dd, 0xae);
> + qtest_writeb(s, 0x364001de, 0x41);
> + qtest_writeb(s, 0x364001df, 0x5a);
> + qtest_writeb(s, 0x5a41ae0d, 0xf8);
> + qtest_writeb(s, 0x5a41ae0e, 0x36);
> + qtest_writeb(s, 0x5a41ae0f, 0xd7);
> + qtest_writeb(s, 0x5a41ae10, 0x36);
> + qtest_writeb(s, 0x36d736f8, 0x0c);
> + qtest_writeb(s, 0x36d736f9, 0x80);
> + qtest_writeb(s, 0x36d736fa, 0x0d);
> + qtest_outl(s, 0xc02d, 0x364000);
> +
> + qtest_quit(s);
> +}
> +
> /*
> * This used to trigger the assert in lsi_do_dma()
> * https://bugs.launchpad.net/qemu/+bug/697510
> @@ -44,5 +112,8 @@ int main(int argc, char **argv)
> qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
> test_lsi_do_dma_empty_queue);
>
> + qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
> + test_lsi_do_msgout_cancel_req);
> +
> return g_test_run();
> }
> --
> 2.35.3
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-07-12 0:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-11 12:33 [PATCH v2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) Mauro Matteo Cascella
2022-07-12 0:09 ` Alexander Bulekov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).