From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:40824) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UXuc5-0007Vg-Ve for qemu-devel@nongnu.org; Thu, 02 May 2013 10:36:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UXuc0-0000lx-U9 for qemu-devel@nongnu.org; Thu, 02 May 2013 10:36:01 -0400 Received: from cantor2.suse.de ([195.135.220.15]:49390 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UXuc0-0000li-NC for qemu-devel@nongnu.org; Thu, 02 May 2013 10:35:56 -0400 Message-ID: <518279C9.7030501@suse.de> Date: Thu, 02 May 2013 16:35:53 +0200 From: =?ISO-8859-1?Q?Andreas_F=E4rber?= MIME-Version: 1.0 References: <1366965244-20542-1-git-send-email-jasowang@redhat.com> <20130427192642.GA30188@redhat.com> <517CD5AC.2080708@redhat.com> <20130428083514.GE7106@redhat.com> In-Reply-To: <20130428083514.GE7106@redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH 1/3] virtio-pci: properly validate address before accessing config List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jason Wang Cc: aliguori@us.ibm.com, pmatouse@redhat.com, qemu-devel@nongnu.org, "Michael S. Tsirkin" Am 28.04.2013 10:35, schrieb Michael S. Tsirkin: > On Sun, Apr 28, 2013 at 03:54:20PM +0800, Jason Wang wrote: >> On 04/28/2013 03:26 AM, Michael S. Tsirkin wrote: >>> On Fri, Apr 26, 2013 at 04:34:02PM +0800, Jason Wang wrote: >>>> There are several several issues in the current checking: >>>> >>>> - The check was based on the minus of unsigned values which can over= flow >>>> - It was done after .{set|get}_config() which can lead crash when co= nfig_len is >>>> zero since vdev->config is NULL >>>> >>>> Fix this by: >>>> >>>> - Validate the address in virtio_pci_config_{read|write}() before >>>> .{set|get}_config >>>> - Use addition instead minus to do the validation >>>> >>>> Cc: Michael S. Tsirkin >>>> Cc: Petr Matousek >>>> Signed-off-by: Jason Wang >>> Why do this in virtio-pci and not in virtio.c? >>> If instead we correct the checks in virtio.c we >>> get less code, and all transports will benefit >>> automatically. >> >> I wish I could but looks like vitio_config_read{b|w|l} were only used = by >> virtio-pci. Other transport such as ccw and s390-virtio-bus have their >> own implementation. >=20 > Okay but still, the bug is in checks in virtio.c, why not fix it there > instead of making it assume caller does the checks? Ping? This issue has been assigned a CVE but the solution does not seem to be agreed on yet - are you working on a different proposal, Jason? Thanks, Andreas --=20 SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 N=FCrnberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imend=F6rffer; HRB 16746 AG N=FCrnbe= rg