* [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written [not found] <162441284292.15618.4627728437912000813-0@git.sr.ht> @ 2021-06-23 2:26 ` Qiang Liu 2021-06-23 3:23 ` Jason Wang 0 siblings, 1 reply; 4+ messages in thread From: Qiang Liu @ 2021-06-23 2:26 UTC (permalink / raw) To: Dmitry Fleytman, Jason Wang, qemu-devel From: cyruscyliu <cyruscyliu@gmail.com> A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This patch remove the g_aasert_not_reached() there and make the access pass. Fixes: 786fd2b0f87 ("VMXNET3 device implementation") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309 Buglink: https://bugs.launchpad.net/qemu/+bug/1913923 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> --- hw/net/vmxnet3.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index eff299f629..a388918479 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque, vmxnet3_set_variable_mac(s, val, s->temp_mac); break; - /* Interrupt Cause Register */ - case VMXNET3_REG_ICR: - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d", - val, size); - g_assert_not_reached(); - break; - /* Event Cause Register */ case VMXNET3_REG_ECR: VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d", -- 2.30.2 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written 2021-06-23 2:26 ` [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written Qiang Liu @ 2021-06-23 3:23 ` Jason Wang 2021-06-25 2:19 ` Qiang Liu 0 siblings, 1 reply; 4+ messages in thread From: Jason Wang @ 2021-06-23 3:23 UTC (permalink / raw) To: Qiang Liu, Dmitry Fleytman, qemu-devel 在 2021/6/23 上午10:26, Qiang Liu 写道: > From: cyruscyliu <cyruscyliu@gmail.com> > > A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This > patch remove the g_aasert_not_reached() there and make the access pass. > > Fixes: 786fd2b0f87 ("VMXNET3 device implementation") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309 > Buglink: https://bugs.launchpad.net/qemu/+bug/1913923 > > Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Do we need to warn about the unimplemented register? Thanks > --- > hw/net/vmxnet3.c | 7 ------- > 1 file changed, 7 deletions(-) > > diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c > index eff299f629..a388918479 100644 > --- a/hw/net/vmxnet3.c > +++ b/hw/net/vmxnet3.c > @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque, > vmxnet3_set_variable_mac(s, val, s->temp_mac); > break; > > - /* Interrupt Cause Register */ > - case VMXNET3_REG_ICR: > - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d", > - val, size); > - g_assert_not_reached(); > - break; > - > /* Event Cause Register */ > case VMXNET3_REG_ECR: > VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d", > -- > 2.30.2 > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written 2021-06-23 3:23 ` Jason Wang @ 2021-06-25 2:19 ` Qiang Liu 2021-06-25 2:57 ` Jason Wang 0 siblings, 1 reply; 4+ messages in thread From: Qiang Liu @ 2021-06-25 2:19 UTC (permalink / raw) To: Jason Wang; +Cc: Dmitry Fleytman, open list:All patches CC here Hi, On Wed, Jun 23, 2021 at 11:23 AM Jason Wang <jasowang@redhat.com> wrote: > > > 在 2021/6/23 上午10:26, Qiang Liu 写道: > > From: cyruscyliu <cyruscyliu@gmail.com> > > > > A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This > > patch remove the g_aasert_not_reached() there and make the access pass. > > > > Fixes: 786fd2b0f87 ("VMXNET3 device implementation") > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309 > > Buglink: https://bugs.launchpad.net/qemu/+bug/1913923 > > > > Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> > > > Do we need to warn about the unimplemented register? If we remove the case branch, it will go to the default branch which can warn users if VMXNET_DEBUG_CB_ENABLED is defined, so there is no need to warn this unimplemented register. Am I right? ``` vmxnet3_io_bar1_write(... default: VMW_CBPRN("Unknown Write to BAR1 [%" PRIx64 "] = %" PRIx64 ", size %d", addr, val, size); break; ``` > Thanks > > > > --- > > hw/net/vmxnet3.c | 7 ------- > > 1 file changed, 7 deletions(-) > > > > diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c > > index eff299f629..a388918479 100644 > > --- a/hw/net/vmxnet3.c > > +++ b/hw/net/vmxnet3.c > > @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque, > > vmxnet3_set_variable_mac(s, val, s->temp_mac); > > break; > > > > - /* Interrupt Cause Register */ > > - case VMXNET3_REG_ICR: > > - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d", > > - val, size); > > - g_assert_not_reached(); > > - break; > > - > > /* Event Cause Register */ > > case VMXNET3_REG_ECR: > > VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d", > > -- > > 2.30.2 > > > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written 2021-06-25 2:19 ` Qiang Liu @ 2021-06-25 2:57 ` Jason Wang 0 siblings, 0 replies; 4+ messages in thread From: Jason Wang @ 2021-06-25 2:57 UTC (permalink / raw) To: Qiang Liu; +Cc: Dmitry Fleytman, open list:All patches CC here 在 2021/6/25 上午10:19, Qiang Liu 写道: > Hi, > On Wed, Jun 23, 2021 at 11:23 AM Jason Wang <jasowang@redhat.com> wrote: >> >> 在 2021/6/23 上午10:26, Qiang Liu 写道: >>> From: cyruscyliu <cyruscyliu@gmail.com> >>> >>> A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This >>> patch remove the g_aasert_not_reached() there and make the access pass. >>> >>> Fixes: 786fd2b0f87 ("VMXNET3 device implementation") >>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309 >>> Buglink: https://bugs.launchpad.net/qemu/+bug/1913923 >>> >>> Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> >> >> Do we need to warn about the unimplemented register? > If we remove the case branch, it will go to the default branch which > can warn users if > VMXNET_DEBUG_CB_ENABLED is defined, so there is no need to warn this > unimplemented register. Am I right? > ``` > vmxnet3_io_bar1_write(... > default: > VMW_CBPRN("Unknown Write to BAR1 [%" PRIx64 "] = %" PRIx64 ", size %d", > addr, val, size); > break; > ``` Right. I've queued this patch. Thanks >> Thanks >> >> >>> --- >>> hw/net/vmxnet3.c | 7 ------- >>> 1 file changed, 7 deletions(-) >>> >>> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c >>> index eff299f629..a388918479 100644 >>> --- a/hw/net/vmxnet3.c >>> +++ b/hw/net/vmxnet3.c >>> @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque, >>> vmxnet3_set_variable_mac(s, val, s->temp_mac); >>> break; >>> >>> - /* Interrupt Cause Register */ >>> - case VMXNET3_REG_ICR: >>> - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d", >>> - val, size); >>> - g_assert_not_reached(); >>> - break; >>> - >>> /* Event Cause Register */ >>> case VMXNET3_REG_ECR: >>> VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d", >>> -- >>> 2.30.2 >>> ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-25 2:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <162441284292.15618.4627728437912000813-0@git.sr.ht>
2021-06-23 2:26 ` [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written Qiang Liu
2021-06-23 3:23 ` Jason Wang
2021-06-25 2:19 ` Qiang Liu
2021-06-25 2:57 ` Jason Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).