Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847)

[Paolo Bonzini <pbonzini@redhat.com>]

On 15/11/2018 04:14, Li Qiang wrote:
> 
> 
> Paolo Bonzini <pbonzini@redhat.com <mailto:pbonzini@redhat.com>> 于2018
> 年11月14日周三 下午11:44写道：
> 
>     On 14/11/2018 02:38, Li Qiang wrote:
>     >
>     >
>     > Paolo Bonzini <pbonzini@redhat.com <mailto:pbonzini@redhat.com>
>     <mailto:pbonzini@redhat.com <mailto:pbonzini@redhat.com>>> 于2018
>     > 年11月14日周三 上午2:27写道：
>     >
>     >     On 13/11/2018 11:17, Kevin Wolf wrote:
>     >     > Am 13.11.2018 um 02:45 hat Li Qiang geschrieben:
>     >     >> Ping.... what't the status of this patch.
>     >     >>
>     >     >> I see Kevin's new pr doesn't contain this patch.
>     >     >
>     >     > Oh, I thought you said that you wanted to fix this at a higher
>     >     level so
>     >     > that the problem is caught before even getting into nvme
>     code? If you
>     >     > don't, I can apply the patch for my next pull request.
>     >
>     >     As far as I know the bug doesn't exist.  Li Qiang, if you have a
>     >     reproducer please send it.
>     >
>     >
>     > Hello Paolo,
>     > Though I've send the debug information and ASAN output in the mail to
>     > secalert@redhat.com <mailto:secalert@redhat.com>
>     <mailto:secalert@redhat.com <mailto:secalert@redhat.com>>, I'm glad
>     provide here.
>     > This is for read, I think the write the same but as the PoC is in
>     > userspace, the mmap can only map the exact size of the MMIO,
>     > So we can only write within the area. But if we using a module we can
>     > write the out of MMIO I think
>     > The nvme device's parameter should set as 'cmb_size_mb=2' and the PCI
>     > address may differ in your system.
> 
>     Ok, thanks.  I've created a reproducer using qtest (though I have to run
>     now and cannot post it properly).
> 
>     The patch for the fix is simply:
> 
> 
> So do you send this or me?

Me, together with the test.

Paolo