|
 |
9ae3a8 |
From 92504013c1489168e3514f3c7342c016156c6af3 Mon Sep 17 00:00:00 2001
|
|
|
9ae3a8 |
From: Michael S. Tsirkin <mst@redhat.com>
|
|
|
9ae3a8 |
Date: Wed, 19 Mar 2014 17:21:02 +0200
|
|
|
9ae3a8 |
Subject: [PATCH] virtio-net: fix guest-triggerable buffer overrun
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
RH-Author: Michael S. Tsirkin <mst@redhat.com>
|
|
|
9ae3a8 |
Message-id: <1395242197-28749-1-git-send-email-mst@redhat.com>
|
|
|
9ae3a8 |
O-Subject: [virt-devel][PATCH EMBARGOED qemu-kvm RHEL7.0] virtio-net: fix
|
|
|
9ae3a8 |
Bugzilla: 1078308
|
|
|
9ae3a8 |
RH-Acked-by: Markus Armbruster <armbruz@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Vlad Yasevich <vyasevic@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
When VM guest programs multicast addresses for
|
|
|
9ae3a8 |
a virtio net card, it supplies a 32 bit
|
|
|
9ae3a8 |
entries counter for the number of addresses.
|
|
|
9ae3a8 |
These addresses are read into tail portion of
|
|
|
9ae3a8 |
a fixed macs array which has size MAC_TABLE_ENTRIES,
|
|
|
9ae3a8 |
at offset equal to in_use.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
To avoid overflow of this array by guest, qemu attempts
|
|
|
9ae3a8 |
to test the size as follows:
|
|
|
9ae3a8 |
- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
however, as mac_data.entries is uint32_t, this sum
|
|
|
9ae3a8 |
can overflow, e.g. if in_use is 1 and mac_data.entries
|
|
|
9ae3a8 |
is 0xffffffff then in_use + mac_data.entries will be 0.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Qemu will then read guest supplied buffer into this
|
|
|
9ae3a8 |
memory, overflowing buffer on heap.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1078308
|
|
|
9ae3a8 |
Upstream status: EMBARGOED RT 284849
|
|
|
9ae3a8 |
Brew build: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7225956
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
hw/net/virtio-net.c | 2 +-
|
|
|
9ae3a8 |
1 files changed, 1 insertions(+), 1 deletions(-)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
|
|
|
9ae3a8 |
index 06c53fe..2d559e0 100644
|
|
|
9ae3a8 |
--- a/hw/net/virtio-net.c
|
|
|
9ae3a8 |
+++ b/hw/net/virtio-net.c
|
|
|
9ae3a8 |
@@ -594,7 +594,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
|
|
|
9ae3a8 |
goto error;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
|
|
|
9ae3a8 |
+ if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) {
|
|
|
9ae3a8 |
s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN],
|
|
|
9ae3a8 |
mac_data.entries * ETH_ALEN);
|
|
|
9ae3a8 |
if (s != mac_data.entries * ETH_ALEN) {
|
|
|
9ae3a8 |
--
|
|
|
9ae3a8 |
1.7.1
|
|
|
9ae3a8 |
|