Brad Bishop | 1932369 | 2019-04-05 15:28:33 -0400 | [diff] [blame^] | 1 | CVE: CVE-2018-20125 |
| 2 | Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=2c858ce] |
| 3 | |
| 4 | Signed-off-by: Kai Kang <kai.kang@windriver.com> |
| 5 | |
| 6 | From 2c858ce5da8ae6689c75182b73bc455a291cad41 Mon Sep 17 00:00:00 2001 |
| 7 | From: Prasad J Pandit <pjp@fedoraproject.org> |
| 8 | Date: Thu, 13 Dec 2018 01:00:36 +0530 |
| 9 | Subject: [PATCH] pvrdma: check number of pages when creating rings |
| 10 | |
| 11 | When creating CQ/QP rings, an object can have up to |
| 12 | PVRDMA_MAX_FAST_REG_PAGES 8 pages. Check 'npages' parameter |
| 13 | to avoid excessive memory allocation or a null dereference. |
| 14 | |
| 15 | Reported-by: Li Qiang <liq3ea@163.com> |
| 16 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> |
| 17 | Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> |
| 18 | Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> |
| 19 | --- |
| 20 | hw/rdma/vmw/pvrdma_cmd.c | 11 +++++++++++ |
| 21 | 1 file changed, 11 insertions(+) |
| 22 | |
| 23 | diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c |
| 24 | index 3b94545761..f236ac4795 100644 |
| 25 | --- a/hw/rdma/vmw/pvrdma_cmd.c |
| 26 | +++ b/hw/rdma/vmw/pvrdma_cmd.c |
| 27 | @@ -259,6 +259,11 @@ static int create_cq_ring(PCIDevice *pci_dev , PvrdmaRing **ring, |
| 28 | int rc = -EINVAL; |
| 29 | char ring_name[MAX_RING_NAME_SZ]; |
| 30 | |
| 31 | + if (!nchunks || nchunks > PVRDMA_MAX_FAST_REG_PAGES) { |
| 32 | + pr_dbg("invalid nchunks: %d\n", nchunks); |
| 33 | + return rc; |
| 34 | + } |
| 35 | + |
| 36 | pr_dbg("pdir_dma=0x%llx\n", (long long unsigned int)pdir_dma); |
| 37 | dir = rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); |
| 38 | if (!dir) { |
| 39 | @@ -372,6 +377,12 @@ static int create_qp_rings(PCIDevice *pci_dev, uint64_t pdir_dma, |
| 40 | char ring_name[MAX_RING_NAME_SZ]; |
| 41 | uint32_t wqe_sz; |
| 42 | |
| 43 | + if (!spages || spages > PVRDMA_MAX_FAST_REG_PAGES |
| 44 | + || !rpages || rpages > PVRDMA_MAX_FAST_REG_PAGES) { |
| 45 | + pr_dbg("invalid pages: %d, %d\n", spages, rpages); |
| 46 | + return rc; |
| 47 | + } |
| 48 | + |
| 49 | pr_dbg("pdir_dma=0x%llx\n", (long long unsigned int)pdir_dma); |
| 50 | dir = rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); |
| 51 | if (!dir) { |
| 52 | -- |
| 53 | 2.20.1 |
| 54 | |