Patrick Williams | f1e5d69 | 2016-03-30 15:21:19 -0500 | [diff] [blame] | 1 | From: Prasad J Pandit <address@hidden> |
| 2 | |
| 3 | When IDE AHCI emulation uses Frame Information Structures(FIS) |
| 4 | engine for data transfer, the mapped FIS buffer address is stored |
| 5 | in a static 'bounce.buffer'. When a request is made to map another |
| 6 | memory region, address_space_map() returns NULL because |
| 7 | 'bounce.buffer' is in_use. It leads to a null pointer dereference |
| 8 | error while doing 'dma_memory_unmap'. Add a check to avoid it. |
| 9 | |
| 10 | Reported-by: Zuozhi fzz <address@hidden> |
| 11 | Signed-off-by: Prasad J Pandit <address@hidden> |
| 12 | |
| 13 | Upstream-Status: Backport |
| 14 | https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05740.html |
| 15 | |
| 16 | CVE: CVE-2016-2197 |
| 17 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 18 | |
| 19 | --- |
| 20 | hw/ide/ahci.c | 16 ++++++++++------ |
| 21 | 1 file changed, 10 insertions(+), 6 deletions(-) |
| 22 | |
| 23 | Update as per review |
| 24 | -> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05715.html |
| 25 | |
| 26 | Index: qemu-2.5.0/hw/ide/ahci.c |
| 27 | =================================================================== |
| 28 | --- qemu-2.5.0.orig/hw/ide/ahci.c |
| 29 | +++ qemu-2.5.0/hw/ide/ahci.c |
| 30 | @@ -661,9 +661,11 @@ static bool ahci_map_fis_address(AHCIDev |
| 31 | |
| 32 | static void ahci_unmap_fis_address(AHCIDevice *ad) |
| 33 | { |
| 34 | - dma_memory_unmap(ad->hba->as, ad->res_fis, 256, |
| 35 | - DMA_DIRECTION_FROM_DEVICE, 256); |
| 36 | - ad->res_fis = NULL; |
| 37 | + if (ad->res_fis) { |
| 38 | + dma_memory_unmap(ad->hba->as, ad->res_fis, 256, |
| 39 | + DMA_DIRECTION_FROM_DEVICE, 256); |
| 40 | + ad->res_fis = NULL; |
| 41 | + } |
| 42 | } |
| 43 | |
| 44 | static bool ahci_map_clb_address(AHCIDevice *ad) |
| 45 | @@ -677,9 +679,11 @@ static bool ahci_map_clb_address(AHCIDev |
| 46 | |
| 47 | static void ahci_unmap_clb_address(AHCIDevice *ad) |
| 48 | { |
| 49 | - dma_memory_unmap(ad->hba->as, ad->lst, 1024, |
| 50 | - DMA_DIRECTION_FROM_DEVICE, 1024); |
| 51 | - ad->lst = NULL; |
| 52 | + if (ad->lst) { |
| 53 | + dma_memory_unmap(ad->hba->as, ad->lst, 1024, |
| 54 | + DMA_DIRECTION_FROM_DEVICE, 1024); |
| 55 | + ad->lst = NULL; |
| 56 | + } |
| 57 | } |
| 58 | |
| 59 | static void ahci_write_fis_sdb(AHCIState *s, NCQTransferState *ncq_tfs) |