Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 1 | CVE: CVE-2022-1050 |
| 2 | Upstream-Status: Submitted [https://lore.kernel.org/qemu-devel/20220403095234.2210-1-yuval.shaia.ml@gmail.com/] |
| 3 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 4 | |
| 5 | From dbdef95c272e8f3ec037c3db4197c66002e30995 Mon Sep 17 00:00:00 2001 |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 6 | From: Yuval Shaia <yuval.shaia.ml@gmail.com> |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 7 | Date: Sun, 3 Apr 2022 12:52:34 +0300 |
| 8 | Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 9 | |
| 10 | Guest driver might execute HW commands when shared buffers are not yet |
| 11 | allocated. |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 12 | This could happen on purpose (malicious guest) or because of some other |
| 13 | guest/host address mapping error. |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 14 | We need to protect againts such case. |
| 15 | |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 16 | Fixes: CVE-2022-1050 |
| 17 | |
| 18 | Reported-by: Raven <wxhusst@gmail.com> |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 19 | Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com> |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 20 | --- |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 21 | hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++ |
| 22 | 1 file changed, 6 insertions(+) |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 23 | |
| 24 | diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 25 | index da7ddfa548..89db963c46 100644 |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 26 | --- a/hw/rdma/vmw/pvrdma_cmd.c |
| 27 | +++ b/hw/rdma/vmw/pvrdma_cmd.c |
| 28 | @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev) |
| 29 | |
| 30 | dsr_info = &dev->dsr_info; |
| 31 | |
| 32 | + if (!dsr_info->dsr) { |
| 33 | + /* Buggy or malicious guest driver */ |
| 34 | + rdma_error_report("Exec command without dsr, req or rsp buffers"); |
| 35 | + goto out; |
| 36 | + } |
| 37 | + |
| 38 | if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) / |
| 39 | sizeof(struct cmd_handler)) { |
| 40 | rdma_error_report("Unsupported command"); |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 41 | -- |
Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame^] | 42 | 2.34.1 |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 43 | |