Andrew Geissler | 87f5cff | 2022-09-30 13:13:31 -0500 | [diff] [blame] | 1 | CVE: CVE-2022-2962 |
| 2 | Upstream-Status: Backport |
| 3 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 4 | |
| 5 | From 5c5c50b0a73d78ffe18336c9996fef5eae9bbbb0 Mon Sep 17 00:00:00 2001 |
| 6 | From: Zheyu Ma <zheyuma97@gmail.com> |
| 7 | Date: Sun, 21 Aug 2022 20:43:43 +0800 |
| 8 | Subject: [PATCH] net: tulip: Restrict DMA engine to memories |
| 9 | |
| 10 | The DMA engine is started by I/O access and then itself accesses the |
| 11 | I/O registers, triggering a reentrancy bug. |
| 12 | |
| 13 | The following log can reveal it: |
| 14 | ==5637==ERROR: AddressSanitizer: stack-overflow |
| 15 | #0 0x5595435f6078 in tulip_xmit_list_update qemu/hw/net/tulip.c:673 |
| 16 | #1 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 |
| 17 | #2 0x559544637f86 in memory_region_write_accessor qemu/softmmu/memory.c:492:5 |
| 18 | #3 0x5595446379fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18 |
| 19 | #4 0x5595446372fa in memory_region_dispatch_write qemu/softmmu/memory.c |
| 20 | #5 0x55954468b74c in flatview_write_continue qemu/softmmu/physmem.c:2825:23 |
| 21 | #6 0x559544683662 in flatview_write qemu/softmmu/physmem.c:2867:12 |
| 22 | #7 0x5595446833f3 in address_space_write qemu/softmmu/physmem.c:2963:18 |
| 23 | #8 0x5595435fb082 in dma_memory_rw_relaxed qemu/include/sysemu/dma.h:87:12 |
| 24 | #9 0x5595435fb082 in dma_memory_rw qemu/include/sysemu/dma.h:130:12 |
| 25 | #10 0x5595435fb082 in dma_memory_write qemu/include/sysemu/dma.h:171:12 |
| 26 | #11 0x5595435fb082 in stl_le_dma qemu/include/sysemu/dma.h:272:1 |
| 27 | #12 0x5595435fb082 in stl_le_pci_dma qemu/include/hw/pci/pci.h:910:1 |
| 28 | #13 0x5595435fb082 in tulip_desc_write qemu/hw/net/tulip.c:101:9 |
| 29 | #14 0x5595435f7e3d in tulip_xmit_list_update qemu/hw/net/tulip.c:706:9 |
| 30 | #15 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 |
| 31 | |
| 32 | Fix this bug by restricting the DMA engine to memories regions. |
| 33 | |
| 34 | Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> |
| 35 | Signed-off-by: Jason Wang <jasowang@redhat.com> |
| 36 | --- |
| 37 | hw/net/tulip.c | 4 ++-- |
| 38 | 1 file changed, 2 insertions(+), 2 deletions(-) |
| 39 | |
| 40 | diff --git a/hw/net/tulip.c b/hw/net/tulip.c |
| 41 | index 097e905bec..b9e42c322a 100644 |
| 42 | --- a/hw/net/tulip.c |
| 43 | +++ b/hw/net/tulip.c |
| 44 | @@ -70,7 +70,7 @@ static const VMStateDescription vmstate_pci_tulip = { |
| 45 | static void tulip_desc_read(TULIPState *s, hwaddr p, |
| 46 | struct tulip_descriptor *desc) |
| 47 | { |
| 48 | - const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; |
| 49 | + const MemTxAttrs attrs = { .memory = true }; |
| 50 | |
| 51 | if (s->csr[0] & CSR0_DBO) { |
| 52 | ldl_be_pci_dma(&s->dev, p, &desc->status, attrs); |
| 53 | @@ -88,7 +88,7 @@ static void tulip_desc_read(TULIPState *s, hwaddr p, |
| 54 | static void tulip_desc_write(TULIPState *s, hwaddr p, |
| 55 | struct tulip_descriptor *desc) |
| 56 | { |
| 57 | - const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; |
| 58 | + const MemTxAttrs attrs = { .memory = true }; |
| 59 | |
| 60 | if (s->csr[0] & CSR0_DBO) { |
| 61 | stl_be_pci_dma(&s->dev, p, desc->status, attrs); |
| 62 | -- |
| 63 | 2.34.1 |
| 64 | |