1f0277483b
- block: bugfix: Don't pause vm when NOSPACE EIO happened - block: enable cache mode of empty cdrom - block/mirror: fix file-system went to read-only after block-mirror - scsi-bus: fix incorrect call for blk_error_retry_reset_timeout() - scsi-bus: fix unmatched object_unref() - block: Add sanity check when setting retry parameters - block-backend: Stop retrying when draining - scsi-disk: Add support for retry on errors - scsi-bus: Refactor the code that retries requests - virtio_blk: Add support for retry on errors - block: Add error retry param setting - block-backend: Add timeout support for retry - block-backend: Enable retry action on errors - block-backend: Add device specific retry callback - block-backend: Introduce retry timer - qapi/block-core: Add retry option for error action - scsi: bugfix: fix division by zero - scsi: cdrom: Fix crash after remote cdrom detached - qemu-pr: fixed ioctl failed for multipath disk - scsi-disk: define props in scsi_block_disk to avoid memleaks - bugfix: fix possible memory leak - bugfix: fix some illegal memory access and memory leak - util/log: add CONFIG_DISABLE_QEMU_LOG macro - log: Add some logs on VM runtime path - bugfix: fix eventfds may double free when vm_id reused in ivshmem - hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize() - hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config() - qemu-img create: 'cache' paramter only use for reg file image - qemu-img: add qemu-img direct create - qemu-img block: set zero flags only when discard_zeros of the block supported - Revert "file-posix: Remove unused s->discard_zeroes" - pcie_sriov: Validate NumVFs (CVE-2024-26327) - hw/nvme: Use pcie_sriov_num_vfs() (CVE-2024-26328) - hw/acpi/cpu: Use CPUState typedef - target/i386/sev: Fix missing ERRP_GUARD() for error_prepend() - virtio-gpu: remove needless condition - hw/i2c/smbus_slave: Add object path on error prints - vfio/pci: Ascend710 change to bar2 quirk - vfio/pci: Ascend910 need 4Bytes quirk in bar0 - vfio/pci: Ascend710 need 4Bytes quirk in bar0 - vfio/pci: Ascend310 need 4Bytes quirk in bar4 - chardev/char-socket: Fix TLS io channels sending too much data to the backend - i386/cpuid: Move leaf 7 to correct group - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available - blkio: Respect memory-alignment for bounce buffer allocations - virtio-gpu: Correct virgl_renderer_resource_get_info() error check - hw/usb: Style cleanup - tests/qemu-iotests: resolved the problem that the 108 test cases in the container fail Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 404d45bf9147058a475a8031c454a6c8e0acc123)
86 lines
3.2 KiB
Diff
86 lines
3.2 KiB
Diff
From 6a32c9764439093fe4b53f87059c35761d711e39 Mon Sep 17 00:00:00 2001
|
|
From: Akihiko Odaki <akihiko.odaki@daynix.com>
|
|
Date: Wed, 28 Feb 2024 20:33:12 +0900
|
|
Subject: [PATCH] hw/nvme: Use pcie_sriov_num_vfs() (CVE-2024-26328)
|
|
|
|
nvme_sriov_pre_write_ctrl() used to directly inspect SR-IOV
|
|
configurations to know the number of VFs being disabled due to SR-IOV
|
|
configuration writes, but the logic was flawed and resulted in
|
|
out-of-bound memory access.
|
|
|
|
It assumed PCI_SRIOV_NUM_VF always has the number of currently enabled
|
|
VFs, but it actually doesn't in the following cases:
|
|
- PCI_SRIOV_NUM_VF has been set but PCI_SRIOV_CTRL_VFE has never been.
|
|
- PCI_SRIOV_NUM_VF was written after PCI_SRIOV_CTRL_VFE was set.
|
|
- VFs were only partially enabled because of realization failure.
|
|
|
|
It is a responsibility of pcie_sriov to interpret SR-IOV configurations
|
|
and pcie_sriov does it correctly, so use pcie_sriov_num_vfs(), which it
|
|
provides, to get the number of enabled VFs before and after SR-IOV
|
|
configuration writes.
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Fixes: CVE-2024-26328
|
|
Fixes: 11871f53ef8e ("hw/nvme: Add support for the Virtualization Management command")
|
|
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
|
|
Message-Id: <20240228-reuse-v8-1-282660281e60@daynix.com>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
---
|
|
hw/nvme/ctrl.c | 26 ++++++++------------------
|
|
1 file changed, 8 insertions(+), 18 deletions(-)
|
|
|
|
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
|
|
index f026245d1e..7a56e7b79b 100644
|
|
--- a/hw/nvme/ctrl.c
|
|
+++ b/hw/nvme/ctrl.c
|
|
@@ -8466,36 +8466,26 @@ static void nvme_pci_reset(DeviceState *qdev)
|
|
nvme_ctrl_reset(n, NVME_RESET_FUNCTION);
|
|
}
|
|
|
|
-static void nvme_sriov_pre_write_ctrl(PCIDevice *dev, uint32_t address,
|
|
- uint32_t val, int len)
|
|
+static void nvme_sriov_post_write_config(PCIDevice *dev, uint16_t old_num_vfs)
|
|
{
|
|
NvmeCtrl *n = NVME(dev);
|
|
NvmeSecCtrlEntry *sctrl;
|
|
- uint16_t sriov_cap = dev->exp.sriov_cap;
|
|
- uint32_t off = address - sriov_cap;
|
|
- int i, num_vfs;
|
|
+ int i;
|
|
|
|
- if (!sriov_cap) {
|
|
- return;
|
|
- }
|
|
-
|
|
- if (range_covers_byte(off, len, PCI_SRIOV_CTRL)) {
|
|
- if (!(val & PCI_SRIOV_CTRL_VFE)) {
|
|
- num_vfs = pci_get_word(dev->config + sriov_cap + PCI_SRIOV_NUM_VF);
|
|
- for (i = 0; i < num_vfs; i++) {
|
|
- sctrl = &n->sec_ctrl_list.sec[i];
|
|
- nvme_virt_set_state(n, le16_to_cpu(sctrl->scid), false);
|
|
- }
|
|
- }
|
|
+ for (i = pcie_sriov_num_vfs(dev); i < old_num_vfs; i++) {
|
|
+ sctrl = &n->sec_ctrl_list.sec[i];
|
|
+ nvme_virt_set_state(n, le16_to_cpu(sctrl->scid), false);
|
|
}
|
|
}
|
|
|
|
static void nvme_pci_write_config(PCIDevice *dev, uint32_t address,
|
|
uint32_t val, int len)
|
|
{
|
|
- nvme_sriov_pre_write_ctrl(dev, address, val, len);
|
|
+ uint16_t old_num_vfs = pcie_sriov_num_vfs(dev);
|
|
+
|
|
pci_default_write_config(dev, address, val, len);
|
|
pcie_cap_flr_write_config(dev, address, val, len);
|
|
+ nvme_sriov_post_write_config(dev, old_num_vfs);
|
|
}
|
|
|
|
static const VMStateDescription nvme_vmstate = {
|
|
--
|
|
2.27.0
|
|
|