0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch 1.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243
  1. CVE: CVE-2022-1050
  2. Upstream-Status: Submitted [https://lore.kernel.org/qemu-devel/20220403095234.2210-1-yuval.shaia.ml@gmail.com/]
  3. Signed-off-by: Ross Burton <ross.burton@arm.com>
  4. From dbdef95c272e8f3ec037c3db4197c66002e30995 Mon Sep 17 00:00:00 2001
  5. From: Yuval Shaia <yuval.shaia.ml@gmail.com>
  6. Date: Sun, 3 Apr 2022 12:52:34 +0300
  7. Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver
  8. Guest driver might execute HW commands when shared buffers are not yet
  9. allocated.
  10. This could happen on purpose (malicious guest) or because of some other
  11. guest/host address mapping error.
  12. We need to protect againts such case.
  13. Fixes: CVE-2022-1050
  14. Reported-by: Raven <wxhusst@gmail.com>
  15. Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
  16. ---
  17. hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
  18. 1 file changed, 6 insertions(+)
  19. diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
  20. index da7ddfa548..89db963c46 100644
  21. --- a/hw/rdma/vmw/pvrdma_cmd.c
  22. +++ b/hw/rdma/vmw/pvrdma_cmd.c
  23. @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
  24. dsr_info = &dev->dsr_info;
  25. + if (!dsr_info->dsr) {
  26. + /* Buggy or malicious guest driver */
  27. + rdma_error_report("Exec command without dsr, req or rsp buffers");
  28. + goto out;
  29. + }
  30. +
  31. if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
  32. sizeof(struct cmd_handler)) {
  33. rdma_error_report("Unsupported command");
  34. --
  35. 2.34.1