OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read

Browse Source 
xlnx_dp_read allows an out-of-bounds read at its default branch because
of an improper index.

According to
https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html
(DP Module), registers 0x3A4/0x3A4/0x3AC are allowed.

DP_INT_MASK     0x000003A4      32      mixed   0xFFFFF03F      Interrupt Mask Register for intrN.
DP_INT_EN       0x000003A8      32      mixed   0x00000000      Interrupt Enable Register.
DP_INT_DS       0x000003AC      32      mixed   0x00000000      Interrupt Disable Register.

In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device
will write s->core_registers[0x3A4
>> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4
>> 2) + 1). However, the current size of s->core_registers is (0x3AF >>
>> 2), that is ((0x3A4 >> 2) + 2), which is out of the range.
In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to
the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read)
rather than 0x3A4.

This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4,
but does not adjust the size of s->core_registers to avoid breaking
migration.

Fixes: 58ac482a66 ("introduce xlnx-dp")
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Qiang Liu 2021-08-04 14:51:50 +08:00 committed by Gerd Hoffmann
parent 7852a77f59
commit 2b3a98255c
3 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/display/xlnx_dp.c
View File

@ -714,7 +714,11 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size)
break;
default:
assert(offset <= (0x3AC >> 2));
ret = s->core_registers[offset];
if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) {
ret = s->core_registers[DP_INT_MASK];
} else {
ret = s->core_registers[offset];
}
break;
}

33
tests/qtest/fuzz-xlnx-dp-test.c Normal file
View File

@ -0,0 +1,33 @@
/*
* QTest fuzzer-generated testcase for xlnx-dp display device
*
* Copyright (c) 2021 Qiang Liu <cyruscyliu@gmail.com>
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "qemu/osdep.h"
#include "libqos/libqtest.h"
/*
* This used to trigger the out-of-bounds read in xlnx_dp_read
*/
static void test_fuzz_xlnx_dp_0x3ac(void)
{
QTestState *s = qtest_init("-M xlnx-zcu102 -display none ");
qtest_readl(s, 0xfd4a03ac);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_init(&argc, &argv, NULL);
if (strcmp(arch, "aarch64") == 0) {
qtest_add_func("fuzz/test_fuzz_xlnx_dp/3ac", test_fuzz_xlnx_dp_0x3ac);
}
return g_test_run();
}

1
tests/qtest/meson.build
View File

@ -187,6 +187,7 @@ qtests_aarch64 = \
'numa-test',
'boot-serial-test',
'xlnx-can-test',
'fuzz-xlnx-dp-test',
'migration-test']
qtests_s390x = \