OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

Pull request

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+ber27ys35W+dsvQfe+BBqr8OQ4FAmGoZQIACgkQfe+BBqr8
 OQ6D/w//UXY70lOLT2QteGSqUhdZcBcw0EzNMkWzqUl2wzwlYoJ3mu6QO1YVwE0r
 yp1nbsmZcoZ4Sr8RAOihF6jbSHBXuwa26ZrqRJXGKLgmT631oxUpCk8UoQt284v0
 e6ecKIZUcp409/QZLortK7NU5Ntx3zVuus+tsj6UB0bwbJsM4wL+q5q1uI6kVtmz
 GBo0m66Zy+2OS1gxDGHsQGFC/q8ZpEptzdaUcqCxRiNQbfzTiLp/xguXm9CVW3Ic
 j2zgL95yMP4Z0CiTdNuVTDfis2UACrt/YIudBE2Al4qVVa5QhgijTbtnagCly8Tw
 9sCjxGh5aQFCMAht2JDdiFtoU+8zayPZS2IfZfMPZStjqHqQngj525ksTA1Z6PQc
 yv+0Rj1yXLD2IkNu96cqt6FChOYN4z6hHeb4VRd9TXMoOICJuBnVSvmCG2vTcauU
 QAl+ii2UPMG4L0MrBxExA9WTTwisu30t99HFMjmZgg8YD9SrMSDZxrMOZn7og5kV
 OTWX/jLbIrVV1h4S45QsKIuSlrIASZbKXeqXxHYnxAN5IC7h8GAbisFZ/zxcMgXU
 tMmP813n4bEpMKgAKMo3DsinDmYBhyl23+T5Ty+2+ddagGWeNqXNi9P3YX3Fa+Un
 ZctLthVIcSZU84Mm4gYSTQMU61owEh0dfzl+pWhDCjrxBozXi74=
 =H1RQ
 -----END PGP SIGNATURE-----

Merge tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu into staging

Pull request

# gpg: Signature made Wed 01 Dec 2021 10:17:38 PM PST
# gpg:                using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]

* tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu:
  tests/qtest/fdc-test: Add a regression test for CVE-2021-20196
  hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
  hw/block/fdc: Extract blk_create_empty_drive()

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Richard Henderson 2021-12-02 08:49:51 -08:00
commit a69254a2b3
2 changed files with 58 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
hw/block/fdc.c
View File

@ -61,6 +61,12 @@
} while (0)
/* Anonymous BlockBackend for empty drive */
static BlockBackend *blk_create_empty_drive(void)
{
return blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
}
/********************************************************/
/* qdev floppy bus */
@ -486,8 +492,7 @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
}
if (!dev->conf.blk) {
/* Anonymous BlockBackend for an empty drive */
dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
dev->conf.blk = blk_create_empty_drive();
ret = blk_attach_dev(dev->conf.blk, qdev);
assert(ret == 0);
@ -1161,7 +1166,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit)
static FDrive *get_cur_drv(FDCtrl *fdctrl)
{
return get_drv(fdctrl, fdctrl->cur_drv);
FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv);
if (!cur_drv->blk) {
/*
* Kludge: empty drive line selected. Create an anonymous
* BlockBackend to avoid NULL deref with various BlockBackend
* API calls within this model (CVE-2021-20196).
* Due to the controller QOM model limitations, we don't
* attach the created to the controller device.
*/
cur_drv->blk = blk_create_empty_drive();
}
return cur_drv;
}
/* Status A register : 0x00 (read-only) */

38
tests/qtest/fdc-test.c
View File

@ -32,6 +32,9 @@
/* TODO actually test the results and get rid of this */
#define qmp_discard_response(...) qobject_unref(qmp(__VA_ARGS__))
#define DRIVE_FLOPPY_BLANK \
"-drive if=floppy,file=null-co://,file.read-zeroes=on,format=raw,size=1440k"
#define TEST_IMAGE_SIZE 1440 * 1024
#define FLOPPY_BASE 0x3f0
@ -546,6 +549,40 @@ static void fuzz_registers(void)
}
}
static bool qtest_check_clang_sanitizer(void)
{
#if defined(__SANITIZE_ADDRESS__) || __has_feature(address_sanitizer)
return true;
#else
g_test_skip("QEMU not configured using --enable-sanitizers");
return false;
#endif
}
static void test_cve_2021_20196(void)
{
QTestState *s;
if (!qtest_check_clang_sanitizer()) {
return;
}
s = qtest_initf("-nographic -m 32M -nodefaults " DRIVE_FLOPPY_BLANK);
qtest_outw(s, 0x3f4, 0x0500);
qtest_outb(s, 0x3f5, 0x00);
qtest_outb(s, 0x3f5, 0x00);
qtest_outw(s, 0x3f4, 0x0000);
qtest_outb(s, 0x3f5, 0x00);
qtest_outw(s, 0x3f1, 0x0400);
qtest_outw(s, 0x3f4, 0x0000);
qtest_outw(s, 0x3f4, 0x0000);
qtest_outb(s, 0x3f5, 0x00);
qtest_outb(s, 0x3f5, 0x01);
qtest_outw(s, 0x3f1, 0x0500);
qtest_outb(s, 0x3f5, 0x00);
qtest_quit(s);
}
int main(int argc, char **argv)
{
int fd;
@ -576,6 +613,7 @@ int main(int argc, char **argv)
qtest_add_func("/fdc/read_no_dma_18", test_read_no_dma_18);
qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19);
qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196);
ret = g_test_run();