OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
9904adfaca
qemu-e2k/block
History
Chen Qun ff0507c239 block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb 
There is an overflow, the source 'datain.data[2]' is 100 bytes,
 but the 'ss' is 252 bytes.This may cause a security issue because
 we can access a lot of unrelated memory data.

The len for sbp copy data should take the minimum of mx_sb_len and
 sb_len_wr, not the maximum.

If we use iscsi device for VM backend storage, ASAN show stack:

READ of size 252 at 0xfffd149dcfc4 thread T0
    #0 0xaaad433d0d34 in __asan_memcpy (aarch64-softmmu/qemu-system-aarch64+0x2cb0d34)
    #1 0xaaad45f9d6d0 in iscsi_aio_ioctl_cb /qemu/block/iscsi.c:996:9
    #2 0xfffd1af0e2dc  (/usr/lib64/iscsi/libiscsi.so.8+0xe2dc)
    #3 0xfffd1af0d174  (/usr/lib64/iscsi/libiscsi.so.8+0xd174)
    #4 0xfffd1af19fac  (/usr/lib64/iscsi/libiscsi.so.8+0x19fac)
    #5 0xaaad45f9acc8 in iscsi_process_read /qemu/block/iscsi.c:403:5
    #6 0xaaad4623733c in aio_dispatch_handler /qemu/util/aio-posix.c:467:9
    #7 0xaaad4622f350 in aio_dispatch_handlers /qemu/util/aio-posix.c:510:20
    #8 0xaaad4622f350 in aio_dispatch /qemu/util/aio-posix.c:520
    #9 0xaaad46215944 in aio_ctx_dispatch /qemu/util/async.c:298:5
    #10 0xfffd1bed12f4 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x512f4)
    #11 0xaaad46227de0 in glib_pollfds_poll /qemu/util/main-loop.c:219:9
    #12 0xaaad46227de0 in os_host_main_loop_wait /qemu/util/main-loop.c:242
    #13 0xaaad46227de0 in main_loop_wait /qemu/util/main-loop.c:518
    #14 0xaaad43d9d60c in qemu_main_loop /qemu/softmmu/vl.c:1662:9
    #15 0xaaad4607a5b0 in main /qemu/softmmu/main.c:49:5
    #16 0xfffd1a460b9c in __libc_start_main (/lib64/libc.so.6+0x20b9c)
    #17 0xaaad43320740 in _start (aarch64-softmmu/qemu-system-aarch64+0x2c00740)

0xfffd149dcfc4 is located 0 bytes to the right of 100-byte region [0xfffd149dcf60,0xfffd149dcfc4)
allocated by thread T0 here:
    #0 0xaaad433d1e70 in __interceptor_malloc (aarch64-softmmu/qemu-system-aarch64+0x2cb1e70)
    #1 0xfffd1af0e254  (/usr/lib64/iscsi/libiscsi.so.8+0xe254)
    #2 0xfffd1af0d174  (/usr/lib64/iscsi/libiscsi.so.8+0xd174)
    #3 0xfffd1af19fac  (/usr/lib64/iscsi/libiscsi.so.8+0x19fac)
    #4 0xaaad45f9acc8 in iscsi_process_read /qemu/block/iscsi.c:403:5
    #5 0xaaad4623733c in aio_dispatch_handler /qemu/util/aio-posix.c:467:9
    #6 0xaaad4622f350 in aio_dispatch_handlers /qemu/util/aio-posix.c:510:20
    #7 0xaaad4622f350 in aio_dispatch /qemu/util/aio-posix.c:520
    #8 0xaaad46215944 in aio_ctx_dispatch /qemu/util/async.c:298:5
    #9 0xfffd1bed12f4 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x512f4)
    #10 0xaaad46227de0 in glib_pollfds_poll /qemu/util/main-loop.c:219:9
    #11 0xaaad46227de0 in os_host_main_loop_wait /qemu/util/main-loop.c:242
    #12 0xaaad46227de0 in main_loop_wait /qemu/util/main-loop.c:518
    #13 0xaaad43d9d60c in qemu_main_loop /qemu/softmmu/vl.c:1662:9
    #14 0xaaad4607a5b0 in main /qemu/softmmu/main.c:49:5
    #15 0xfffd1a460b9c in __libc_start_main (/lib64/libc.so.6+0x20b9c)
    #16 0xaaad43320740 in _start (aarch64-softmmu/qemu-system-aarch64+0x2c00740)

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200418062602.10776-1-kuhn.chenqun@huawei.com
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-20 11:31:46 +01:00
..
monitor Use &error_abort instead of separate assert() 2020-03-17 16:05:40 +01:00
accounting.c
aio_task.c
backup-top.c block/block-copy: hide structure definitions 2020-03-11 12:42:30 +01:00
backup-top.h
backup.c backup: don't acquire aio_context in backup_clean 2020-04-07 14:34:47 +02:00
blkdebug.c
blklogwrites.c
blkreplay.c
blkverify.c block: Remove bdrv_recurse_is_first_non_filter() 2020-02-18 11:55:40 +01:00
block-backend.c block: Fix blk->in_flight during blk_wait_while_drained() 2020-04-07 15:40:57 +02:00
block-copy.c block/block-copy: hide structure definitions 2020-03-11 12:42:30 +01:00
bochs.c
cloop.c
commit.c commit: Fix is_read for block_job_error_action() 2020-02-18 10:53:56 +01:00
copy-on-read.c block: Remove bdrv_recurse_is_first_non_filter() 2020-02-18 11:55:40 +01:00
create.c
crypto.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
crypto.h
curl.c block/curl: HTTP header field names are case insensitive 2020-03-11 12:42:29 +01:00
dirty-bitmap.c block/dirty-bitmap: improve _next_dirty_area API 2020-03-18 14:03:46 -04:00
dmg-bz2.c
dmg-lzfse.c
dmg.c
dmg.h
file-posix.c block: trickle down the fallback image creation function use to the block drivers 2020-03-26 14:44:33 +01:00
file-win32.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
filter-compress.c block: Remove bdrv_recurse_is_first_non_filter() 2020-02-18 11:55:40 +01:00
gluster.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
io_uring.c block/io_uring: Remove superfluous semicolon 2020-02-18 10:54:02 +01:00
io.c block/io: fix bdrv_co_do_copy_on_readv 2020-03-16 11:46:11 +00:00
iscsi-opts.c
iscsi.c block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb 2020-04-20 11:31:46 +01:00
linux-aio.c misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
Makefile.objs monitor/hmp: rename device-hotplug.c to block/monitor/block-hmp-cmds.c 2020-03-09 18:05:31 +00:00
mirror.c mirror: Wait only for in-flight operations 2020-03-27 14:47:23 +01:00
nbd.c block: trickle down the fallback image creation function use to the block drivers 2020-03-26 14:44:33 +01:00
nfs.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
null.c
nvme.c block: trickle down the fallback image creation function use to the block drivers 2020-03-26 14:44:33 +01:00
parallels.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
parallels.h
qapi-sysemu.c block: Move system emulator QMP commands to block/qapi-sysemu.c 2020-03-06 17:15:38 +01:00
qapi.c block: Fix VM size field width in snapshot dump 2020-02-20 16:43:42 +01:00
qcow2-bitmap.c block/qcow2-bitmap: use bdrv_dirty_bitmap_next_dirty 2020-03-18 14:03:46 -04:00
qcow2-cache.c
qcow2-cluster.c qcow2: Fix alloc_cluster_abort() for pre-existing clusters 2020-03-06 17:15:37 +01:00
qcow2-refcount.c qcow2: update_refcount(): Reset old_table_index after qcow2_cache_put() 2020-02-18 10:53:56 +01:00
qcow2-snapshot.c qcow2: Don't round the L1 table allocation up to the sector size 2020-02-06 13:47:45 +01:00
qcow2-threads.c block/qcow2-threads: fix qcow2_decompress 2020-03-11 12:42:30 +01:00
qcow2.c qcow2: Check request size in qcow2_co_pwritev_compressed_part() 2020-04-07 13:51:09 +02:00
qcow2.h qcow2: Remove unused fields from BDRVQcow2State 2020-03-27 14:47:23 +01:00
qcow.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
qed-check.c
qed-cluster.c
qed-l2-cache.c
qed-table.c
qed.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
qed.h
quorum.c quorum: Stop marking it as a filter 2020-02-18 11:55:40 +01:00
raw-format.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
rbd.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
replication.c replication: assert we own context before job_cancel_sync 2020-04-07 14:34:47 +02:00
sheepdog.c sheepdog: Consistently set bdrv_has_zero_init_truncate 2020-03-26 14:44:33 +01:00
snapshot.c
ssh.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
stream.c block/stream: Remove redundant statement in stream_run() 2020-03-09 15:59:31 +01:00
throttle-groups.c throttle-groups: fix memory leak in throttle_group_set_limit: 2020-01-06 13:43:06 +01:00
throttle.c block: Remove bdrv_recurse_is_first_non_filter() 2020-02-18 11:55:40 +01:00
trace-events block/block-copy: use block_status 2020-03-11 12:42:30 +01:00
vdi.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
vhdx-endian.c
vhdx-log.c
vhdx.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
vhdx.h
vmdk.c block: pass BlockDriver reference to the .bdrv_co_create 2020-03-26 14:44:33 +01:00
vpc.c vpc: Don't round up already aligned BAT sizes 2020-04-07 15:42:08 +02:00
vvfat.c block/vvfat: Do not unref qcow on closing backing bdrv 2020-02-18 10:53:56 +01:00
vxhs.c
win32-aio.c
write-threshold.c