qemu-e2k/hw
Philippe Mathieu-Daudé defac5e2fb hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507)
Per the 82078 datasheet, if the end-of-track (EOT byte in
the FIFO) is more than the number of sectors per side, the
command is terminated unsuccessfully:

* 5.2.5 DATA TRANSFER TERMINATION

  The 82078 supports terminal count explicitly through
  the TC pin and implicitly through the underrun/over-
  run and end-of-track (EOT) functions. For full sector
  transfers, the EOT parameter can define the last
  sector to be transferred in a single or multisector
  transfer. If the last sector to be transferred is a par-
  tial sector, the host can stop transferring the data in
  mid-sector, and the 82078 will continue to complete
  the sector as if a hardware TC was received. The
  only difference between these implicit functions and
  TC is that they return "abnormal termination" result
  status. Such status indications can be ignored if they
  were expected.

* 6.1.3 READ TRACK

  This command terminates when the EOT specified
  number of sectors have been read. If the 82078
  does not find an I D Address Mark on the diskette
  after the second· occurrence of a pulse on the
  INDX# pin, then it sets the IC code in Status Regis-
  ter 0 to "01" (Abnormal termination), sets the MA bit
  in Status Register 1 to "1", and terminates the com-
  mand.

* 6.1.6 VERIFY

  Refer to Table 6-6 and Table 6-7 for information
  concerning the values of MT and EC versus SC and
  EOT value.

* Table 6·6. Result Phase Table

* Table 6-7. Verify Command Result Phase Table

Fix by aborting the transfer when EOT > # Sectors Per Side.

Cc: qemu-stable@nongnu.org
Cc: Hervé Poussineau <hpoussin@reactos.org>
Fixes: baca51faff ("floppy driver: disk geometry auto detect")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/339
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211118115733.4038610-2-philmd@redhat.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2022-05-12 12:31:08 +02:00
..
9pfs 9pfs: fix qemu_mknodat() to always return -1 on error on macOS host 2022-05-01 14:07:03 +02:00
acpi hw/acpi/aml-build: Use existing CPU topology to build PPTT table 2022-05-09 11:47:55 +01:00
adc aspeed/adc: Add AST1030 support 2022-05-02 17:03:02 +02:00
alpha Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
arm hw/arm/virt: Fix CPU's default NUMA node ID 2022-05-09 11:47:55 +01:00
audio pc: remove -soundhw pcspk 2022-05-07 07:46:59 +02:00
avr Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
block hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507) 2022-05-12 12:31:08 +02:00
char hw/char: fix qcode array bounds check in ESCC impl 2022-04-26 16:12:26 +01:00
core qapi/machine.json: Add cluster-id 2022-05-09 11:47:54 +01:00
cpu cpu/core: Fix "help" of CPU core device types 2021-04-09 16:05:16 -04:00
cris Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
display artist: only render dirty scanlines on the display surface 2022-05-08 18:52:37 +01:00
dma Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
gpio hw/gpio/aspeed_gpio: Fix QOM pin property 2022-05-02 17:03:04 +02:00
hppa Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
hyperv util: rename qemu_*block() socket functions 2022-05-03 15:53:20 +04:00
i2c Use g_new() & friends where that makes obvious sense 2022-03-21 15:44:44 +01:00
i386 Clean up header guards that don't match their file name 2022-05-11 16:49:06 +02:00
ide MIPS patches queue 2022-03-09 09:13:39 +00:00
input hw: replace qemu_set_nonblock() 2022-05-03 15:52:33 +04:00
intc ppc/xive: Update the state of the External interrupt signal 2022-05-05 15:36:17 -03:00
ipack qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
ipmi hw/isa: Inline and remove one-line isa_init_irq() 2022-03-08 19:38:17 +01:00
isa Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
m68k hw: Add compat machines for 7.1 2022-04-20 09:36:24 +02:00
mem Mark remaining global TypeInfo instances as const 2022-02-21 13:30:20 +00:00
microblaze Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
mips Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
misc lasi: move from hw/hppa to hw/misc 2022-05-08 18:52:37 +01:00
net Clean up header guards that don't match their file name 2022-05-11 16:49:06 +02:00
nios2 hw/nios2: Machine with a Vectored Interrupt Controller 2022-04-26 08:17:05 -07:00
nubus qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvme Clean up header guards that don't match their file name 2022-05-11 16:49:06 +02:00
nvram Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
openrisc hw/openrisc/openrisc_sim: Add support for initrd loading 2022-02-26 10:39:36 +09:00
pci Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
pci-bridge pci: expose TYPE_XIO3130_DOWNSTREAM name 2022-03-06 05:08:23 -05:00
pci-host dino: move from hw/hppa to hw/pci-host 2022-05-08 18:52:36 +01:00
pcmcia hw/pcmcia: Do not register PCMCIA type if not required 2021-05-02 17:24:50 +02:00
ppc Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
rdma hw/pvrdma: Some cosmetic fixes 2022-04-26 12:25:14 +02:00
remote Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
riscv hw/riscv: Enable TPM backends 2022-04-29 10:48:48 +10:00
rtc Replace qemu_gettimeofday() with g_get_real_time() 2022-04-06 10:50:37 +02:00
rx hw/rx: rx-gdbsim DTB load address aligned of 16byte. 2022-04-21 10:06:42 -07:00
s390x target/s390x: add S390_FEAT_VECTOR_ENH2 to qemu CPU model 2022-05-04 08:47:19 +02:00
scsi virtio-scsi: move request-related items from .h to .c 2022-05-09 10:45:04 +01:00
sd Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
sensor hw/sensor: add Renesas raa228000 device 2022-03-08 18:46:48 +01:00
sh4 Use g_new() & friends where that makes obvious sense 2022-03-21 15:44:44 +01:00
smbios hw/smbios: Add table 4 parameter, "processor-id" 2022-03-06 05:28:55 -05:00
sparc Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
sparc64 Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
ssi aspeed/smc: Add AST1030 support 2022-05-02 17:03:03 +02:00
timer aspeed/timer: Add AST1030 support 2022-05-02 17:03:03 +02:00
tpm Replace qemu_real_host_page variables with inlined functions 2022-04-06 10:50:38 +02:00
tricore hw/tricore: fix inclusion of tricore_testboard 2021-07-20 20:10:21 +02:00
usb Clean up header guards that don't match their file name 2022-05-11 16:49:06 +02:00
vfio vfio/common: Rename VFIOGuestIOMMU::iommu into ::iommu_mr 2022-05-06 09:06:51 -06:00
virtio virtio-scsi: don't waste CPU polling the event virtqueue 2022-05-09 10:45:04 +01:00
watchdog aspeed/wdt: Add AST1030 support 2022-05-02 17:03:03 +02:00
xen meson: remove CONFIG_XEN_PCI_PASSTHROUGH from config-target.h 2022-04-28 08:52:22 +02:00
xenpv Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
xtensa hw/xtensa: fix reset value of MIROUT register of MX PIC 2022-05-06 15:27:40 -07:00
Kconfig hw/arm: xlnx-zcu102: Add Xilinx eFUSE device 2021-09-30 13:42:10 +01:00
meson.build sensor: Move hardware sensors from misc to a sensor directory 2021-06-17 07:10:32 -05:00