Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP5:GA
qemu.29142
0422-hw-nvme-fix-CVE-2021-3929.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0422-hw-nvme-fix-CVE-2021-3929.patch of Package qemu.29142
From: Dario Faggioli <dfaggioli@suse.com> Date: Thu, 20 Apr 2023 16:05:53 +0200 Subject: hw/nvme: fix CVE-2021-3929 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: 736b01642d85be832385063f278fe7cd4ffb5221 References: bsc#1193880, CVE-2021-3929 This fixes CVE-2021-3929 "locally" by denying DMA to the iomem of the device itself. This still allows DMA to MMIO regions of other devices (e.g. doing P2P DMA to the controller memory buffer of another NVMe device). Fixes: CVE-2021-3929 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>41 Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Lin Ma <lma@suse.com> Signed-off-by: Dario Faggioli <dfaggioli@suse.com> --- hw/block/nvme.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 9faad29fadfe31ac7c9bcdb6c3f2..fe5ba56cf997e636aefdd2ae165a 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -34,6 +34,24 @@ static void nvme_process_sq(void *opaque); +static inline bool nvme_addr_is_iomem(NvmeCtrl *n, hwaddr addr) +{ + PCIDevice *pci_dev = &n->parent_obj; + hwaddr regs_hi, regs_lo, msix_hi, msix_lo; + + /* + * The purpose of this check is to guard against invalid "local" access + * to the iomem (i.e. controller registers, MSIX-related space). + */ + regs_lo = n->iomem.addr; + regs_hi = regs_lo + int128_get64(n->iomem.size); + msix_lo = pci_dev->msix_exclusive_bar.addr; + msix_hi = msix_lo + int128_get64(pci_dev->msix_exclusive_bar.size); + + return (addr >= regs_lo && addr < regs_hi) || + (addr >= msix_lo && addr < msix_hi); +} + static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid) { return sqid < n->num_queues && n->sq[sqid] != NULL ? 0 : -1; @@ -90,6 +108,9 @@ static uint16_t nvme_map_prp(QEMUSGList *qsg, uint64_t prp1, uint64_t prp2, return NVME_INVALID_FIELD | NVME_DNR; } + if (nvme_addr_is_iomem(n, prp1)) { + return NVME_DATA_TRAS_ERROR; + } pci_dma_sglist_init(qsg, &n->parent_obj, num_prps); qemu_sglist_add(qsg, prp1, trans_len); len -= trans_len; @@ -126,6 +147,9 @@ static uint16_t nvme_map_prp(QEMUSGList *qsg, uint64_t prp1, uint64_t prp2, } trans_len = MIN(len, n->page_size); + if (nvme_addr_is_iomem(n, prp_ent)) { + return NVME_DATA_TRAS_ERROR; + } qemu_sglist_add(qsg, prp_ent, trans_len); len -= trans_len; i++; @@ -134,6 +158,9 @@ static uint16_t nvme_map_prp(QEMUSGList *qsg, uint64_t prp1, uint64_t prp2, if (prp2 & (n->page_size - 1)) { goto unmap; } + if (nvme_addr_is_iomem(n, prp2)) { + return NVME_DATA_TRAS_ERROR; + } qemu_sglist_add(qsg, prp2, len); } }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor