From patchwork Thu Apr 18 20:02:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 789863 Delivered-To: patch@linaro.org Received: by 2002:adf:e6ca:0:b0:346:15ad:a2a with SMTP id y10csp748826wrm; Thu, 18 Apr 2024 13:07:10 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXJtp+2vZF10HAieBsTo9Ebasy+4OELPsVTGN1NRef0QQ0UKSmcih8I7KzmK6GKHSB74BCeFLwbNoSW9xa4KQFk X-Google-Smtp-Source: AGHT+IHMIjakRpiCA3hCFTKTP4Jd5oKdxjA+XGATjEcX/BIgSvNeTTiwgwdLlTdFRphQ2yxhjHtK X-Received: by 2002:a05:6358:4b01:b0:186:249a:c8de with SMTP id kr1-20020a0563584b0100b00186249ac8demr358110rwc.5.1713470829884; Thu, 18 Apr 2024 13:07:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1713470829; cv=none; d=google.com; s=arc-20160816; b=ybKyTzkT6ypS+m70wTt/TDR8KqbVp/5xH1JYjYz4G32jsAYRXk8U8RGqDHAEcWQ7RK DNCg12PrfVzRsBAKefAiReARARRzG3fXyRzlCFa74jbA6aECSvPJow3KSbAPE7K9ljM9 vB+EC3zgJdMrEzj4s64brM8JU2WtN+9j3Q9VNBoKhM1zHjHTZNpfMnNDotSl5rdPvqQe bIid6YYs6bkFm4Yh5LRQZohbspmQYEUNSydFpbO0LTAyZV8k+h+58FY+Jc7hlvQgT4ax C9DPkHJo5oOmijTsBYsdb7PiEYm3e4Cxu5XSVgD0QYsXAJWLNH7+j9ZseaIj0aP1at9I FUew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=Euw+OU7XLFwGu2EhJCZq7uqCAlPqlFFFHDIAVSBRPhU=; fh=tRhOdRo3RUGB1Op9NsKs6zZ1tjf3Fks3D9Jm5ySYJkw=; b=vxUS0TVjuCRuQ2gXdLaxL5PG4E5FqrnPmUlJ2WcWLbl5neBAql/zX+zYOzOlOstwb1 ZCnHnoYDv6zyXG2Zmh9Iuu3XQF/Jyw6eJjvossQuGCMC0OgSdubkINY6vBV1X6UclX8D Aq58dJEStdJ6nwUrIlPbK1dAnX3X6SNUZyDctw+b52rI20WxqvhpYWSJqe3GT8nMQlQl UcclIc0tT47uYQAjISCbMwqLwDL2PAARZAGyIBJPth0Gkuokahkw2Qgw85tQqRgkqDvW aHnvKP29PrLlhXXHqKpLEhJSCg8arbxe3/N5uvyyvx80wGWyKsT/lgo13IQWYT7Yr6IX AuiA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id g4-20020a0562140ac400b006a04d4c2eebsi2232262qvi.569.2024.04.18.13.07.09 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 18 Apr 2024 13:07:09 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rxXyc-0001lr-Fr; Thu, 18 Apr 2024 16:03:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rxXyA-0001ZU-W8; Thu, 18 Apr 2024 16:02:59 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rxXy6-0005LH-Lm; Thu, 18 Apr 2024 16:02:54 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DA62D5FE12; Thu, 18 Apr 2024 23:02:27 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 4303FB93F8; Thu, 18 Apr 2024 23:02:25 +0300 (MSK) Received: (nullmailer pid 952869 invoked by uid 1000); Thu, 18 Apr 2024 20:02:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Qiang Liu , Richard Henderson , Kevin Wolf , Michael Tokarev Subject: [Stable-7.2.11 51/59] hw/block/nand: Fix out-of-bound access in NAND block buffer Date: Thu, 18 Apr 2024 23:02:11 +0300 Message-Id: <20240418200224.952785-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé nand_command() and nand_getio() don't check @offset points into the block, nor the available data length (s->iolen) is not negative. In order to fix: - check the offset is in range in nand_blk_load_NAND_PAGE_SIZE(), - do not set @iolen if blk_load() failed. Reproducer: $ cat << EOF | qemu-system-arm -machine tosa \ -monitor none -serial none \ -display none -qtest stdio write 0x10000111 0x1 0xca write 0x10000104 0x1 0x47 write 0x1000ca04 0x1 0xd7 write 0x1000ca01 0x1 0xe0 write 0x1000ca04 0x1 0x71 write 0x1000ca00 0x1 0x50 write 0x1000ca04 0x1 0xd7 read 0x1000ca02 0x1 write 0x1000ca01 0x1 0x10 EOF ================================================================= ==15750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61f000000de0 at pc 0x560e61557210 bp 0x7ffcfc4a59f0 sp 0x7ffcfc4a59e8 READ of size 1 at 0x61f000000de0 thread T0 #0 0x560e6155720f in mem_and hw/block/nand.c:101:20 #1 0x560e6155ac9c in nand_blk_write_512 hw/block/nand.c:663:9 #2 0x560e61544200 in nand_command hw/block/nand.c:293:13 #3 0x560e6153cc83 in nand_setio hw/block/nand.c:520:13 #4 0x560e61a0a69e in tc6393xb_nand_writeb hw/display/tc6393xb.c:380:13 #5 0x560e619f9bf7 in tc6393xb_writeb hw/display/tc6393xb.c:524:9 #6 0x560e647c7d03 in memory_region_write_accessor softmmu/memory.c:492:5 #7 0x560e647c7641 in access_with_adjusted_size softmmu/memory.c:554:18 #8 0x560e647c5f66 in memory_region_dispatch_write softmmu/memory.c:1514:16 #9 0x560e6485409e in flatview_write_continue softmmu/physmem.c:2825:23 #10 0x560e648421eb in flatview_write softmmu/physmem.c:2867:12 #11 0x560e64841ca8 in address_space_write softmmu/physmem.c:2963:18 #12 0x560e61170162 in qemu_writeb tests/qtest/videzzo/videzzo_qemu.c:1080:5 #13 0x560e6116eef7 in dispatch_mmio_write tests/qtest/videzzo/videzzo_qemu.c:1227:28 0x61f000000de0 is located 0 bytes to the right of 3424-byte region [0x61f000000080,0x61f000000de0) allocated by thread T0 here: #0 0x560e611276cf in malloc /root/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x7f7959a87e98 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57e98) #2 0x560e64b98871 in object_new qom/object.c:749:12 #3 0x560e64b5d1a1 in qdev_new hw/core/qdev.c:153:19 #4 0x560e61547ea5 in nand_init hw/block/nand.c:639:11 #5 0x560e619f8772 in tc6393xb_init hw/display/tc6393xb.c:558:16 #6 0x560e6390bad2 in tosa_init hw/arm/tosa.c:250:12 SUMMARY: AddressSanitizer: heap-buffer-overflow hw/block/nand.c:101:20 in mem_and ==15750==ABORTING Broken since introduction in commit 3e3d5815cb ("NAND Flash memory emulation and ECC calculation helpers for use by NAND controllers"). Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1445 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1446 Reported-by: Qiang Liu Reviewed-by: Richard Henderson Reviewed-by: Kevin Wolf Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20240409135944.24997-4-philmd@linaro.org> (cherry picked from commit d39fdfff348fdf00173b7a58e935328a64db7d28) Signed-off-by: Michael Tokarev diff --git a/hw/block/nand.c b/hw/block/nand.c index 81b2bb804d..d994bfe372 100644 --- a/hw/block/nand.c +++ b/hw/block/nand.c @@ -255,7 +255,9 @@ static unsigned nand_load_block(NANDFlashState *s, unsigned offset) { unsigned iolen; - s->blk_load(s, s->addr, offset); + if (!s->blk_load(s, s->addr, offset)) { + return 0; + } iolen = (1 << s->page_shift); if (s->gnd) { @@ -783,6 +785,10 @@ static bool glue(nand_blk_load_, NAND_PAGE_SIZE)(NANDFlashState *s, return false; } + if (offset > NAND_PAGE_SIZE + OOB_SIZE) { + return false; + } + if (s->blk) { if (s->mem_oob) { if (blk_pread(s->blk, SECTOR(addr) << BDRV_SECTOR_BITS,