[v3] hw/pvrdma: Protect against buggy or malicious guest driver

[PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Yuval Shaia 2 years ago

Guest driver might execute HW commands when shared buffers are not yet
allocated.
This could happen on purpose (malicious guest) or because of some other
guest/host address mapping error.
We need to protect againts such case.

Fixes: CVE-2022-1050

Reported-by: Raven <wxhusst@gmail.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
---
v1 -> v2:
	* Commit message changes
v2 -> v3:
	* Exclude cosmetic changes
---
 hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
index da7ddfa548..89db963c46 100644
--- a/hw/rdma/vmw/pvrdma_cmd.c
+++ b/hw/rdma/vmw/pvrdma_cmd.c
@@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
 
     dsr_info = &dev->dsr_info;
 
+    if (!dsr_info->dsr) {
+            /* Buggy or malicious guest driver */
+            rdma_error_report("Exec command without dsr, req or rsp buffers");
+            goto out;
+    }
+
     if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
                       sizeof(struct cmd_handler)) {
         rdma_error_report("Unsupported command");
-- 
2.20.1

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Michael Tokarev 1 year, 7 months ago

Ping? This is from April this year, half a year ago.
Can this be applied or?

Marcel said it should wait a week or two, I think that's been done already.. ;)

Thanks,

/mjt

03.04.2022 12:52, Yuval Shaia wrote:
> Guest driver might execute HW commands when shared buffers are not yet
> allocated.
> This could happen on purpose (malicious guest) or because of some other
> guest/host address mapping error.
> We need to protect againts such case.
> 
> Fixes: CVE-2022-1050
> 
> Reported-by: Raven <wxhusst@gmail.com>
> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
> ---
> v1 -> v2:
> 	* Commit message changes
> v2 -> v3:
> 	* Exclude cosmetic changes
> ---
>   hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
> index da7ddfa548..89db963c46 100644
> --- a/hw/rdma/vmw/pvrdma_cmd.c
> +++ b/hw/rdma/vmw/pvrdma_cmd.c
> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>   
>       dsr_info = &dev->dsr_info;
>   
> +    if (!dsr_info->dsr) {
> +            /* Buggy or malicious guest driver */
> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
> +            goto out;
> +    }
> +
>       if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>                         sizeof(struct cmd_handler)) {
>           rdma_error_report("Unsupported command");

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Marcel Apfelbaum 2 years ago

Hi Yuval,
Thank you for the changes.

On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>
> Guest driver might execute HW commands when shared buffers are not yet
> allocated.
> This could happen on purpose (malicious guest) or because of some other
> guest/host address mapping error.
> We need to protect againts such case.
>
> Fixes: CVE-2022-1050
>
> Reported-by: Raven <wxhusst@gmail.com>
> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
> ---
> v1 -> v2:
>         * Commit message changes
> v2 -> v3:
>         * Exclude cosmetic changes
> ---
>  hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
> index da7ddfa548..89db963c46 100644
> --- a/hw/rdma/vmw/pvrdma_cmd.c
> +++ b/hw/rdma/vmw/pvrdma_cmd.c
> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>
>      dsr_info = &dev->dsr_info;
>
> +    if (!dsr_info->dsr) {
> +            /* Buggy or malicious guest driver */
> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
> +            goto out;
> +    }
> +
>      if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>                        sizeof(struct cmd_handler)) {
>          rdma_error_report("Unsupported command");
> --
> 2.20.1
>

cc-ing Peter and Philippe for a question:
Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
have to wait a week or so.

Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Thanks,
Marcel

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Claudio Fontana 1 year, 4 months ago

On 4/5/22 12:31, Marcel Apfelbaum wrote:
> Hi Yuval,
> Thank you for the changes.
> 
> On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>
>> Guest driver might execute HW commands when shared buffers are not yet
>> allocated.
>> This could happen on purpose (malicious guest) or because of some other
>> guest/host address mapping error.
>> We need to protect againts such case.
>>
>> Fixes: CVE-2022-1050
>>
>> Reported-by: Raven <wxhusst@gmail.com>
>> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
>> ---
>> v1 -> v2:
>>         * Commit message changes
>> v2 -> v3:
>>         * Exclude cosmetic changes
>> ---
>>  hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
>> index da7ddfa548..89db963c46 100644
>> --- a/hw/rdma/vmw/pvrdma_cmd.c
>> +++ b/hw/rdma/vmw/pvrdma_cmd.c
>> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>>
>>      dsr_info = &dev->dsr_info;
>>
>> +    if (!dsr_info->dsr) {
>> +            /* Buggy or malicious guest driver */
>> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
>> +            goto out;
>> +    }
>> +
>>      if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>>                        sizeof(struct cmd_handler)) {
>>          rdma_error_report("Unsupported command");
>> --
>> 2.20.1
>>
> 
> cc-ing Peter and Philippe for a question:
> Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
> have to wait a week or so.
> 
> Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
> Thanks,
> Marcel
> 

Hi all,

patch is reviewed, anything holding back the inclusion of this security fix?

Thanks,

Claudio

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Yuval Shaia 1 year, 4 months ago

Can anyone else pick this one?

Thanks,
Yuval

On Wed, 7 Dec 2022 at 17:05, Claudio Fontana <cfontana@suse.de> wrote:

> On 4/5/22 12:31, Marcel Apfelbaum wrote:
> > Hi Yuval,
> > Thank you for the changes.
> >
> > On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com>
> wrote:
> >>
> >> Guest driver might execute HW commands when shared buffers are not yet
> >> allocated.
> >> This could happen on purpose (malicious guest) or because of some other
> >> guest/host address mapping error.
> >> We need to protect againts such case.
> >>
> >> Fixes: CVE-2022-1050
> >>
> >> Reported-by: Raven <wxhusst@gmail.com>
> >> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
> >> ---
> >> v1 -> v2:
> >>         * Commit message changes
> >> v2 -> v3:
> >>         * Exclude cosmetic changes
> >> ---
> >>  hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
> >>  1 file changed, 6 insertions(+)
> >>
> >> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
> >> index da7ddfa548..89db963c46 100644
> >> --- a/hw/rdma/vmw/pvrdma_cmd.c
> >> +++ b/hw/rdma/vmw/pvrdma_cmd.c
> >> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
> >>
> >>      dsr_info = &dev->dsr_info;
> >>
> >> +    if (!dsr_info->dsr) {
> >> +            /* Buggy or malicious guest driver */
> >> +            rdma_error_report("Exec command without dsr, req or rsp
> buffers");
> >> +            goto out;
> >> +    }
> >> +
> >>      if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
> >>                        sizeof(struct cmd_handler)) {
> >>          rdma_error_report("Unsupported command");
> >> --
> >> 2.20.1
> >>
> >
> > cc-ing Peter and Philippe for a question:
> > Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
> > have to wait a week or so.
> >
> > Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
> > Thanks,
> > Marcel
> >
>
> Hi all,
>
> patch is reviewed, anything holding back the inclusion of this security
> fix?
>
> Thanks,
>
> Claudio
>

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Marcel Apfelbaum 1 year, 4 months ago

On Mon, Dec 19, 2022 at 10:57 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>
> Can anyone else pick this one?

Adding Thomas,

I dropped the ball with this one, I am sorry about that, maybe it
doesn't worth a Pull Request only for it.

Maybe it can go through the Misc tree?

Thank you,
Marcel


>
> Thanks,
> Yuval
>
> On Wed, 7 Dec 2022 at 17:05, Claudio Fontana <cfontana@suse.de> wrote:
>>
>> On 4/5/22 12:31, Marcel Apfelbaum wrote:
>> > Hi Yuval,
>> > Thank you for the changes.
>> >
>> > On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>> >>
>> >> Guest driver might execute HW commands when shared buffers are not yet
>> >> allocated.
>> >> This could happen on purpose (malicious guest) or because of some other
>> >> guest/host address mapping error.
>> >> We need to protect againts such case.
>> >>
>> >> Fixes: CVE-2022-1050
>> >>
>> >> Reported-by: Raven <wxhusst@gmail.com>
>> >> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
>> >> ---
>> >> v1 -> v2:
>> >>         * Commit message changes
>> >> v2 -> v3:
>> >>         * Exclude cosmetic changes
>> >> ---
>> >>  hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>> >>  1 file changed, 6 insertions(+)
>> >>
>> >> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
>> >> index da7ddfa548..89db963c46 100644
>> >> --- a/hw/rdma/vmw/pvrdma_cmd.c
>> >> +++ b/hw/rdma/vmw/pvrdma_cmd.c
>> >> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>> >>
>> >>      dsr_info = &dev->dsr_info;
>> >>
>> >> +    if (!dsr_info->dsr) {
>> >> +            /* Buggy or malicious guest driver */
>> >> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
>> >> +            goto out;
>> >> +    }
>> >> +
>> >>      if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>> >>                        sizeof(struct cmd_handler)) {
>> >>          rdma_error_report("Unsupported command");
>> >> --
>> >> 2.20.1
>> >>
>> >
>> > cc-ing Peter and Philippe for a question:
>> > Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
>> > have to wait a week or so.
>> >
>> > Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
>> > Thanks,
>> > Marcel
>> >
>>
>> Hi all,
>>
>> patch is reviewed, anything holding back the inclusion of this security fix?
>>
>> Thanks,
>>
>> Claudio

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Thomas Huth 1 year, 3 months ago

On 19/12/2022 12.21, Marcel Apfelbaum wrote:
> On Mon, Dec 19, 2022 at 10:57 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>
>> Can anyone else pick this one?
> 
> Adding Thomas,
> 
> I dropped the ball with this one, I am sorry about that, maybe it
> doesn't worth a Pull Request only for it.

Why not? Pull request for single patches aren't that uncommon.

> Maybe it can go through the Misc tree?

hw/rdma/ is really not my turf, but since the patch is small, it sounds like 
a good candidate for qemu-trivial, I think.

  Thomas


>> On Wed, 7 Dec 2022 at 17:05, Claudio Fontana <cfontana@suse.de> wrote:
>>>
>>> On 4/5/22 12:31, Marcel Apfelbaum wrote:
>>>> Hi Yuval,
>>>> Thank you for the changes.
>>>>
>>>> On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>>>>
>>>>> Guest driver might execute HW commands when shared buffers are not yet
>>>>> allocated.
>>>>> This could happen on purpose (malicious guest) or because of some other
>>>>> guest/host address mapping error.
>>>>> We need to protect againts such case.
>>>>>
>>>>> Fixes: CVE-2022-1050
>>>>>
>>>>> Reported-by: Raven <wxhusst@gmail.com>
>>>>> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
>>>>> ---
>>>>> v1 -> v2:
>>>>>          * Commit message changes
>>>>> v2 -> v3:
>>>>>          * Exclude cosmetic changes
>>>>> ---
>>>>>   hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>>>>>   1 file changed, 6 insertions(+)
>>>>>
>>>>> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
>>>>> index da7ddfa548..89db963c46 100644
>>>>> --- a/hw/rdma/vmw/pvrdma_cmd.c
>>>>> +++ b/hw/rdma/vmw/pvrdma_cmd.c
>>>>> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>>>>>
>>>>>       dsr_info = &dev->dsr_info;
>>>>>
>>>>> +    if (!dsr_info->dsr) {
>>>>> +            /* Buggy or malicious guest driver */
>>>>> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
>>>>> +            goto out;
>>>>> +    }
>>>>> +
>>>>>       if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>>>>>                         sizeof(struct cmd_handler)) {
>>>>>           rdma_error_report("Unsupported command");
>>>>> --
>>>>> 2.20.1
>>>>>
>>>>
>>>> cc-ing Peter and Philippe for a question:
>>>> Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
>>>> have to wait a week or so.
>>>>
>>>> Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
>>>> Thanks,
>>>> Marcel
>>>>
>>>
>>> Hi all,
>>>
>>> patch is reviewed, anything holding back the inclusion of this security fix?
>>>
>>> Thanks,
>>>
>>> Claudio
>

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Laurent Vivier 1 year, 3 months ago

Le 28/12/2022 à 20:32, Thomas Huth a écrit :
> On 19/12/2022 12.21, Marcel Apfelbaum wrote:
>> On Mon, Dec 19, 2022 at 10:57 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>>
>>> Can anyone else pick this one?
>>
>> Adding Thomas,
>>
>> I dropped the ball with this one, I am sorry about that, maybe it
>> doesn't worth a Pull Request only for it.
> 
> Why not? Pull request for single patches aren't that uncommon.
> 
>> Maybe it can go through the Misc tree?
> 
> hw/rdma/ is really not my turf, but since the patch is small, it sounds like a good candidate for 
> qemu-trivial, I think.

Applied to my trivial-patches branch.

Thanks,
Laurent

> 
>   Thomas
> 
> 
>>> On Wed, 7 Dec 2022 at 17:05, Claudio Fontana <cfontana@suse.de> wrote:
>>>>
>>>> On 4/5/22 12:31, Marcel Apfelbaum wrote:
>>>>> Hi Yuval,
>>>>> Thank you for the changes.
>>>>>
>>>>> On Sun, Apr 3, 2022 at 11:54 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>>>>>
>>>>>> Guest driver might execute HW commands when shared buffers are not yet
>>>>>> allocated.
>>>>>> This could happen on purpose (malicious guest) or because of some other
>>>>>> guest/host address mapping error.
>>>>>> We need to protect againts such case.
>>>>>>
>>>>>> Fixes: CVE-2022-1050
>>>>>>
>>>>>> Reported-by: Raven <wxhusst@gmail.com>
>>>>>> Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
>>>>>> ---
>>>>>> v1 -> v2:
>>>>>>          * Commit message changes
>>>>>> v2 -> v3:
>>>>>>          * Exclude cosmetic changes
>>>>>> ---
>>>>>>   hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
>>>>>>   1 file changed, 6 insertions(+)
>>>>>>
>>>>>> diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
>>>>>> index da7ddfa548..89db963c46 100644
>>>>>> --- a/hw/rdma/vmw/pvrdma_cmd.c
>>>>>> +++ b/hw/rdma/vmw/pvrdma_cmd.c
>>>>>> @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
>>>>>>
>>>>>>       dsr_info = &dev->dsr_info;
>>>>>>
>>>>>> +    if (!dsr_info->dsr) {
>>>>>> +            /* Buggy or malicious guest driver */
>>>>>> +            rdma_error_report("Exec command without dsr, req or rsp buffers");
>>>>>> +            goto out;
>>>>>> +    }
>>>>>> +
>>>>>>       if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
>>>>>>                         sizeof(struct cmd_handler)) {
>>>>>>           rdma_error_report("Unsupported command");
>>>>>> -- 
>>>>>> 2.20.1
>>>>>>
>>>>>
>>>>> cc-ing Peter and Philippe for a question:
>>>>> Do we have a "Security Fixes" or a "Misc" subtree? Otherwise it will
>>>>> have to wait a week or so.
>>>>>
>>>>> Reviewed by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
>>>>> Thanks,
>>>>> Marcel
>>>>>
>>>>
>>>> Hi all,
>>>>
>>>> patch is reviewed, anything holding back the inclusion of this security fix?
>>>>
>>>> Thanks,
>>>>
>>>> Claudio
>>
> 
>

Re: [PATCH v3] hw/pvrdma: Protect against buggy or malicious guest driver

Posted by Michael Tokarev 11 months, 2 weeks ago

16.01.2023 20:50, Laurent Vivier wrote:
> Le 28/12/2022 à 20:32, Thomas Huth a écrit :
>> On 19/12/2022 12.21, Marcel Apfelbaum wrote:
>>> On Mon, Dec 19, 2022 at 10:57 AM Yuval Shaia <yuval.shaia.ml@gmail.com> wrote:
>>>>
>>>> Can anyone else pick this one?
>>>
>>> Adding Thomas,
>>>
>>> I dropped the ball with this one, I am sorry about that, maybe it
>>> doesn't worth a Pull Request only for it.
>>
>> Why not? Pull request for single patches aren't that uncommon.
>>
>>> Maybe it can go through the Misc tree?
>>
>> hw/rdma/ is really not my turf, but since the patch is small, it sounds like a good candidate for qemu-trivial, I think.
> 
> Applied to my trivial-patches branch.

Has it been forgotten again? :)

/mjt