[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH for-8.1 v2] hw/virtio-iommu: Fix potential OOB access in virt
|
From: |
Philippe Mathieu-Daudé |
|
Subject: |
Re: [PATCH for-8.1 v2] hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() |
|
Date: |
Mon, 17 Jul 2023 19:26:23 +0200 |
|
User-agent: |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 |
On 17/7/23 18:21, Eric Auger wrote:
In the virtio_iommu_handle_command() when a PROBE request is handled,
output_size takes a value greater than the tail size and on a subsequent
iteration we can get a stack out-of-band access. Initialize the
output_size on each iteration.
A backtrace would be helpful (or reproducer).
The issue was found with ASAN. Credits to:
Yiming Tao(Zhejiang University)
Gaoning Pan(Zhejiang University)
Fixes: 1733eebb9e7 ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Mauro Matteo Cascella <mcascell@redhat.com>
Did you mean:
Reported-by: Yiming Tao <taoym@zju.edu.cn>
?
Cc: qemu-stable@nongnu.org
---
- added the Cc: qemu-stable@nongnu.org and copied 2 persons involved
in the reporting loop
---
hw/virtio/virtio-iommu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>