87ad860c62
Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch <keith.busch@intel.com> Cc: qemu-block@nongnu.org Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Tested-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
81 lines
2.0 KiB
C
81 lines
2.0 KiB
C
/*
|
|
* QTest testcase for NVMe
|
|
*
|
|
* Copyright (c) 2014 SUSE LINUX Products GmbH
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or later.
|
|
* See the COPYING file in the top-level directory.
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/units.h"
|
|
#include "libqtest.h"
|
|
#include "libqos/libqos-pc.h"
|
|
|
|
static QOSState *qnvme_start(const char *extra_opts)
|
|
{
|
|
QOSState *qs;
|
|
const char *arch = qtest_get_arch();
|
|
const char *cmd = "-drive id=drv0,if=none,file=null-co://,format=raw "
|
|
"-device nvme,addr=0x4.0,serial=foo,drive=drv0 %s";
|
|
|
|
if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
|
|
qs = qtest_pc_boot(cmd, extra_opts ? : "");
|
|
global_qtest = qs->qts;
|
|
return qs;
|
|
}
|
|
|
|
g_printerr("nvme tests are only available on x86\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
static void qnvme_stop(QOSState *qs)
|
|
{
|
|
qtest_shutdown(qs);
|
|
}
|
|
|
|
static void nop(void)
|
|
{
|
|
QOSState *qs;
|
|
|
|
qs = qnvme_start(NULL);
|
|
qnvme_stop(qs);
|
|
}
|
|
|
|
static void nvmetest_cmb_test(void)
|
|
{
|
|
const int cmb_bar_size = 2 * MiB;
|
|
QOSState *qs;
|
|
QPCIDevice *pdev;
|
|
QPCIBar bar;
|
|
|
|
qs = qnvme_start("-global nvme.cmb_size_mb=2");
|
|
pdev = qpci_device_find(qs->pcibus, QPCI_DEVFN(4,0));
|
|
g_assert(pdev != NULL);
|
|
|
|
qpci_device_enable(pdev);
|
|
bar = qpci_iomap(pdev, 2, NULL);
|
|
|
|
qpci_io_writel(pdev, bar, 0, 0xccbbaa99);
|
|
g_assert_cmpint(qpci_io_readb(pdev, bar, 0), ==, 0x99);
|
|
g_assert_cmpint(qpci_io_readw(pdev, bar, 0), ==, 0xaa99);
|
|
|
|
/* Test partially out-of-bounds accesses. */
|
|
qpci_io_writel(pdev, bar, cmb_bar_size - 1, 0x44332211);
|
|
g_assert_cmpint(qpci_io_readb(pdev, bar, cmb_bar_size - 1), ==, 0x11);
|
|
g_assert_cmpint(qpci_io_readw(pdev, bar, cmb_bar_size - 1), !=, 0x2211);
|
|
g_assert_cmpint(qpci_io_readl(pdev, bar, cmb_bar_size - 1), !=, 0x44332211);
|
|
g_free(pdev);
|
|
|
|
qnvme_stop(qs);
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
g_test_init(&argc, &argv, NULL);
|
|
qtest_add_func("/nvme/nop", nop);
|
|
qtest_add_func("/nvme/cmb_test", nvmetest_cmb_test);
|
|
|
|
return g_test_run();
|
|
}
|