* Wed Dec 13 2023 Jon Maloy <jmaloy@redhat.com> - 6.2.0-44
- kvm-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch [RHEL-15437] - kvm-tests-qtest-ahci-test-add-test-exposing-reset-issue-.patch [RHEL-15437] - Resolves: RHEL-15437 (CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8])
This commit is contained in:
Jon Maloy
parent
8bba2efc03
commit
b867c18285
|
|
@ -0,0 +1,128 @@
|
|||
From 2308abf0c5da2fe35a0721318c31d22e077663c2 Mon Sep 17 00:00:00 2001
|
||||
From: Jon Maloy <jmaloy@redhat.com>
|
||||
Date: Fri, 24 Nov 2023 12:17:11 -0500
|
||||
Subject: [PATCH 1/2] hw/ide: reset: cancel async DMA operation before
|
||||
resetting state
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
||||
RH-MergeRequest: 335: hw/ide: reset: cancel async DMA operation before resetting state
|
||||
RH-Jira: RHEL-15437
|
||||
RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
|
||||
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
RH-Commit: [1/2] b0f5f7f888559a210f1c6b3c545e337dbbc9cf22 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
|
||||
|
||||
JIRA: https://issues.redhat.com/browse/RHEL-15437
|
||||
CVE: CVE-2023-5088
|
||||
Upstream: Merged
|
||||
|
||||
commit 7d7512019fc40c577e2bdd61f114f31a9eb84a8e
|
||||
Author: Fiona Ebner <f.ebner@proxmox.com>
|
||||
Date: Wed Sep 6 15:09:21 2023 +0200
|
||||
|
||||
hw/ide: reset: cancel async DMA operation before resetting state
|
||||
|
||||
If there is a pending DMA operation during ide_bus_reset(), the fact
|
||||
that the IDEState is already reset before the operation is canceled
|
||||
can be problematic. In particular, ide_dma_cb() might be called and
|
||||
then use the reset IDEState which contains the signature after the
|
||||
reset. When used to construct the IO operation this leads to
|
||||
ide_get_sector() returning 0 and nsector being 1. This is particularly
|
||||
bad, because a write command will thus destroy the first sector which
|
||||
often contains a partition table or similar.
|
||||
|
||||
Traces showing the unsolicited write happening with IDEState
|
||||
0x5595af6949d0 being used after reset:
|
||||
|
||||
> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
|
||||
> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
|
||||
> ide_reset IDEstate 0x5595af6949d0
|
||||
> ide_reset IDEstate 0x5595af694da8
|
||||
> ide_bus_reset_aio aio_cancel
|
||||
> dma_aio_cancel dbs=0x7f64600089a0
|
||||
> dma_blk_cb dbs=0x7f64600089a0 ret=0
|
||||
> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
|
||||
> ahci_populate_sglist ahci(0x5595af6923f0)[0]
|
||||
> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
|
||||
> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
|
||||
> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
|
||||
> dma_blk_cb dbs=0x7f6420802010 ret=0
|
||||
|
||||
> (gdb) p *qiov
|
||||
> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
|
||||
> iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
|
||||
> size = 512}}}
|
||||
> (gdb) bt
|
||||
> #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
|
||||
> cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
|
||||
> at ../block/block-backend.c:1682
|
||||
> #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
|
||||
> at ../softmmu/dma-helpers.c:179
|
||||
> #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
|
||||
> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
|
||||
> io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
|
||||
> io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
|
||||
> cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
|
||||
> dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
|
||||
> #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
|
||||
> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
|
||||
> cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
|
||||
> at ../softmmu/dma-helpers.c:280
|
||||
> #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
|
||||
> at ../hw/ide/core.c:953
|
||||
> #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
|
||||
> at ../softmmu/dma-helpers.c:107
|
||||
> #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
|
||||
> #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
|
||||
> at ../block/block-backend.c:1527
|
||||
> #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
|
||||
> #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
|
||||
> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
|
||||
> i1=<optimized out>) at ../util/coroutine-ucontext.c:177
|
||||
|
||||
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
||||
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
||||
Tested-by: simon.rowe@nutanix.com
|
||||
Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com>
|
||||
|
||||
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
||||
---
|
||||
hw/ide/core.c | 14 +++++++-------
|
||||
1 file changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/hw/ide/core.c b/hw/ide/core.c
|
||||
index 05a32d0a99..fd50c123e8 100644
|
||||
--- a/hw/ide/core.c
|
||||
+++ b/hw/ide/core.c
|
||||
@@ -2456,19 +2456,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
|
||||
|
||||
void ide_bus_reset(IDEBus *bus)
|
||||
{
|
||||
- bus->unit = 0;
|
||||
- bus->cmd = 0;
|
||||
- ide_reset(&bus->ifs[0]);
|
||||
- ide_reset(&bus->ifs[1]);
|
||||
- ide_clear_hob(bus);
|
||||
-
|
||||
- /* pending async DMA */
|
||||
+ /* pending async DMA - needs the IDEState before it is reset */
|
||||
if (bus->dma->aiocb) {
|
||||
trace_ide_bus_reset_aio();
|
||||
blk_aio_cancel(bus->dma->aiocb);
|
||||
bus->dma->aiocb = NULL;
|
||||
}
|
||||
|
||||
+ bus->unit = 0;
|
||||
+ bus->cmd = 0;
|
||||
+ ide_reset(&bus->ifs[0]);
|
||||
+ ide_reset(&bus->ifs[1]);
|
||||
+ ide_clear_hob(bus);
|
||||
+
|
||||
/* reset dma provider too */
|
||||
if (bus->dma->ops->reset) {
|
||||
bus->dma->ops->reset(bus->dma);
|
||||
--
|
||||
2.41.0
|
||||
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
From b5a7e5e22a52d11034b997d2bd363c3f83f168e9 Mon Sep 17 00:00:00 2001
|
||||
From: Jon Maloy <jmaloy@redhat.com>
|
||||
Date: Fri, 24 Nov 2023 12:17:53 -0500
|
||||
Subject: [PATCH 2/2] tests/qtest: ahci-test: add test exposing reset issue
|
||||
with pending callback
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
||||
RH-MergeRequest: 335: hw/ide: reset: cancel async DMA operation before resetting state
|
||||
RH-Jira: RHEL-15437
|
||||
RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
|
||||
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
RH-Commit: [2/2] 364e0703d22d69a4c1cfcff250ad0a3c81ada7b2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
|
||||
|
||||
JIRA: https://issues.redhat.com/browse/RHEL-15437
|
||||
CVE: CVE-2023-5088
|
||||
Upstream: Merged
|
||||
|
||||
commit cc610857bbd3551f4b86ae2299336b5d9aa0db2b
|
||||
Author: Fiona Ebner <f.ebner@proxmox.com>
|
||||
Date: Wed Sep 6 15:09:22 2023 +0200
|
||||
|
||||
tests/qtest: ahci-test: add test exposing reset issue with pending callback
|
||||
|
||||
Before commit "hw/ide: reset: cancel async DMA operation before
|
||||
resetting state", this test would fail, because a reset with a
|
||||
pending write operation would lead to an unsolicited write to the
|
||||
first sector of the disk.
|
||||
|
||||
The test writes a pattern to the beginning of the disk and verifies
|
||||
that it is still intact after a reset with a pending operation. It
|
||||
also checks that the pending operation actually completes correctly.
|
||||
|
||||
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
||||
Message-ID: <20230906130922.142845-2-f.ebner@proxmox.com>
|
||||
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
||||
|
||||
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
||||
---
|
||||
tests/qtest/ahci-test.c | 86 ++++++++++++++++++++++++++++++++++++++++-
|
||||
1 file changed, 85 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c
|
||||
index 8073ccc205..b4d15566e1 100644
|
||||
--- a/tests/qtest/ahci-test.c
|
||||
+++ b/tests/qtest/ahci-test.c
|
||||
@@ -1425,6 +1425,89 @@ static void test_reset(void)
|
||||
ahci_shutdown(ahci);
|
||||
}
|
||||
|
||||
+static void test_reset_pending_callback(void)
|
||||
+{
|
||||
+ AHCIQState *ahci;
|
||||
+ AHCICommand *cmd;
|
||||
+ uint8_t port;
|
||||
+ uint64_t ptr1;
|
||||
+ uint64_t ptr2;
|
||||
+
|
||||
+ int bufsize = 4 * 1024;
|
||||
+ int speed = bufsize + (bufsize / 2);
|
||||
+ int offset1 = 0;
|
||||
+ int offset2 = bufsize / AHCI_SECTOR_SIZE;
|
||||
+
|
||||
+ g_autofree unsigned char *tx1 = g_malloc(bufsize);
|
||||
+ g_autofree unsigned char *tx2 = g_malloc(bufsize);
|
||||
+ g_autofree unsigned char *rx1 = g_malloc0(bufsize);
|
||||
+ g_autofree unsigned char *rx2 = g_malloc0(bufsize);
|
||||
+
|
||||
+ /* Uses throttling to make test independent of specific environment. */
|
||||
+ ahci = ahci_boot_and_enable("-drive if=none,id=drive0,file=%s,"
|
||||
+ "cache=writeback,format=%s,"
|
||||
+ "throttling.bps-write=%d "
|
||||
+ "-M q35 "
|
||||
+ "-device ide-hd,drive=drive0 ",
|
||||
+ tmp_path, imgfmt, speed);
|
||||
+
|
||||
+ port = ahci_port_select(ahci);
|
||||
+ ahci_port_clear(ahci, port);
|
||||
+
|
||||
+ ptr1 = ahci_alloc(ahci, bufsize);
|
||||
+ ptr2 = ahci_alloc(ahci, bufsize);
|
||||
+
|
||||
+ g_assert(ptr1 && ptr2);
|
||||
+
|
||||
+ /* Need two different patterns. */
|
||||
+ do {
|
||||
+ generate_pattern(tx1, bufsize, AHCI_SECTOR_SIZE);
|
||||
+ generate_pattern(tx2, bufsize, AHCI_SECTOR_SIZE);
|
||||
+ } while (memcmp(tx1, tx2, bufsize) == 0);
|
||||
+
|
||||
+ qtest_bufwrite(ahci->parent->qts, ptr1, tx1, bufsize);
|
||||
+ qtest_bufwrite(ahci->parent->qts, ptr2, tx2, bufsize);
|
||||
+
|
||||
+ /* Write to beginning of disk to check it wasn't overwritten later. */
|
||||
+ ahci_guest_io(ahci, port, CMD_WRITE_DMA_EXT, ptr1, bufsize, offset1);
|
||||
+
|
||||
+ /* Issue asynchronously to get a pending callback during reset. */
|
||||
+ cmd = ahci_command_create(CMD_WRITE_DMA_EXT);
|
||||
+ ahci_command_adjust(cmd, offset2, ptr2, bufsize, 0);
|
||||
+ ahci_command_commit(ahci, cmd, port);
|
||||
+ ahci_command_issue_async(ahci, cmd);
|
||||
+
|
||||
+ ahci_set(ahci, AHCI_GHC, AHCI_GHC_HR);
|
||||
+
|
||||
+ ahci_command_free(cmd);
|
||||
+
|
||||
+ /* Wait for throttled write to finish. */
|
||||
+ sleep(1);
|
||||
+
|
||||
+ /* Start again. */
|
||||
+ ahci_clean_mem(ahci);
|
||||
+ ahci_pci_enable(ahci);
|
||||
+ ahci_hba_enable(ahci);
|
||||
+ port = ahci_port_select(ahci);
|
||||
+ ahci_port_clear(ahci, port);
|
||||
+
|
||||
+ /* Read and verify. */
|
||||
+ ahci_guest_io(ahci, port, CMD_READ_DMA_EXT, ptr1, bufsize, offset1);
|
||||
+ qtest_bufread(ahci->parent->qts, ptr1, rx1, bufsize);
|
||||
+ g_assert_cmphex(memcmp(tx1, rx1, bufsize), ==, 0);
|
||||
+
|
||||
+ ahci_guest_io(ahci, port, CMD_READ_DMA_EXT, ptr2, bufsize, offset2);
|
||||
+ qtest_bufread(ahci->parent->qts, ptr2, rx2, bufsize);
|
||||
+ g_assert_cmphex(memcmp(tx2, rx2, bufsize), ==, 0);
|
||||
+
|
||||
+ ahci_free(ahci, ptr1);
|
||||
+ ahci_free(ahci, ptr2);
|
||||
+
|
||||
+ ahci_clean_mem(ahci);
|
||||
+
|
||||
+ ahci_shutdown(ahci);
|
||||
+}
|
||||
+
|
||||
static void test_ncq_simple(void)
|
||||
{
|
||||
AHCIQState *ahci;
|
||||
@@ -1929,7 +2012,8 @@ int main(int argc, char **argv)
|
||||
qtest_add_func("/ahci/migrate/dma/halted", test_migrate_halted_dma);
|
||||
|
||||
qtest_add_func("/ahci/max", test_max);
|
||||
- qtest_add_func("/ahci/reset", test_reset);
|
||||
+ qtest_add_func("/ahci/reset/simple", test_reset);
|
||||
+ qtest_add_func("/ahci/reset/pending_callback", test_reset_pending_callback);
|
||||
|
||||
qtest_add_func("/ahci/io/ncq/simple", test_ncq_simple);
|
||||
qtest_add_func("/ahci/migrate/ncq/simple", test_migrate_ncq);
|
||||
--
|
||||
2.41.0
|
||||
|
||||
|
|
@ -83,7 +83,7 @@ Obsoletes: %1-rhev <= %{epoch}:%{version}-%{release}
|
|||
Summary: QEMU is a machine emulator and virtualizer
|
||||
Name: qemu-kvm
|
||||
Version: 6.2.0
|
||||
Release: 43%{?rcrel}%{?dist}
|
||||
Release: 44%{?rcrel}%{?dist}
|
||||
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
|
||||
Epoch: 15
|
||||
License: GPLv2 and GPLv2+ and CC-BY
|
||||
|
|
@ -807,6 +807,10 @@ Patch322: kvm-net-Update-MemReentrancyGuard-for-NIC.patch
|
|||
Patch323: kvm-vhost-release-memory_listener-object-in-error-path.patch
|
||||
# For RHEL-2600 - qemu core dump occurs when client connects to VNC server because qemu cmd only adds vnc but without graphics device
|
||||
Patch324: kvm-ui-fix-crash-when-there-are-no-active_console.patch
|
||||
# For RHEL-15437 - CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8]
|
||||
Patch325: kvm-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch
|
||||
# For RHEL-15437 - CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8]
|
||||
Patch326: kvm-tests-qtest-ahci-test-add-test-exposing-reset-issue-.patch
|
||||
|
||||
BuildRequires: wget
|
||||
BuildRequires: rpm-build
|
||||
|
|
@ -1976,6 +1980,12 @@ sh %{_sysconfdir}/sysconfig/modules/kvm.modules &> /dev/null || :
|
|||
|
||||
|
||||
%changelog
|
||||
* Wed Dec 13 2023 Jon Maloy <jmaloy@redhat.com> - 6.2.0-44
|
||||
- kvm-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch [RHEL-15437]
|
||||
- kvm-tests-qtest-ahci-test-add-test-exposing-reset-issue-.patch [RHEL-15437]
|
||||
- Resolves: RHEL-15437
|
||||
(CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8])
|
||||
|
||||
* Wed Dec 06 2023 Jon Maloy <jmaloy@redhat.com> - 6.2.0-43
|
||||
- kvm-net-Provide-MemReentrancyGuard-to-qemu_new_nic.patch [RHEL-7309]
|
||||
- kvm-net-Update-MemReentrancyGuard-for-NIC.patch [RHEL-7309]
|
||||
|
|
|
|||
Loading…
Reference in New Issue