129 lines
5.4 KiB
Diff
129 lines
5.4 KiB
Diff
From 2308abf0c5da2fe35a0721318c31d22e077663c2 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Fri, 24 Nov 2023 12:17:11 -0500
|
|
Subject: [PATCH 1/2] hw/ide: reset: cancel async DMA operation before
|
|
resetting state
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 335: hw/ide: reset: cancel async DMA operation before resetting state
|
|
RH-Jira: RHEL-15437
|
|
RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
|
|
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
RH-Commit: [1/2] b0f5f7f888559a210f1c6b3c545e337dbbc9cf22 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-15437
|
|
CVE: CVE-2023-5088
|
|
Upstream: Merged
|
|
|
|
commit 7d7512019fc40c577e2bdd61f114f31a9eb84a8e
|
|
Author: Fiona Ebner <f.ebner@proxmox.com>
|
|
Date: Wed Sep 6 15:09:21 2023 +0200
|
|
|
|
hw/ide: reset: cancel async DMA operation before resetting state
|
|
|
|
If there is a pending DMA operation during ide_bus_reset(), the fact
|
|
that the IDEState is already reset before the operation is canceled
|
|
can be problematic. In particular, ide_dma_cb() might be called and
|
|
then use the reset IDEState which contains the signature after the
|
|
reset. When used to construct the IO operation this leads to
|
|
ide_get_sector() returning 0 and nsector being 1. This is particularly
|
|
bad, because a write command will thus destroy the first sector which
|
|
often contains a partition table or similar.
|
|
|
|
Traces showing the unsolicited write happening with IDEState
|
|
0x5595af6949d0 being used after reset:
|
|
|
|
> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
|
|
> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
|
|
> ide_reset IDEstate 0x5595af6949d0
|
|
> ide_reset IDEstate 0x5595af694da8
|
|
> ide_bus_reset_aio aio_cancel
|
|
> dma_aio_cancel dbs=0x7f64600089a0
|
|
> dma_blk_cb dbs=0x7f64600089a0 ret=0
|
|
> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
|
|
> ahci_populate_sglist ahci(0x5595af6923f0)[0]
|
|
> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
|
|
> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
|
|
> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
|
|
> dma_blk_cb dbs=0x7f6420802010 ret=0
|
|
|
|
> (gdb) p *qiov
|
|
> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
|
|
> iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
|
|
> size = 512}}}
|
|
> (gdb) bt
|
|
> #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
|
|
> cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
|
|
> at ../block/block-backend.c:1682
|
|
> #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
|
|
> at ../softmmu/dma-helpers.c:179
|
|
> #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
|
|
> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
|
|
> io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
|
|
> io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
|
|
> cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
|
|
> dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
|
|
> #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
|
|
> sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
|
|
> cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
|
|
> at ../softmmu/dma-helpers.c:280
|
|
> #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
|
|
> at ../hw/ide/core.c:953
|
|
> #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
|
|
> at ../softmmu/dma-helpers.c:107
|
|
> #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
|
|
> #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
|
|
> at ../block/block-backend.c:1527
|
|
> #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
|
|
> #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
|
|
> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
|
|
> i1=<optimized out>) at ../util/coroutine-ucontext.c:177
|
|
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Tested-by: simon.rowe@nutanix.com
|
|
Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
hw/ide/core.c | 14 +++++++-------
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/hw/ide/core.c b/hw/ide/core.c
|
|
index 05a32d0a99..fd50c123e8 100644
|
|
--- a/hw/ide/core.c
|
|
+++ b/hw/ide/core.c
|
|
@@ -2456,19 +2456,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
|
|
|
|
void ide_bus_reset(IDEBus *bus)
|
|
{
|
|
- bus->unit = 0;
|
|
- bus->cmd = 0;
|
|
- ide_reset(&bus->ifs[0]);
|
|
- ide_reset(&bus->ifs[1]);
|
|
- ide_clear_hob(bus);
|
|
-
|
|
- /* pending async DMA */
|
|
+ /* pending async DMA - needs the IDEState before it is reset */
|
|
if (bus->dma->aiocb) {
|
|
trace_ide_bus_reset_aio();
|
|
blk_aio_cancel(bus->dma->aiocb);
|
|
bus->dma->aiocb = NULL;
|
|
}
|
|
|
|
+ bus->unit = 0;
|
|
+ bus->cmd = 0;
|
|
+ ide_reset(&bus->ifs[0]);
|
|
+ ide_reset(&bus->ifs[1]);
|
|
+ ide_clear_hob(bus);
|
|
+
|
|
/* reset dma provider too */
|
|
if (bus->dma->ops->reset) {
|
|
bus->dma->ops->reset(bus->dma);
|
|
--
|
|
2.41.0
|
|
|