Commit 5ec15fab authored by Thomas Huth's avatar Thomas Huth Committed by zhanghailiang
Browse files

hw/scsi/megasas: Fix possible out-of-bounds array access in tracepoints 

Some tracepoints in megasas.c use a guest-controlled value as an index
into the mfi_frame_desc[] array. Thus a malicious guest could cause an
out-of-bounds error here. Fortunately, the impact is very low since this
can only happen when the corresponding tracepoints have been enabled
before, but the problem should be fixed anyway with a proper check.

Buglink: https://bugs.launchpad.net/qemu/+bug/1882065


Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Message-Id: <20200615072629.32321-1-thuth@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 7bad5151

hw/scsi/megasas.c

+23 −13
Original line number Diff line number Diff line
@@ -53,10 +53,6 @@ 
#define MEGASAS_FLAG_USE_QUEUE64   1

#define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)



static const char *mfi_frame_desc[] = {

    "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",

    "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};



typedef struct MegasasCmd {

    uint32_t index;

    uint16_t flags;
@@ -182,6 +178,20 @@ static void megasas_frame_set_scsi_status(MegasasState *s, 
    stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status), v);

}



static inline const char *mfi_frame_desc(unsigned int cmd)

{

    static const char *mfi_frame_descs[] = {

        "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",

        "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"

    };



    if (cmd < ARRAY_SIZE(mfi_frame_descs)) {

        return mfi_frame_descs[cmd];

    }



    return "Unknown";

}



/*

 * Context is considered opaque, but the HBA firmware is running

 * in little endian mode. So convert it to little endian, too.
@@ -1669,25 +1679,25 @@ static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd, 
    if (is_logical) {

        if (target_id >= MFI_MAX_LD || lun_id != 0) {

            trace_megasas_scsi_target_not_present(

                mfi_frame_desc[frame_cmd], is_logical, target_id, lun_id);

                mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);

            return MFI_STAT_DEVICE_NOT_FOUND;

        }

    }

    sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);



    cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);

    trace_megasas_handle_scsi(mfi_frame_desc[frame_cmd], is_logical,

    trace_megasas_handle_scsi(mfi_frame_desc(frame_cmd), is_logical,

                              target_id, lun_id, sdev, cmd->iov_size);



    if (!sdev || (megasas_is_jbod(s) && is_logical)) {

        trace_megasas_scsi_target_not_present(

            mfi_frame_desc[frame_cmd], is_logical, target_id, lun_id);

            mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);

        return MFI_STAT_DEVICE_NOT_FOUND;

    }



    if (cdb_len > 16) {

        trace_megasas_scsi_invalid_cdb_len(

                mfi_frame_desc[frame_cmd], is_logical,

                mfi_frame_desc(frame_cmd), is_logical,

                target_id, lun_id, cdb_len);

        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));

        cmd->frame->header.scsi_status = CHECK_CONDITION;
@@ -1705,7 +1715,7 @@ static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd, 
    cmd->req = scsi_req_new(sdev, cmd->index, lun_id, cdb, cmd);

    if (!cmd->req) {

        trace_megasas_scsi_req_alloc_failed(

                mfi_frame_desc[frame_cmd], target_id, lun_id);

                mfi_frame_desc(frame_cmd), target_id, lun_id);

        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));

        cmd->frame->header.scsi_status = BUSY;

        s->event_count++;
@@ -1750,17 +1760,17 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd) 
    }



    trace_megasas_handle_io(cmd->index,

                            mfi_frame_desc[frame_cmd], target_id, lun_id,

                            mfi_frame_desc(frame_cmd), target_id, lun_id,

                            (unsigned long)lba_start, (unsigned long)lba_count);

    if (!sdev) {

        trace_megasas_io_target_not_present(cmd->index,

            mfi_frame_desc[frame_cmd], target_id, lun_id);

            mfi_frame_desc(frame_cmd), target_id, lun_id);

        return MFI_STAT_DEVICE_NOT_FOUND;

    }



    if (cdb_len > 16) {

        trace_megasas_scsi_invalid_cdb_len(

            mfi_frame_desc[frame_cmd], 1, target_id, lun_id, cdb_len);

            mfi_frame_desc(frame_cmd), 1, target_id, lun_id, cdb_len);

        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));

        cmd->frame->header.scsi_status = CHECK_CONDITION;

        s->event_count++;
@@ -1780,7 +1790,7 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd) 
                            lun_id, cdb, cmd);

    if (!cmd->req) {

        trace_megasas_scsi_req_alloc_failed(

            mfi_frame_desc[frame_cmd], target_id, lun_id);

            mfi_frame_desc(frame_cmd), target_id, lun_id);

        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));

        cmd->frame->header.scsi_status = BUSY;

        s->event_count++;