[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout
From: |
Bin Meng |
Subject: |
Re: [PATCH] scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) |
Date: |
Fri, 2 Sep 2022 18:55:47 +0800 |
Hi Mauro,
On Fri, Sep 2, 2022 at 6:44 PM Mauro Matteo Cascella
<mcascell@redhat.com> wrote:
>
> Hi Bin,
>
> On Fri, Sep 2, 2022 at 3:56 AM Bin Meng <bmeng.cn@gmail.com> wrote:
> >
> > Hi,
> >
> > On Wed, Jul 13, 2022 at 8:45 PM Paolo Bonzini <pbonzini@redhat.com> wrote:
> > >
> > > From: Mauro Matteo Cascella <mcascell@redhat.com>
> > >
> > > Set current_req to NULL, not current_req->req, to prevent reusing a free'd
> > > buffer in case of repeated SCSI cancel requests. Also apply the fix to
> > > CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel
> > > the request.
> > >
> > > Thanks to Alexander Bulekov for providing a reproducer.
> > >
> > > Fixes: CVE-2022-0216
> > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
> > > Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
> > > Tested-by: Alexander Bulekov <alxndr@bu.edu>
> > > Message-Id: <20220711123316.421279-1-mcascell@redhat.com>
> > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> > > ---
> > > Adjust the patch from v1 to v2 since the changes crossed
> > > with the pull request.
> > >
> > > hw/scsi/lsi53c895a.c | 3 +-
> > > tests/qtest/fuzz-lsi53c895a-test.c | 71 ++++++++++++++++++++++++++++++
> > > 2 files changed, 73 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
> > > index 99ea42d49b..ad5f5e5f39 100644
> > > --- a/hw/scsi/lsi53c895a.c
> > > +++ b/hw/scsi/lsi53c895a.c
> > > @@ -1030,7 +1030,7 @@ static void lsi_do_msgout(LSIState *s)
> > > trace_lsi_do_msgout_abort(current_tag);
> > > if (current_req && current_req->req) {
> > > scsi_req_cancel(current_req->req);
> > > - current_req->req = NULL;
> > > + current_req = NULL;
> > > }
> > > lsi_disconnect(s);
> > > break;
> > > @@ -1056,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s)
> > > /* clear the current I/O process */
> > > if (s->current) {
> > > scsi_req_cancel(s->current->req);
> > > + current_req = NULL;
> > > }
> > >
> > > /* As the current implemented devices scsi_disk and
> > > scsi_generic
> > > diff --git a/tests/qtest/fuzz-lsi53c895a-test.c
> > > b/tests/qtest/fuzz-lsi53c895a-test.c
> > > index 2e8e67859e..6872c70d3a 100644
> > > --- a/tests/qtest/fuzz-lsi53c895a-test.c
> > > +++ b/tests/qtest/fuzz-lsi53c895a-test.c
> > > @@ -8,6 +8,74 @@
> > > #include "qemu/osdep.h"
> > > #include "libqtest.h"
> > >
> > > +/*
> > > + * This used to trigger a UAF in lsi_do_msgout()
> > > + * https://gitlab.com/qemu-project/qemu/-/issues/972
> > > + */
> > > +static void test_lsi_do_msgout_cancel_req(void)
> > > +{
> > > + QTestState *s;
> > > +
> > > + s = qtest_init("-M q35 -m 4G -display none -nodefaults "
> >
> > This test does not run on machines with small size memory. Is 4G a
> > must have for this test?
>
> 4G comes from [1], I don't think it's a must have. Would 2G be okay?
2G is much better. My machine has 8G memory and 4G fails sometimes.
> For some reason ASAN does not trigger the UAF when I run the test
> locally with less than 2G (1.7G to be precise). I didn't really
> investigate why that is the case.
>
> [1] https://gitlab.com/qemu-project/qemu/-/issues/972#note_1019851430.
>
Regards,
Bin