[Qemu-commits] [qemu/qemu] d2ff85: ide: Check array bounds before writing to io_buffe...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: d2ff85854512574e7209f295e87b0835d5b032c6
      
https://github.com/qemu/qemu/commit/d2ff85854512574e7209f295e87b0835d5b032c6
  Author: Kevin Wolf <address@hidden>
  Date:   2015-07-26 (Sun, 26 Jul 2015)

  Changed paths:
    M hw/ide/core.c

  Log Message:
  -----------
  ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

If the end_transfer_func of a command is called because enough data has
been read or written for the current PIO transfer, and it fails to
correctly call the command completion functions, the DRQ bit in the
status register and s->end_transfer_func may remain set. This allows the
guest to access further bytes in s->io_buffer beyond s->data_end, and
eventually overflowing the io_buffer.

One case where this currently happens is emulation of the ATAPI command
START STOP UNIT.

This patch fixes the problem by adding explicit array bounds checks
before accessing the buffer instead of relying on end_transfer_func to
function correctly.

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Reviewed-by: John Snow <address@hidden>


  Commit: 03441c3a4a42beb25460dd11592539030337d0f8
      
https://github.com/qemu/qemu/commit/03441c3a4a42beb25460dd11592539030337d0f8
  Author: Kevin Wolf <address@hidden>
  Date:   2015-07-26 (Sun, 26 Jul 2015)

  Changed paths:
    M hw/ide/atapi.c

  Log Message:
  -----------
  ide/atapi: Fix START STOP UNIT command completion

The command must be completed on all code paths. START STOP UNIT with
pwrcnd set should succeed without doing anything.

Signed-off-by: Kevin Wolf <address@hidden>
Reviewed-by: John Snow <address@hidden>


  Commit: cb72cba83021fa42719e73a5249c12096a4d1cfc
      
https://github.com/qemu/qemu/commit/cb72cba83021fa42719e73a5249c12096a4d1cfc
  Author: Kevin Wolf <address@hidden>
  Date:   2015-07-26 (Sun, 26 Jul 2015)

  Changed paths:
    M hw/ide/core.c

  Log Message:
  -----------
  ide: Clear DRQ after handling all expected accesses

This is additional hardening against an end_transfer_func that fails to
clear the DRQ status bit. The bit must be unset as soon as the PIO
transfer has completed, so it's better to do this in a central place
instead of duplicating the code in all commands (and forgetting it in
some).

Signed-off-by: Kevin Wolf <address@hidden>
Reviewed-by: John Snow <address@hidden>


  Commit: e40db4c6d391419c0039fe274c74df32a6ca1a28
      
https://github.com/qemu/qemu/commit/e40db4c6d391419c0039fe274c74df32a6ca1a28
  Author: Peter Maydell <address@hidden>
  Date:   2015-07-27 (Mon, 27 Jul 2015)

  Changed paths:
    M hw/ide/atapi.c
    M hw/ide/core.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/jnsnow/tags/cve-2015-5154-pull-request' 
into staging

# gpg: Signature made Mon Jul 27 13:01:10 2015 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <address@hidden>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/cve-2015-5154-pull-request:
  ide: Clear DRQ after handling all expected accesses
  ide/atapi: Fix START STOP UNIT command completion
  ide: Check array bounds before writing to io_buffer (CVE-2015-5154)

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/f793d97e454a...e40db4c6d391