The guest can program the e1000e DMA address to its MMIO. This will cause an UAF issue.
Following is the reproducer: cat << EOF | ./i386-softmmu/qemu-system-i386 -M q35,accel=qtest \ -qtest stdio -nographic -monitor none -serial none outl 0xcf8 0x80001010 outl 0xcfc 0xe1020000 outl 0xcf8 0x80001014 outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x800010a2 write 0xe102003b 0x1 0xff write 0xe1020103 0x1e 0xffffff055c5e5c30be4511d084ffffffffffffffffffffffffffffffffff write 0xe1020420 0x4 0xffffffff write 0xe1020424 0x4 0xffffffff write 0xe102042b 0x1 0xff write 0xe1020430 0x4 0x055c5e5c write 0x5c041 0x1 0x04 write 0x5c042 0x1 0x02 write 0x5c043 0x1 0xe1 write 0x5c048 0x1 0x8a write 0x5c04a 0x1 0x31 write 0x5c04b 0x1 0xff write 0xe1020403 0x1 0xff EOF This patch avoid this by adding a 'in_io' in E1000EState to indicate it is in IO processing. Buglink: https://bugs.launchpad.net/qemu/+bug/1886362 Reported-by: Alexander Bulekov <alx...@bu.edu> Signed-off-by: Li Qiang <liq...@163.com> --- hw/net/e1000e.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c index fda34518c9..eb6b34b7f3 100644 --- a/hw/net/e1000e.c +++ b/hw/net/e1000e.c @@ -77,6 +77,8 @@ typedef struct E1000EState { bool disable_vnet; + bool in_io; + E1000ECore core; } E1000EState; @@ -98,7 +100,15 @@ static uint64_t e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size) { E1000EState *s = opaque; - return e1000e_core_read(&s->core, addr, size); + uint64_t ret; + + if (s->in_io) { + return 0; + } + s->in_io = true; + ret = e1000e_core_read(&s->core, addr, size); + s->in_io = false; + return ret; } static void @@ -106,7 +116,13 @@ e1000e_mmio_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { E1000EState *s = opaque; + + if (s->in_io) { + return; + } + s->in_io = true; e1000e_core_write(&s->core, addr, val, size); + s->in_io = false; } static bool @@ -138,19 +154,28 @@ e1000e_io_read(void *opaque, hwaddr addr, unsigned size) uint32_t idx = 0; uint64_t val; + if (s->in_io) { + return 0; + } + s->in_io = true; + switch (addr) { case E1000_IOADDR: trace_e1000e_io_read_addr(s->ioaddr); + s->in_io = false; return s->ioaddr; case E1000_IODATA: if (e1000e_io_get_reg_index(s, &idx)) { val = e1000e_core_read(&s->core, idx, sizeof(val)); trace_e1000e_io_read_data(idx, val); + s->in_io = false; return val; } + s->in_io = false; return 0; default: trace_e1000e_wrn_io_read_unknown(addr); + s->in_io = false; return 0; } } @@ -162,19 +187,27 @@ e1000e_io_write(void *opaque, hwaddr addr, E1000EState *s = opaque; uint32_t idx = 0; + if (s->in_io) { + return; + } + s->in_io = true; + switch (addr) { case E1000_IOADDR: trace_e1000e_io_write_addr(val); s->ioaddr = (uint32_t) val; + s->in_io = false; return; case E1000_IODATA: if (e1000e_io_get_reg_index(s, &idx)) { trace_e1000e_io_write_data(idx, val); e1000e_core_write(&s->core, idx, val, sizeof(val)); } + s->in_io = false; return; default: trace_e1000e_wrn_io_write_unknown(addr); + s->in_io = false; return; } } -- 2.17.1
