diff options
| author | Qiang Liu | 2021-08-04 08:51:50 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2021-08-31 14:34:36 +0200 |
| commit | 2b3a98255c90d8d2f9f87a73eb33371961508517 (patch) | |
| tree | 6bc9c3a868a27fbbb6480fd3ad66c3465773f207 | |
| parent | vga: don't abort when adding a duplicate isa-vga device (diff) | |
| download | qemu-2b3a98255c90d8d2f9f87a73eb33371961508517.tar.gz qemu-2b3a98255c90d8d2f9f87a73eb33371961508517.tar.xz qemu-2b3a98255c90d8d2f9f87a73eb33371961508517.zip | |
hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read
xlnx_dp_read allows an out-of-bounds read at its default branch because
of an improper index.
According to
https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html
(DP Module), registers 0x3A4/0x3A4/0x3AC are allowed.
DP_INT_MASK 0x000003A4 32 mixed 0xFFFFF03F Interrupt Mask Register for intrN.
DP_INT_EN 0x000003A8 32 mixed 0x00000000 Interrupt Enable Register.
DP_INT_DS 0x000003AC 32 mixed 0x00000000 Interrupt Disable Register.
In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device
will write s->core_registers[0x3A4
>> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4
>> 2) + 1). However, the current size of s->core_registers is (0x3AF >>
>> 2), that is ((0x3A4 >> 2) + 2), which is out of the range.
In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to
the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read)
rather than 0x3A4.
This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4,
but does not adjust the size of s->core_registers to avoid breaking
migration.
Fixes: 58ac482a66de ("introduce xlnx-dp")
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/display/xlnx_dp.c | 6 | ||||
| -rw-r--r-- | tests/qtest/fuzz-xlnx-dp-test.c | 33 | ||||
| -rw-r--r-- | tests/qtest/meson.build | 1 |
3 files changed, 39 insertions, 1 deletions
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c index 2bb7a5441a..9bb781e312 100644 --- a/hw/display/xlnx_dp.c +++ b/hw/display/xlnx_dp.c @@ -714,7 +714,11 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size) break; default: assert(offset <= (0x3AC >> 2)); - ret = s->core_registers[offset]; + if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) { + ret = s->core_registers[DP_INT_MASK]; + } else { + ret = s->core_registers[offset]; + } break; } diff --git a/tests/qtest/fuzz-xlnx-dp-test.c b/tests/qtest/fuzz-xlnx-dp-test.c new file mode 100644 index 0000000000..69eb6c0eb1 --- /dev/null +++ b/tests/qtest/fuzz-xlnx-dp-test.c @@ -0,0 +1,33 @@ +/* + * QTest fuzzer-generated testcase for xlnx-dp display device + * + * Copyright (c) 2021 Qiang Liu <cyruscyliu@gmail.com> + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqos/libqtest.h" + +/* + * This used to trigger the out-of-bounds read in xlnx_dp_read + */ +static void test_fuzz_xlnx_dp_0x3ac(void) +{ + QTestState *s = qtest_init("-M xlnx-zcu102 -display none "); + qtest_readl(s, 0xfd4a03ac); + qtest_quit(s); +} + +int main(int argc, char **argv) +{ + const char *arch = qtest_get_arch(); + + g_test_init(&argc, &argv, NULL); + + if (strcmp(arch, "aarch64") == 0) { + qtest_add_func("fuzz/test_fuzz_xlnx_dp/3ac", test_fuzz_xlnx_dp_0x3ac); + } + + return g_test_run(); +} diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index 2bc3efd49f..757bb8499a 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -187,6 +187,7 @@ qtests_aarch64 = \ 'numa-test', 'boot-serial-test', 'xlnx-can-test', + 'fuzz-xlnx-dp-test', 'migration-test'] qtests_s390x = \ |