qemu/hw/xen
Simon Gaiser 2e63eb2bec xen/pt: Set is_express to avoid out-of-bounds write
The passed-through device might be an express device. In this case the
old code allocated a too small emulated config space in
pci_config_alloc() since pci_config_size() returned the size for a
non-express device. This leads to an out-of-bound write in
xen_pt_config_reg_init(), which sometimes results in crashes. So set
is_express as already done for KVM in vfio-pci.

Shortened ASan report:

==17512==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000041648 at pc 0x55e0fdac51ff bp 0x7ffe4af07410 sp 0x7ffe4af07408
WRITE of size 2 at 0x611000041648 thread T0
    #0 0x55e0fdac51fe in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
    #1 0x55e0fdac51fe in stw_he_p include/qemu/bswap.h:330
    #2 0x55e0fdac51fe in stw_le_p include/qemu/bswap.h:379
    #3 0x55e0fdac51fe in pci_set_word include/hw/pci/pci.h:490
    #4 0x55e0fdac51fe in xen_pt_config_reg_init hw/xen/xen_pt_config_init.c:1991
    #5 0x55e0fdac51fe in xen_pt_config_init hw/xen/xen_pt_config_init.c:2067
    #6 0x55e0fdabcf4d in xen_pt_realize hw/xen/xen_pt.c:830
    #7 0x55e0fdf59666 in pci_qdev_realize hw/pci/pci.c:2034
    #8 0x55e0fdda7d3d in device_set_realized hw/core/qdev.c:914
[...]

0x611000041648 is located 8 bytes to the right of 256-byte region [0x611000041540,0x611000041640)
allocated by thread T0 here:
    #0 0x7ff596a94bb8 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9bb8)
    #1 0x7ff57da66580 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x50580)
    #2 0x55e0fdda7d3d in device_set_realized hw/core/qdev.c:914
[...]

Signed-off-by: Simon Gaiser <hw42@ipsumj.de>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
2017-12-14 16:11:53 -08:00
..
Makefile.objs pci-assign: Remove 2017-11-05 14:52:10 +01:00
trace-events trace-events: fix code style: %# -> 0x% 2017-08-01 12:13:07 +01:00
xen-common.c migration: move skip_section_footers 2017-06-28 11:18:39 +02:00
xen-host-pci-device.c util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
xen-host-pci-device.h Clean up decorations and whitespace around header guards 2016-07-12 16:20:46 +02:00
xen_backend.c xen: add a global indicator for grant copy being available 2017-10-26 14:23:06 -07:00
xen_devconfig.c xen: Rename xen_be_printf to xen_pv_printf 2016-10-28 17:53:50 -07:00
xen_pt.c xen/pt: Set is_express to avoid out-of-bounds write 2017-12-14 16:11:53 -08:00
xen_pt.h xen/pt: allow QEMU to request MSI unmasking at bind time 2017-09-20 19:05:27 -07:00
xen_pt_config_init.c xen/pt: allow QEMU to request MSI unmasking at bind time 2017-09-20 19:05:27 -07:00
xen_pt_graphics.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
xen_pt_load_rom.c pci-assign: Remove 2017-11-05 14:52:10 +01:00
xen_pt_msi.c xen/pt: allow QEMU to request MSI unmasking at bind time 2017-09-20 19:05:27 -07:00
xen_pvdev.c xen: create qdev for each backend device 2016-11-22 10:29:39 -08:00