mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2b3a98255c
qemu/hw
History
Qiang Liu 2b3a98255c hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read 
xlnx_dp_read allows an out-of-bounds read at its default branch because
of an improper index.

According to
https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html
(DP Module), registers 0x3A4/0x3A4/0x3AC are allowed.

DP_INT_MASK     0x000003A4      32      mixed   0xFFFFF03F      Interrupt Mask Register for intrN.
DP_INT_EN       0x000003A8      32      mixed   0x00000000      Interrupt Enable Register.
DP_INT_DS       0x000003AC      32      mixed   0x00000000      Interrupt Disable Register.

In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device
will write s->core_registers[0x3A4
>> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4
>> 2) + 1). However, the current size of s->core_registers is (0x3AF >>
>> 2), that is ((0x3A4 >> 2) + 2), which is out of the range.
In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to
the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read)
rather than 0x3A4.

This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4,
but does not adjust the size of s->core_registers to avoid breaking
migration.

Fixes: 58ac482a66 ("introduce xlnx-dp")
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-08-31 14:34:36 +02:00
..
9pfs 9pfs: reduce latency of Twalk 2021-07-05 13:03:16 +02:00
acpi hw/acpi/Kconfig: Add missing Kconfig dependencies (build error) 2021-07-20 15:29:27 +02:00
adc adc: Move the max111x driver to the adc directory 2021-06-17 07:10:32 -05:00
alpha hw/alpha: Provide a PCI-ISA bridge device node 2021-06-28 07:27:32 -07:00
arm hw/arm/xlnx-zynqmp: Add unimplemented APU mmio 2021-08-26 17:02:01 +01:00
audio hw/audio/adlib: Remove unused variable in adlib_callback 2021-07-26 07:07:07 -10:00
avr hw/avr/atmega.c: use the avr51 cpu for atmega1280 2021-05-13 19:11:42 +02:00
block pc,pci,virtio: bugfixes, improvements 2021-07-09 14:30:01 +01:00
char hw/char/pl011: add support for sending break 2021-08-25 10:48:50 +01:00
core hw/core/loader: In gunzip(), check index is in range before use, not after 2021-08-26 17:02:00 +01:00
cpu cpu/core: Fix "help" of CPU core device types 2021-04-09 16:05:16 -04:00
cris Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
display hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read 2021-08-31 14:34:36 +02:00
dma hw/dma/xlnx-zdma Always expect 'dma' link property to be set 2021-08-26 17:01:59 +01:00
gpio hw: aspeed_gpio: Fix memory size 2021-07-27 11:00:00 +01:00
hppa docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
hyperv vmbus: Don't make QOM property registration conditional 2021-07-06 18:04:38 -04:00
i2c i2c/smbus_eeprom: Add feature bit to SPD data 2021-07-29 10:59:49 +10:00
i386 Error reporting patches for 2021-08-26 2021-08-27 09:57:28 +01:00
ide hw/ide/Kconfig: Add missing dependency PCI -> IDE_QDEV 2021-07-20 15:30:42 +02:00
input Some qemu updates for IPMI and I2C 2021-07-11 14:32:49 +01:00
intc ppc/xive: Export xive_presenter_notify() 2021-08-27 12:41:13 +10:00
ipack Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ipmi ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct 2021-07-08 14:15:01 -05:00
isa hw/isa/vt82c686: Add missing Kconfig dependency (runtime error) 2021-07-20 20:10:20 +02:00
m68k bitops.h: revert db1ffc32dd ("qemu/bitops.h: add bitrev8 implementation") 2021-07-26 06:56:41 -10:00
mem docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
microblaze Do not include sysemu/sysemu.h if it's not really necessary 2021-05-02 17:24:50 +02:00
mips arch_init.h: Don't include arch_init.h unnecessarily 2021-08-26 17:02:00 +01:00
misc Some qemu updates for IPMI and I2C 2021-07-11 14:32:49 +01:00
net hw/net: e1000e: Don't zero out the VLAN tag in the legacy RX descriptor 2021-08-02 12:19:18 +08:00
nios2 Do not include cpu.h if it's not really necessary 2021-05-02 17:24:51 +02:00
nubus hw: Do not include hw/sysbus.h if it is not necessary 2021-05-02 17:24:50 +02:00
nvme hw/nvme: fix missing variable initializers 2021-08-09 12:52:16 +02:00
nvram docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
openrisc Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
pci hw/pci: Add pci_bus_range() to get PCI bus number range 2021-07-16 11:10:45 -04:00
pci-bridge hw/pcie-root-port: Fix hotplug for PCI devices requiring IO 2021-08-03 16:31:07 -04:00
pci-host Revert "acpi/gpex: Inform os to keep firmware resource map" 2021-08-03 16:32:34 -04:00
pcmcia hw/pcmcia: Do not register PCMCIA type if not required 2021-05-02 17:24:50 +02:00
ppc ppc patch queue 2021-08-27 2021-08-27 11:34:12 +01:00
rdma pvrdma: Fix the ring init error flow (CVE-2021-3608) 2021-07-04 22:47:51 +03:00
remote Remove superfluous ERRP_GUARD() 2021-08-26 17:15:28 +02:00
riscv arch_init.h: Don't include arch_init.h unnecessarily 2021-08-26 17:02:00 +01:00
rtc docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
rx hw/rx/rx-gdbsim: Do not accept invalid memory size 2021-05-03 10:07:41 +02:00
s390x error: Use error_fatal to simplify obvious fatal errors (again) 2021-08-26 17:15:28 +02:00
scsi vhost-scsi: Plug memory leak on migrate_add_blocker() failure 2021-08-26 17:15:28 +02:00
sd hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30 2021-08-03 19:34:51 +02:00
sensor hw/misc: add MAX34451 device 2021-07-08 14:42:00 -05:00
sh4 Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
smbios hw/smbios: support for type 41 (onboard devices extended information) 2021-05-14 10:26:18 -04:00
sparc hw/block/fdc: Extract SysBus floppy controllers to fdc-sysbus.c 2021-06-25 08:53:28 -04:00
sparc64 hw/block/fdc: Extract ISA floppy controllers to fdc-isa.c 2021-06-25 08:53:28 -04:00
ssi Trivial patches pull request 20210503 2021-05-05 13:52:00 +01:00
timer hw/timer: Initial commit of Ibex Timer 2021-06-24 05:00:12 -07:00
tpm docs: fix references to docs/specs/tpm.rst 2021-06-02 06:51:09 +02:00
tricore hw/tricore: fix inclusion of tricore_testboard 2021-07-20 20:10:21 +02:00
usb chardev: mark explicitly first argument as poisoned 2021-08-05 16:15:33 +04:00
vfio vfio: Avoid error_propagate() after migrate_add_blocker() 2021-08-26 17:15:28 +02:00
virtio vhost: Clean up how VhostOpts method vhost_backend_init() fails 2021-08-26 17:15:28 +02:00
watchdog docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
xen docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
xenpv meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
xtensa Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
Kconfig sensor: Move hardware sensors from misc to a sensor directory 2021-06-17 07:10:32 -05:00
meson.build sensor: Move hardware sensors from misc to a sensor directory 2021-06-17 07:10:32 -05:00