[qemu-xen master] block/nbd: fix segmentation fault when .desc is not null-terminated

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[qemu-xen master] block/nbd: fix segmentation fault when .desc is not null-terminated

commit b9da3c1de7829a982685029222482cc5914638f4
Author:     Murilo Opsfelder Araujo <[hidden email]>
AuthorDate: Fri Jan 5 11:32:41 2018 -0200
Commit:     Michael Roth <[hidden email]>
CommitDate: Tue Jan 9 10:41:11 2018 -0600

    block/nbd: fix segmentation fault when .desc is not null-terminated
    The find_desc_by_name() from util/qemu-option.c relies on the .name not being
    NULL to call strcmp(). This check becomes unsafe when the list is not
    NULL-terminated, which is the case of nbd_runtime_opts in block/nbd.c, and can
    result in segmentation fault when strcmp() tries to access an invalid memory:
        #0 0x00007fff8c75f7d4 in __strcmp_power9 () from /lib64/libc.so.6
        #1 0x00000000102d3ec8 in find_desc_by_name (desc=0x1036d6f0, name=0x28e46670 "server.path") at util/qemu-option.c:166
        #2 0x00000000102d93e0 in qemu_opts_absorb_qdict (opts=0x28e47a80, qdict=0x28e469a0, errp=0x7fffec247c98) at util/qemu-option.c:1026
        #3 0x000000001012a2e4 in nbd_open (bs=0x28e42290, options=0x28e469a0, flags=24578, errp=0x7fffec247d80) at block/nbd.c:406
        #4 0x00000000100144e8 in bdrv_open_driver (bs=0x28e42290, drv=0x1036e070 <bdrv_nbd_unix>, node_name=0x0, options=0x28e469a0, open_flags=24578, errp=0x7fffec247f50) at block.c:1135
        #5 0x0000000010015b04 in bdrv_open_common (bs=0x28e42290, file=0x0, options=0x28e469a0, errp=0x7fffec247f50) at block.c:1395
    >From gdb, the desc[i].name was not NULL and resulted in strcmp() accessing an
    invalid memory:
        >>> p desc[5]
        $8 = {
          name = 0x1037f098 "R27A",
          type = 1561964883,
          help = 0xc0bbb23e <error: Cannot access memory at address 0xc0bbb23e>,
          def_value_str = 0x2 <error: Cannot access memory at address 0x2>
        >>> p desc[6]
        $9 = {
          name = 0x103dac78 <__gcov0.do_qemu_init_bdrv_nbd_init> "\001",
          type = 272101528,
          help = 0x29ec0b754403e31f <error: Cannot access memory at address 0x29ec0b754403e31f>,
          def_value_str = 0x81f343b9 <error: Cannot access memory at address 0x81f343b9>
    This patch fixes the segmentation fault in strcmp() by adding a NULL element at
    the end of nbd_runtime_opts.desc list, which is the common practice to most of
    other structs like runtime_opts in block/null.c. Thus, the desc[i].name != NULL
    check becomes safe because it will not evaluate to true when .desc list reached
    its end.
    Reported-by: R. Nageswara Sastry <[hidden email]>
    Buglink: https://bugs.launchpad.net/qemu/+bug/1727259
    Signed-off-by: Murilo Opsfelder Araujo <[hidden email]>
    Message-Id: <[hidden email]>
    CC: [hidden email]
    Fixes: 7ccc44fd7d1dfa62c4d6f3a680df809d6e7068ce
    Signed-off-by: Eric Blake <[hidden email]>
    (cherry picked from commit c4365735a7d38f4355c6f77e6670d3972315f7c2)
    Signed-off-by: Michael Roth <[hidden email]>
 block/nbd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/nbd.c b/block/nbd.c
index a50d24b..8b8ba56 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -388,6 +388,7 @@ static QemuOptsList nbd_runtime_opts = {
             .type = QEMU_OPT_STRING,
             .help = "ID of the TLS credentials to use",
+        { /* end of list */ }
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

Xen-changelog mailing list
[hidden email]