From f2609ffdf39bcd4f89b5f67b33347490023a7a84 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Thu, 6 Dec 2018 17:48:30 +0530 Subject: i2c: pm_smbus: check smb_index before block transfer write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann Signed-off-by: Prasad J Pandit Reviewed-by: Igor Mammedov Reviewed-by: Li Qiang Reviewed-by: Michael Hanselmann Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Michael S. Tsirkin Message-id: 20181206121830.6177-1-ppandit@redhat.com Signed-off-by: Peter Maydell --- hw/i2c/pm_smbus.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'hw/i2c') diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c index 685a237..0306274 100644 --- a/hw/i2c/pm_smbus.c +++ b/hw/i2c/pm_smbus.c @@ -240,6 +240,9 @@ static void smb_ioport_writeb(void *opaque, hwaddr addr, uint64_t val, uint8_t read = s->smb_addr & 0x01; s->smb_index++; + if (s->smb_index >= PM_SMBUS_MAX_MSG_SIZE) { + s->smb_index = 0; + } if (!read && s->smb_index == s->smb_data0) { uint8_t prot = (s->smb_ctl >> 2) & 0x07; uint8_t cmd = s->smb_cmd; -- cgit v1.1