ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fuzz: fix sparse memory access in the DMA callback 

The code mistakenly relied on address_space_translate to store the
length remaining until the next memory-region. We care about this
because when there is RAM or sparse-memory neighboring on an MMIO
region, we should only write up to the border, to prevent inadvertently
invoking MMIO handlers within the DMA callback.

However address_space_translate_internal only stores the length until
the end of the MemoryRegion if memory_region_is_ram(mr). Otherwise
the *len is left unmodified. This caused some false-positive issues,
where the fuzzer found a way to perform a nested MMIO write through a
DMA callback on an [address, length] that started within sparse memory
and spanned some device MMIO regions.

To fix this, write to sparse memory in small chunks of
memory_access_size (similar to the underlying address_space_write code),
which will prevent accidentally hitting MMIO handlers through large
writes.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
This commit is contained in:
Alexander Bulekov 2021-07-13 11:00:34 -04:00
parent ec397e90d2
commit af16990a1b
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tests/qtest/fuzz/generic_fuzz.c
View File

@ -240,10 +240,17 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
addr, &addr1, &l, true,
MEMTXATTRS_UNSPECIFIED);
if (!(memory_region_is_ram(mr1) ||
memory_region_is_romd(mr1)) && mr1 != sparse_mem_mr) {
/*
* If mr1 isn't RAM, address_space_translate doesn't update l. Use
* memory_access_size to identify the number of bytes that it is safe
* to write without accidentally writing to another MemoryRegion.
*/
if (!memory_region_is_ram(mr1)) {
l = memory_access_size(mr1, l, addr1);
} else {
}
if (memory_region_is_ram(mr1) ||
memory_region_is_romd(mr1) ||
mr1 == sparse_mem_mr) {
/* ROM/RAM case */
if (qtest_log_enabled) {
/*