From nobody Sun Aug 14 15:04:06 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4M5LKL6vdsz4ZJfQ; Sun, 14 Aug 2022 15:04:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4M5LKL6Q7Zz3c0R; Sun, 14 Aug 2022 15:04:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1660489446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vpvcMLsDIMINYjEP/aYWbRgM1nWdgqCUckYo/frh4H4=; b=i1YcIFtVOfFS23VQ1iWWvYeC25K3FOMGEDoOKY0mmQnIBw6LrILgOAE8AP/SEvnYvBY4Oa syXrwklZwgsB04eG5CxAVEGtLuIfJcbbW03JnYQTiYlAjhfw6y4prmy3OAMypiYQ8QsJ9H 52dzSX5mj5Rnd4laNP2pI+7aJdYrGnWKhfG5kSgL8G/3q+Uh/2mHhJ2BGHr4uXCtE3T+gG CxjHVTKpqUt+IMJYsNEIykQWYrMrLEUgm4OCaoZaZ+bPdsX0Wnz73DVWiJYhnKTHVBpJF5 UHF4LM9QtLiLFDix+iPDUtu4JyIu79CCmL7FTMcuMOC6kQqM8c3/TztQ7WwGkg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4M5LKL5T7FzvPg; Sun, 14 Aug 2022 15:04:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 27EF46ho076965; Sun, 14 Aug 2022 15:04:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 27EF46hp076964; Sun, 14 Aug 2022 15:04:06 GMT (envelope-from git) Date: Sun, 14 Aug 2022 15:04:06 GMT Message-Id: <202208141504.27EF46hp076964@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Chuck Tuffli Subject: git: 3d3678627c31 - main - bhyve nvme: Check return value of mapped memory List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: chuck X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3d3678627c3112c94d174a8c51d8c058d02befb3 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1660489446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vpvcMLsDIMINYjEP/aYWbRgM1nWdgqCUckYo/frh4H4=; b=OHs8A6sfBiV1cg+SCGBksFhPMhyaC77E7djGxtmaBUbvrg9zx9rAiKBuCpZKiyWhJylLGN HHXO4eZK0dwGOm5RMLWwhWyGtdY9EExtYk4PIfxbKd8V0wNdeyKKwAFzlpGjmuKZLsmrTT OL05UfZf3r353JKAuQMTkJgd+SnwcwLiSs8nPQe9Y60PKxD75Q9E23rm6Ns7iFAN2+nWMx XcAAx0QeTZOWUYa7v9ZNVkPkyZMxEfCfahNOFSa7zkcf/GiKEnCmrXLIhKFWnqksXlSg4o o02Dt2qL4TzIEBmB7WItJcOsOZYfdem8555eCB61YSvz1BMbmE28e98VqhdETA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1660489446; a=rsa-sha256; cv=none; b=aKt36YZv4/K1/Pwz+LoM+RKcJ0b/jAtyiB9FYNgAqtXgeAN0g/hIa3S+bBxC3MRqveoZCz 2HTKBiWtzQReV1GsZIIWij9F1lLBl/CdRJ4sVfluhMWLjefoehPdrrhGadWUcASFylSoKP BmBcTfDtVcArffU1mQkcxmVeTZK4o++tDjyU6CPWxxXjT9ytW3VfaUpEIU6eonXPUFZHEz z7vFBYuW9i50bimOoxi/fxr3LtGWSscRYPC8aTlYEDgo1IhOnyLw91F2bnrwNdFv9g2gQ/ NUtXO78TaOI3qJLDGuBtIExAeGOCXZjFSigfMCNRhM6eatzauihXgzv3fG5a3Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by chuck: URL: https://cgit.FreeBSD.org/src/commit/?id=3d3678627c3112c94d174a8c51d8c058d02befb3 commit 3d3678627c3112c94d174a8c51d8c058d02befb3 Author: Chuck Tuffli AuthorDate: 2022-08-14 14:45:21 +0000 Commit: Chuck Tuffli CommitDate: 2022-08-14 14:45:21 +0000 bhyve nvme: Check return value of mapped memory Fuzzing of bhyve using hyfuzz discovered a way to cause a segmentation fault in the NVMe emulation. If a guest specifies a physical address in either the PRP1 or PRP2 field of a command that cannot be mapped from guest to host, the function paddr_guest2host() returns a NULL pointer. The NVMe emulation did not check for this error case, which allowed for the segmentation fault to occur. Fix is to check for a return value of NULL and indicate an error back to the guest (Data Transfer error). While in the area, slightly refactor the write/read blockif function to use a common error exit path. PR: 256321 Reported by: Cheolwoo Myung Reviewed by: imp, jhb Differential Revision: https://reviews.freebsd.org/D35452 --- usr.sbin/bhyve/pci_nvme.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/usr.sbin/bhyve/pci_nvme.c b/usr.sbin/bhyve/pci_nvme.c index 5f54e4107c10..e10c8bd437e2 100644 --- a/usr.sbin/bhyve/pci_nvme.c +++ b/usr.sbin/bhyve/pci_nvme.c @@ -2196,6 +2196,8 @@ pci_nvme_append_iov_req(struct pci_nvme_softc *sc, struct pci_nvme_ioreq *req, req->io_req.br_iov[iovidx].iov_base = paddr_guest2host(req->sc->nsc_pi->pi_vmctx, req->prev_gpaddr, size); + if (req->io_req.br_iov[iovidx].iov_base == NULL) + return (-1); req->prev_size += size; req->io_req.br_resid += size; @@ -2212,6 +2214,8 @@ pci_nvme_append_iov_req(struct pci_nvme_softc *sc, struct pci_nvme_ioreq *req, req->io_req.br_iov[iovidx].iov_base = paddr_guest2host(req->sc->nsc_pi->pi_vmctx, gpaddr, size); + if (req->io_req.br_iov[iovidx].iov_base == NULL) + return (-1); req->io_req.br_iov[iovidx].iov_len = size; @@ -2402,8 +2406,7 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc, size = MIN(PAGE_SIZE - (prp1 % PAGE_SIZE), bytes); if (pci_nvme_append_iov_req(sc, req, prp1, size, is_write, offset)) { - pci_nvme_status_genc(&status, - NVME_SC_DATA_TRANSFER_ERROR); + err = -1; goto out; } @@ -2416,8 +2419,7 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc, size = bytes; if (pci_nvme_append_iov_req(sc, req, prp2, size, is_write, offset)) { - pci_nvme_status_genc(&status, - NVME_SC_DATA_TRANSFER_ERROR); + err = -1; goto out; } } else { @@ -2433,6 +2435,10 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc, prp_list = paddr_guest2host(vmctx, prp, PAGE_SIZE - (prp % PAGE_SIZE)); + if (prp_list == NULL) { + err = -1; + goto out; + } last = prp_list + (NVME_PRP2_ITEMS - 1); } @@ -2440,8 +2446,7 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc, if (pci_nvme_append_iov_req(sc, req, *prp_list, size, is_write, offset)) { - pci_nvme_status_genc(&status, - NVME_SC_DATA_TRANSFER_ERROR); + err = -1; goto out; } @@ -2456,10 +2461,10 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc, err = blockif_write(nvstore->ctx, &req->io_req); else err = blockif_read(nvstore->ctx, &req->io_req); - +out: if (err) pci_nvme_status_genc(&status, NVME_SC_DATA_TRANSFER_ERROR); -out: + return (status); }