From patchwork Mon Jun 17 13:46:40 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Woodhouse X-Patchwork-Id: 1948635 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; secure) header.d=infradead.org header.i=@infradead.org header.a=rsa-sha256 header.s=casper.20170209 header.b=h+oYwNOl; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4W2rmh2tfTz20Wg for ; Mon, 17 Jun 2024 23:47:48 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sJChC-0000wG-8Z; Mon, 17 Jun 2024 09:46:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sJChA-0000w2-2B for qemu-devel@nongnu.org; Mon, 17 Jun 2024 09:46:52 -0400 Received: from casper.infradead.org ([2001:8b0:10b:1236::1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sJCh7-00050W-Jk for qemu-devel@nongnu.org; Mon, 17 Jun 2024 09:46:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=MIME-Version:Content-Type:Date:Cc:To: From:Subject:Message-ID:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=AxU/85SH99KlJMySQ7g2tWnZPMLjvx/0SMavTnlcUTg=; b=h+oYwNOlShw/v+7qClMRb4lGjL 2ragtpING89pv0xFBJQ09b/7SeqvwhNwbR2/rdcf+7sgsm04PtA0SVyn1p8XCk0h2aEVKjCJd5Z8k 237avFmwLsqOqaesDKvoz7nRFVyfywBswg7PSPU3Apd3rHuTU756lqg6lsj4kLppQQCJUE4S1WLbD 8s3DSoTD3D9bJoq6avAgONlcA0IUA8h3IIFiKvqCweXkcMQNoetGfKnv/AzzhYFfajpDpJLz79z3l vKQ0XjR6xQOEiG5kvaLueQfxt7/iCGrgD69UmfO7OHSzpEb/KEPYlzuWOj8n4j7hi8OLUN3QVL59c RhHpsfWA==; Received: from [2001:8b0:10b:5:ba92:ab0d:7332:768] (helo=u3832b3a9db3152.ant.amazon.com) by casper.infradead.org with esmtpsa (Exim 4.97.1 #2 (Red Hat Linux)) id 1sJCgz-00000002Apj-0kVi; Mon, 17 Jun 2024 13:46:41 +0000 Message-ID: <3ce6d142356cb061b64d71a4e39525d9d7c52b12.camel@infradead.org> Subject: [PATCH] hw/i386/fw_cfg: Add etc/e820 to fw_cfg late From: David Woodhouse To: qemu-devel Cc: "Michael S. Tsirkin" , Marcel Apfelbaum , Paolo Bonzini , Richard Henderson , Eduardo Habkost , Sergio Lopez , Peter Maydell Date: Mon, 17 Jun 2024 14:46:40 +0100 User-Agent: Evolution 3.44.4-0ubuntu2 MIME-Version: 1.0 X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html Received-SPF: none client-ip=2001:8b0:10b:1236::1; envelope-from=BATV+5b424705a315da09b086+7603+infradead.org+dwmw2@casper.srs.infradead.org; helo=casper.infradead.org X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: David Woodhouse In e820_add_entry() the e820_table is reallocated with g_renew() to make space for a new entry. However, fw_cfg_arch_create() just uses the existing e820_table pointer. This leads to a use-after-free if anything adds a new entry after fw_cfg is set up. Shift the addition of the etc/e820 file to the machine done notifier, and add a sanity check to ensure that e820_table isn't modified after the pointer gets stashed. Signed-off-by: David Woodhouse --- hw/i386/e820_memory_layout.c | 8 ++++++++ hw/i386/fw_cfg.c | 7 ++++--- hw/i386/microvm.c | 5 +++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/hw/i386/e820_memory_layout.c b/hw/i386/e820_memory_layout.c index 06970ac44a..c96515909e 100644 --- a/hw/i386/e820_memory_layout.c +++ b/hw/i386/e820_memory_layout.c @@ -8,13 +8,20 @@ #include "qemu/osdep.h" #include "qemu/bswap.h" +#include "qemu/error-report.h" #include "e820_memory_layout.h" static size_t e820_entries; struct e820_entry *e820_table; +static gboolean e820_done; int e820_add_entry(uint64_t address, uint64_t length, uint32_t type) { + if (e820_done) { + warn_report("warning: E820 modified after being consumed"); + return -1; + } + /* new "etc/e820" file -- include ram and reserved entries */ e820_table = g_renew(struct e820_entry, e820_table, e820_entries + 1); e820_table[e820_entries].address = cpu_to_le64(address); @@ -27,6 +34,7 @@ int e820_add_entry(uint64_t address, uint64_t length, uint32_t type) int e820_get_num_entries(void) { + e820_done = true; return e820_entries; } diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c index 6e0d9945d0..e046ad1a54 100644 --- a/hw/i386/fw_cfg.c +++ b/hw/i386/fw_cfg.c @@ -102,6 +102,10 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg, smbios_anchor, smbios_anchor_len); } #endif + + /* Add etc/e820 late, once all regions should be present */ + fw_cfg_add_file(fw_cfg, "etc/e820", e820_table, + sizeof(struct e820_entry) * e820_get_num_entries()); } FWCfgState *fw_cfg_arch_create(MachineState *ms, @@ -139,9 +143,6 @@ FWCfgState *fw_cfg_arch_create(MachineState *ms, #endif fw_cfg_add_i32(fw_cfg, FW_CFG_IRQ0_OVERRIDE, 1); - fw_cfg_add_file(fw_cfg, "etc/e820", e820_table, - sizeof(struct e820_entry) * e820_get_num_entries()); - fw_cfg_add_bytes(fw_cfg, FW_CFG_HPET, &hpet_cfg, sizeof(hpet_cfg)); /* allocate memory for the NUMA channel: one (64bit) word for the number * of nodes, one word for each VCPU->node and one word for each node to diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c index fec63cacfa..89b2abcebf 100644 --- a/hw/i386/microvm.c +++ b/hw/i386/microvm.c @@ -324,8 +324,6 @@ static void microvm_memory_init(MicrovmMachineState *mms) fw_cfg_add_i16(fw_cfg, FW_CFG_MAX_CPUS, machine->smp.max_cpus); fw_cfg_add_i64(fw_cfg, FW_CFG_RAM_SIZE, (uint64_t)machine->ram_size); fw_cfg_add_i32(fw_cfg, FW_CFG_IRQ0_OVERRIDE, 1); - fw_cfg_add_file(fw_cfg, "etc/e820", e820_table, - sizeof(struct e820_entry) * e820_get_num_entries()); rom_set_fw(fw_cfg); @@ -586,9 +584,12 @@ static void microvm_machine_done(Notifier *notifier, void *data) { MicrovmMachineState *mms = container_of(notifier, MicrovmMachineState, machine_done); + X86MachineState *x86ms = X86_MACHINE(mms); acpi_setup_microvm(mms); dt_setup_microvm(mms); + fw_cfg_add_file(x86ms->fw_cfg, "etc/e820", e820_table, + sizeof(struct e820_entry) * e820_get_num_entries()); } static void microvm_powerdown_req(Notifier *notifier, void *data)