[0/3] hw/sd/sdhci: Fix DMA re-entrancy issue

Message

Philippe Mathieu-Daudé Dec. 15, 2021, 8:55 p.m. UTC

Hi,

This series is an attempt to fix the DMA re-entrancy problem
on the SDHCI device. OSS-Fuzz found it and Alexander generated
a helpful reproducer.

By setting the MemTxAttrs::memory bit before doing DMA transactions,
the flatview API will return MEMTX_BUS_ERROR if the transaction
targets a non-memory (a device), which is usually how DMA-reentrancy
bugs are exploited.

On real hardware, the checks are on the interconnect bus, not in
the SDHCI block. However QEMU blocks aren't modelled that way.
Using the flatview API seems (to me) the simplest and closer
to hardware, it is a generic API and we can use it to trace
bus transactions on all blocks.

Note this series is simply one example to fix the generic
issues. The important changes are in the previous series:
https://lore.kernel.org/qemu-devel/[e-mail]/
Based-on: <[e-mail]>
"physmem: Have flatview API check bus permission from MemTxAttrs"

Cc: Mauro Matteo Cascella <[e-mail]>
Cc: Qiuhao Li <[e-mail]>
Cc: Peter Xu <[e-mail]>
Cc: Jason Wang <[e-mail]>
Cc: David Hildenbrand <[e-mail]>
Cc: Gerd Hoffmann <[e-mail]>
Cc: Peter Maydell <[e-mail]>
Cc: Li Qiang <[e-mail]>
Cc: Thomas Huth <[e-mail]>
Cc: Laurent Vivier <[e-mail]>
Cc: Bandan Das <[e-mail]>
Cc: Edgar E. Iglesias <[e-mail]>
Cc: Darren Kenny <[e-mail]>
Cc: Bin Meng <[e-mail]>
Cc: Paolo Bonzini <[e-mail]>
Cc: Alexander Bulekov <[e-mail]>
Cc: Stefan Hajnoczi <[e-mail]>

Philippe Mathieu-Daudé (3):
  hw/sd/sdhci: Honor failed DMA transactions
  hw/sd/sdhci: Prohibit DMA accesses to devices
  tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue
    29225)

 hw/sd/sdhci.c                  | 35 ++++++++++++----
 tests/qtest/fuzz-sdcard-test.c | 76 ++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+), 9 deletions(-)

Comments

Philippe Mathieu-Daudé Dec. 15, 2021, 8:56 p.m. UTC | #1

On 12/15/21 21:55, Philippe Mathieu-Daudé wrote:
> Hi,
> 
> This series is an attempt to fix the DMA re-entrancy problem
> on the SDHCI device. OSS-Fuzz found it and Alexander generated
> a helpful reproducer.
> 
> By setting the MemTxAttrs::memory bit before doing DMA transactions,
> the flatview API will return MEMTX_BUS_ERROR if the transaction
> targets a non-memory (a device), which is usually how DMA-reentrancy
> bugs are exploited.
> 
> On real hardware, the checks are on the interconnect bus, not in
> the SDHCI block. However QEMU blocks aren't modelled that way.
> Using the flatview API seems (to me) the simplest and closer
> to hardware, it is a generic API and we can use it to trace
> bus transactions on all blocks.
> 
> Note this series is simply one example to fix the generic
> issues. The important changes are in the previous series:
> https://lore.kernel.org/qemu-devel/[e-mail]/
> Based-on: <[e-mail]>
> "physmem: Have flatview API check bus permission from MemTxAttrs"

Please disregard this cover, I forgot to post as RFC...