From: Kevin Wolf <kwolf@redhat.com>

Date: Sun, 26 Jul 2015 23:42:53 -0400

Subject: [PATCH] ide: Check array bounds before writing to io_buffer

 (CVE-2015-5154)

If the end_transfer_func of a command is called because enough data has

been read or written for the current PIO transfer, and it fails to

correctly call the command completion functions, the DRQ bit in the

status register and s->end_transfer_func may remain set. This allows the

guest to access further bytes in s->io_buffer beyond s->data_end, and

eventually overflowing the io_buffer.

One case where this currently happens is emulation of the ATAPI command

START STOP UNIT.

This patch fixes the problem by adding explicit array bounds checks

before accessing the buffer instead of relying on end_transfer_func to

function correctly.

Cc: qemu-stable@nongnu.org

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Reviewed-by: John Snow <jsnow@redhat.com>

(cherry picked from commit d2ff85854512574e7209f295e87b0835d5b032c6)

---

 hw/ide/core.c | 16 ++++++++++++++++

 1 file changed, 16 insertions(+)

diff --git a/hw/ide/core.c b/hw/ide/core.c

index 50691fc..a5a62cd 100644

--- a/hw/ide/core.c

+++ b/hw/ide/core.c

@@ -1931,6 +1931,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)

     }

     p = s->data_ptr;

+    if (p + 2 > s->data_end) {

+        return;

+    }

+

     *(uint16_t *)p = le16_to_cpu(val);

     p += 2;

     s->data_ptr = p;

@@ -1952,6 +1956,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr)

     }

     p = s->data_ptr;

+    if (p + 2 > s->data_end) {

+        return 0;

+    }

+

     ret = cpu_to_le16(*(uint16_t *)p);

     p += 2;

     s->data_ptr = p;

@@ -1973,6 +1981,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)

     }

     p = s->data_ptr;

+    if (p + 4 > s->data_end) {

+        return;

+    }

+

     *(uint32_t *)p = le32_to_cpu(val);

     p += 4;

     s->data_ptr = p;

@@ -1994,6 +2006,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr)

     }

     p = s->data_ptr;

+    if (p + 4 > s->data_end) {

+        return 0;

+    }

+

     ret = cpu_to_le32(*(uint32_t *)p);

     p += 4;

     s->data_ptr = p;