<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: Ubuntu 22.04.5 LTS - OS/kernel version: Linux 6.8.0-52-generic - Architecture: x86_64 - QEMU flavor: qemu-system-ppc64 - QEMU version: QEMU 11.0.1 (2f28d34ea0aead9830478cd1d3d0dd9d9191d82e) - QEMU command line: ``` ./qemu-system-ppc64 -M pseries -nodefaults -device sm501,addr=06.0,x-pixman=0 -qtest stdio -qtest-log none -display none -monitor none -serial none ``` ## Emulated/Virtualized environment - Operating system: none (qtest reproducer) - OS/kernel version: none (qtest reproducer) - Architecture: powerpc64, pseries ## Description of problem Guest-triggerable host out-of-bounds write/read exists in the emulated SM501 2D engine. A guest with access to the SM501 MMIO registers can program rectangle geometry that wraps QEMU's VRAM bounds check, then start a 2D fill or blit and make QEMU access memory outside the allocated local VRAM buffer. This was reproduced with QEMU 11.0.1 (2f28d34ea0aead9830478cd1d3d0dd9d9191d82e) on Ubuntu 22.04.5 LTS with Linux 6.8.0-52-generic. The root cause is in `sm501_2d_operation()`. The destination bounds check computes the end of the requested rectangle with 32-bit arithmetic over guest-controlled destination base, x/y coordinates, width/height, pitch, and bytes-per-pixel values. This expression can wrap to a small value that passes the `get_local_mem_size(s)` check even though the true rectangle extent is outside the local VRAM allocation. `hw/display/sm501.c:730` ```c if (dst_base >= get_local_mem_size(s) || dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >= get_local_mem_size(s)) { qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n"); return; } ``` The later rendering paths reuse the accepted geometry to index into `s->local_mem`. For the rectangle-fill path, the fallback loop writes to `d[i]`, where `d` is `s->local_mem + dst_base` and `i` is derived from the same guest-controlled coordinates and pitch. The BitBlt path has the same source-rectangle bounds pattern and can later reach `memcpy()`, `memmove()`, `ldn_he_p()`, `stn_he_p()`, or pixman helpers using offsets based on the unchecked true extent. `hw/display/sm501.c:915` ```c uint8_t *d = s->local_mem + dst_base; unsigned int x, y, i; for (y = 0; y < height; y++) { i = (dst_x + (dst_y + y) * dst_pitch) * bypp; for (x = 0; x < width; x++, i += bypp) { stn_he_p(&d[i], bypp, color); } } ``` The vulnerable operation is reachable directly through the 2D engine MMIO write handler. Writing `SM501_2D_CONTROL` with the start bit set calls `sm501_2d_operation()`. `hw/display/sm501.c:1547` ```c case SM501_2D_CONTROL: s->twoD_control = value; /* do 2d operation if start flag is set. */ if (value & 0x80000000) { sm501_2d_operation(s); s->twoD_control &= ~0x80000000; /* start flag down */ } ``` One concrete wraparound shape is possible with the maximum 64 MiB local memory configuration: `dst_base = 0x03ffffff`, `dst_x = width = 0x1fff`, `dst_y = height = 0xffff`, `dst_pitch = 0x1fff`, and `bypp = 4`. The checked expression wraps from `0x103f7ffff` to `0x03f7ffff`, which is below 64 MiB and therefore passes the guard, but later per-row indices still reach far past the allocated VRAM buffer. ## Steps to reproduce 1. Build `qemu-system-ppc64` with ASan enabled and SM501/pseries support: ```sh ./configure --enable-asan --target-list="ppc64-softmmu" ``` 2. Run the following qtest reproducer from the QEMU build directory with ASAN/UBSAN reporting enabled, for example with `ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=1` and `UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1` in the environment: ```sh cat <<EOF | ./qemu-system-ppc64 -M pseries -nodefaults -device sm501,addr=06.0,x-pixman=0 -qtest stdio -qtest-log none -display none -monitor none -serial none writel 0x100000 0x00003010 writel 0x100004 0x08000000 writel 0x100008 0x20000000 writel 0x10000c 0x00000004 writel 0x100010 0x80000000 rtas ibm,write-pci-config 5 0x100000 1 0x100100 writel 0x100000 0x00003014 writel 0x100004 0x08000000 writel 0x100008 0x20000000 writel 0x10000c 0x00000004 writel 0x100010 0x84000000 rtas ibm,write-pci-config 5 0x100000 1 0x100100 writel 0x100000 0x00003004 writel 0x100004 0x08000000 writel 0x100008 0x20000000 writel 0x10000c 0x00000002 writel 0x100010 0x00000002 rtas ibm,write-pci-config 5 0x100000 1 0x100100 readl 0x200084100050 writel 0x200084100044 0xffffff03 writel 0x200084100004 0xffffff1f writel 0x200084100008 0xffffff1f writel 0x200084100010 0x0000ff1f writel 0x20008410001c 0x00002000 writel 0x200084100014 0x44434241 writel 0x20008410000c 0x00000180 EOF ``` 3. The reproducer uses RTAS to place the SM501 PCI BARs on pseries, enables PCI memory decoding, then programs the SM501 2D registers with a destination base near the end of 64 MiB VRAM and large rectangle geometry so the 32-bit destination-end check wraps below the VRAM size. The final write starts a rectangle fill through `SM501_2D_CONTROL`. ## Additional information ASan output: ```text AddressSanitizer:DEADLYSIGNAL ================================================================= ==5==ERROR: AddressSanitizer: SEGV on unknown address 0x721ecd7bffff (pc 0x6026bc854cb5 bp 0x00001fff0000 sp 0x7ffd97b134b0 T0) ==5==The signal is caused by a WRITE memory access. #0 0x6026bc854cb5 in stl_he_p /gbf2/qemu/include/qemu/bswap.h:284 #1 0x6026bc854cb5 in stn_he_p /gbf2/qemu/include/qemu/bswap.h:487 #2 0x6026bc854cb5 in sm501_2d_operation ../hw/display/sm501.c:920 #3 0x6026bc854cb5 in sm501_2d_engine_write ../hw/display/sm501.c:1552 #4 0x6026bccc3d39 in memory_region_write_accessor ../system/memory.c:492 #5 0x6026bccc93da in access_with_adjusted_size ../system/memory.c:568 #6 0x6026bcccbb6b in memory_region_dispatch_write ../system/memory.c:1555 #7 0x6026bcce1c09 in flatview_write_continue_step ../system/physmem.c:3263 #8 0x6026bcce2074 in flatview_write_continue ../system/physmem.c:3293 #9 0x6026bcce2074 in flatview_write ../system/physmem.c:3324 #10 0x6026bccea36b in address_space_write ../system/physmem.c:3444 #11 0x6026bccf7991 in qtest_process_command ../system/qtest.c:540 #12 0x6026bccfa52c in qtest_process_inbuf ../system/qtest.c:824 #13 0x6026bd2ac06c in fd_chr_read ../chardev/char-fd.c:72 #14 0x721eb4b3fc43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43) #15 0x6026bd47b977 in glib_pollfds_poll ../util/main-loop.c:290 #16 0x6026bd47b977 in os_host_main_loop_wait ../util/main-loop.c:313 #17 0x6026bd47b977 in main_loop_wait ../util/main-loop.c:592 #18 0x6026bccfdb40 in qemu_main_loop ../system/runstate.c:950 #19 0x6026bd2e2e5f in qemu_default_main ../system/main.c:50 #20 0x6026bc45dcf0 in main ../system/main.c:93 #21 0x721eb3629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #22 0x721eb3629e3f in __libc_start_main_impl ../csu/libc-start.c:392 #23 0x6026bc4634a4 in _start (/gbf2/qemu/build/qemu-system-ppc64+0xb1f4a4) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /gbf2/qemu/include/qemu/bswap.h:284 in stl_he_p ==5==ABORTING ``` Proposed patch: ```diff diff --git a/hw/display/sm501.c b/hw/display/sm501.c --- a/hw/display/sm501.c +++ b/hw/display/sm501.c @@ -682,6 +682,27 @@ static inline void hwc_invalidate(SM501State *s, int crt) get_fb_addr(s, crt) + start, end - start); } +static bool sm501_2d_rect_outside_vram(SM501State *s, uint32_t base, + unsigned int x, unsigned int y, + unsigned int width, + unsigned int height, + unsigned int pitch, unsigned int bypp) +{ + uint64_t offset; + uint64_t local_mem_size = get_local_mem_size(s); + + if (base >= local_mem_size) { + return true; + } + + offset = (uint64_t)x + width + ((uint64_t)y + height) * pitch; + if (offset > (UINT64_MAX - base) / bypp) { + return true; + } + + return base + offset * bypp >= local_mem_size; +} + static void sm501_2d_operation(SM501State *s) { int cmd = (s->twoD_control >> 16) & 0x1F; @@ -727,9 +748,8 @@ static void sm501_2d_operation(SM501State *s) dst_y -= height - 1; } - if (dst_base >= get_local_mem_size(s) || - dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >= - get_local_mem_size(s)) { + if (sm501_2d_rect_outside_vram(s, dst_base, dst_x, dst_y, width, height, + dst_pitch, bypp)) { qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n"); return; } @@ -752,9 +772,8 @@ static void sm501_2d_operation(SM501State *s) src_y -= height - 1; } - if (src_base >= get_local_mem_size(s) || - src_base + (src_x + width + (src_y + height) * src_pitch) * bypp >= - get_local_mem_size(s)) { + if (sm501_2d_rect_outside_vram(s, src_base, src_x, src_y, width, + height, src_pitch, bypp)) { qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op src is outside vram.\n"); return; ``` <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->