i2c: pm_smbus: check smb_index before block transfer write
authorPrasad J Pandit <pjp@fedoraproject.org>
Thu, 6 Dec 2018 12:18:30 +0000 (17:48 +0530)
committerPeter Maydell <peter.maydell@linaro.org>
Thu, 6 Dec 2018 15:51:57 +0000 (15:51 +0000)
commitf2609ffdf39bcd4f89b5f67b33347490023a7a84
treeb94cee05963faa9b5c705b9637bf71438a459dab
parent80422b00196a7af4c6efb628fae0ad8b644e98af
i2c: pm_smbus: check smb_index before block transfer write

While performing block transfer write in smb_ioport_writeb(),
'smb_index' is incremented and used to index smb_data[] array.
Check 'smb_index' value to avoid OOB access.

Note that this bug is exploitable by a guest to escape
from the virtual machine. However the commit which
introduced the bug was only made after the 3.0 release,
and so it is not present in any released QEMU versions.

Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20181206121830.6177-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/i2c/pm_smbus.c