From nobody Tue Aug 1 20:03:31 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RFmJV06kxz4pnvL; Tue, 1 Aug 2023 20:03:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RFmJN2n07z3GC1; Tue, 1 Aug 2023 20:03:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690920212; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZlJtYqbtpmzYNIUjVhLSVcXk4OJPl/1KGhJpmYB7CO4=; b=uSONyW0SMheKddQZwrMLaB6KRLQ+be/x51UPhk/ybeJsFSLIeUH9v5eS2nG2oLSUEkeG4O NWsmJfVPAdieIFdUG9MQbVuZ+IJ8KfDKiA/Idwps7yOQfGHTpJ7uN9VODnbNlZ9jrSUBJU XSNZVg+wNJTV4YKPxHX2yZhbiutTaf46FnyeKRclIQP6kke5b4EFbQrd2vOl68w//Qt7JY Ss9VPoowPjjtZ6//EsmS/QiMiScUSxuddoRX4QsXiHj43NJxmc0U9YiaLRuRtJZtqI3W9w dDcNbiMkkWNGWeX6D5nCQB1Qv1aGyBGLO8kU4p03QY+7N1vXLp+V5Q9pKrWe/g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1690920212; a=rsa-sha256; cv=none; b=Voa/lwars3421EwAH/Fj8GzgEVidh5VWRUUDpEa6sA1EMmhk1Q2Qa63y7PBm1rKeDbOYKs VOEoQlKboOxgm4WQXmloUwTBike1Q588Ze5j9s5QRIXvWSvP+9UTnP55GfeO4he2dECbR/ ltHcUGmlH0ZEDjP+lfAF+0tKxubJOZAIYYGBVU10F7kW0qJGW5AUhQLpjgTEmZL8lwvUtp qRWvluB/oFoPHmYttwD/qfCP86art7s/Te12gWrrsYvMhhG6UwPen8En1XxQTSzSMZRYVa Suc2S9H/1k6HXf8Y2JKasxMQ9+u2qs3UoKIrh+9YFoLoLig8+xRhWW8/BH13+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690920212; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZlJtYqbtpmzYNIUjVhLSVcXk4OJPl/1KGhJpmYB7CO4=; b=As9bgK0MJi6ITfxEt34NmH/l3x4BaUOzMwKl2Qs2rmdx5lJV38XjCWUQdSLQlcy583KGJt 4504LpkQ3hkIB0N4ZGObpS9v1Wur9BcIUuj5PW6HiIJLY/lDxQ0r+DT1BRfDp6odCq1yis DBFboSz1njtaseNyq0Y0vs7VS7QcCn7ADDZuSfPMvyRgfctK2/OWv61iAsBJgyKppo3zsQ YitDWlFWXvLsLEcFYcb60NOKtH6XcSNxwg1avWb+E/NdkFtAkWvgQhrFPhHFWdodRozIQB 5Ckl2JFacCTJBfvo0hnEeNzId5bqJVCLzoJaQTqvQUHiVXiGziQSWTU7Lh8i/w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RFmJN1Fv7zqvL; Tue, 1 Aug 2023 20:03:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 371K3VcQ012648; Tue, 1 Aug 2023 20:03:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 371K3VSo012647; Tue, 1 Aug 2023 20:03:31 GMT (envelope-from git) Date: Tue, 1 Aug 2023 20:03:31 GMT Message-Id: <202308012003.371K3VSo012647@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: bed3ae1d7863 - main - bhyve: Fully reset the fwctl state machine if the guest requests a reset. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bed3ae1d7863ac1e0b1e82ae7bf952937e921efe Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=bed3ae1d7863ac1e0b1e82ae7bf952937e921efe commit bed3ae1d7863ac1e0b1e82ae7bf952937e921efe Author: John Baldwin AuthorDate: 2023-06-29 18:27:12 +0000 Commit: Mark Johnston CommitDate: 2023-08-01 19:45:41 +0000 bhyve: Fully reset the fwctl state machine if the guest requests a reset. If a guest tries to reset the fwctl device while a pending request was in flight, the fwctl state machine can be left in an incomplete state. Specifically, rinfo is not cleared. Normally the state machine for fwctl alternates between REQ (receiving request) and RESP (sending response) and ignores port writes while in RESP or port reads while in REQ. Once a guest completes the writes to the port to send a request, the state machine transitions to RESP and ignores future writes. However, if a guest writes a full request and then resets the fwctl device, the state would transition to REQ without draining the pending response or discarding the received request. Instead, additional port writes after the reset were treated as new payload bytes, but were appended to the previously-received request and could overflow the fget_str buffer. To fix, fully reset the fwctl state machine if the guest requests a reset. admbugs: 998 Approved by: so Reviewed by: markj Reported by: Omri Ben Bassat Security: FreeBSD-SA-23:07.bhyve Security: CVE-2023-3494 --- usr.sbin/bhyve/fwctl.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/usr.sbin/bhyve/fwctl.c b/usr.sbin/bhyve/fwctl.c index 5227c06f0da7..24fedfab8885 100644 --- a/usr.sbin/bhyve/fwctl.c +++ b/usr.sbin/bhyve/fwctl.c @@ -67,12 +67,11 @@ __FBSDID("$FreeBSD$"); * Back-end state-machine */ static enum state { - DORMANT, IDENT_WAIT, IDENT_SEND, REQ, RESP -} be_state = DORMANT; +} be_state; static uint8_t sig[] = { 'B', 'H', 'Y', 'V' }; static u_int ident_idx; @@ -200,6 +199,7 @@ static void fget_data(uint32_t data, uint32_t len __unused) { + assert(fget_cnt + sizeof(uint32_t) <= sizeof(fget_str)); memcpy(&fget_str[fget_cnt], &data, sizeof(data)); fget_cnt += sizeof(uint32_t); } @@ -344,7 +344,8 @@ static int fwctl_request_data(uint32_t value) { - /* Make sure remaining size is >= 0 */ + /* Make sure remaining size is > 0 */ + assert(rinfo.req_size > 0); if (rinfo.req_size <= sizeof(uint32_t)) rinfo.req_size = 0; else @@ -441,6 +442,28 @@ fwctl_response(uint32_t *retval) return (0); } +static void +fwctl_reset(void) +{ + + switch (be_state) { + case RESP: + /* If a response was generated but not fully read, discard it. */ + fwctl_response_done(); + break; + case REQ: + /* Discard partially-received request. */ + memset(&rinfo, 0, sizeof(rinfo)); + break; + case IDENT_WAIT: + case IDENT_SEND: + break; + } + + be_state = IDENT_SEND; + ident_idx = 0; +} + /* * i/o port handling. @@ -468,18 +491,13 @@ fwctl_inb(void) static void fwctl_outw(uint16_t val) { - if (be_state == DORMANT) { - return; - } - if (val == 0) { /* * The guest wants to read the signature. It's possible that the * guest is unaware of the fwctl state at this moment. For that * reason, reset the state machine unconditionally. */ - be_state = IDENT_SEND; - ident_idx = 0; + fwctl_reset(); } }