141 lines
6.9 KiB
Diff
141 lines
6.9 KiB
Diff
|
References: bsc#965156 CVE-2015-6855
|
||
|
|
|
||
|
|
Subject: ide: fix ATAPI command permissions
|
||
|
|
From: John Snow jsnow@redhat.com Thu Sep 17 14:17:05 2015 -0400
|
||
|
|
Date: Fri Sep 18 10:58:56 2015 -0400:
|
||
|
|
Git: d9033e1d3aa666c5071580617a57bd853c5d794a
|
||
|
|
|
||
|
|
We're a little too lenient with what we'll let an ATAPI drive handle.
|
||
|
|
Clamp down on the IDE command execution table to remove CD_OK permissions
|
||
|
|
from commands that are not and have never been ATAPI commands.
|
||
|
|
|
||
|
|
For ATAPI command validity, please see:
|
||
|
|
- ATA4 Section 6.5 ("PACKET Command feature set")
|
||
|
|
- ATA8/ACS Section 4.3 ("The PACKET feature set")
|
||
|
|
- ACS3 Section 4.3 ("The PACKET feature set")
|
||
|
|
|
||
|
|
ACS3 has a historical command validity table in Table B.4
|
||
|
|
("Historical Command Assignments") that can be referenced to find when
|
||
|
|
a command was introduced, deprecated, obsoleted, etc.
|
||
|
|
|
||
|
|
The only reference for ATAPI command validity is by checking that
|
||
|
|
version's PACKET feature set section.
|
||
|
|
|
||
|
|
ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
|
||
|
|
therefore are assumed to have never been ATAPI commands.
|
||
|
|
|
||
|
|
Mandatory commands, as listed in ATA8-ACS3, are:
|
||
|
|
|
||
|
|
- DEVICE RESET
|
||
|
|
- EXECUTE DEVICE DIAGNOSTIC
|
||
|
|
- IDENTIFY DEVICE
|
||
|
|
- IDENTIFY PACKET DEVICE
|
||
|
|
- NOP
|
||
|
|
- PACKET
|
||
|
|
- READ SECTOR(S)
|
||
|
|
- SET FEATURES
|
||
|
|
|
||
|
|
Optional commands as listed in ATA8-ACS3, are:
|
||
|
|
|
||
|
|
- FLUSH CACHE
|
||
|
|
- READ LOG DMA EXT
|
||
|
|
- READ LOG EXT
|
||
|
|
- WRITE LOG DMA EXT
|
||
|
|
- WRITE LOG EXT
|
||
|
|
|
||
|
|
All other commands are illegal to send to an ATAPI device and should
|
||
|
|
be rejected by the device.
|
||
|
|
|
||
|
|
CD_OK removal justifications:
|
||
|
|
|
||
|
|
0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI.
|
||
|
|
0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4.
|
||
|
|
0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI.
|
||
|
|
0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
|
||
|
|
0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.
|
||
|
|
|
||
|
|
This patch fixes a divide by zero fault that can be caused by sending
|
||
|
|
the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
|
||
|
|
attempt to use zeroed CHS values to perform sector arithmetic.
|
||
|
|
|
||
|
|
Reported-by: Qinghao Tang <luodalongde@gmail.com>
|
||
|
|
Signed-off-by: John Snow <jsnow@redhat.com>
|
||
|
|
Reviewed-by: Markus Armbruster <armbru@redhat.com>
|
||
|
|
Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
|
||
|
|
CC: qemu-stable@nongnu.org
|
||
|
|
|
||
|
|
Index: xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/ide/core.c
|
||
|
|
===================================================================
|
||
|
|
--- xen-4.6.0-testing.orig/tools/qemu-xen-dir-remote/hw/ide/core.c
|
||
|
|
+++ xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/ide/core.c
|
||
|
|
@@ -1739,11 +1739,11 @@ static const struct {
|
||
|
|
} ide_cmd_table[0x100] = {
|
||
|
|
/* NOP not implemented, mandatory for CD */
|
||
|
|
[CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK },
|
||
|
|
- [WIN_DSM] = { cmd_data_set_management, ALL_OK },
|
||
|
|
+ [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK },
|
||
|
|
[WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK },
|
||
|
|
[WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC},
|
||
|
|
[WIN_READ] = { cmd_read_pio, ALL_OK },
|
||
|
|
- [WIN_READ_ONCE] = { cmd_read_pio, ALL_OK },
|
||
|
|
+ [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK },
|
||
|
|
[WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK },
|
||
|
|
[WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK },
|
||
|
|
[WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
|
||
|
|
@@ -1762,12 +1762,12 @@ static const struct {
|
||
|
|
[CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK },
|
||
|
|
[WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK },
|
||
|
|
[WIN_SPECIFY] = { cmd_nop, HD_CFA_OK | SET_DSC },
|
||
|
|
- [WIN_STANDBYNOW2] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_IDLEIMMEDIATE2] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_STANDBY2] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_SETIDLE2] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, ALL_OK | SET_DSC },
|
||
|
|
- [WIN_SLEEPNOW2] = { cmd_nop, ALL_OK },
|
||
|
|
+ [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
|
||
|
|
+ [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK },
|
||
|
|
[WIN_PACKETCMD] = { cmd_packet, CD_OK },
|
||
|
|
[WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK },
|
||
|
|
[WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC },
|
||
|
|
@@ -1781,19 +1781,19 @@ static const struct {
|
||
|
|
[WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK },
|
||
|
|
[WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK },
|
||
|
|
[CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK },
|
||
|
|
- [WIN_STANDBYNOW1] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_IDLEIMMEDIATE] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_STANDBY] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_SETIDLE1] = { cmd_nop, ALL_OK },
|
||
|
|
- [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, ALL_OK | SET_DSC },
|
||
|
|
- [WIN_SLEEPNOW1] = { cmd_nop, ALL_OK },
|
||
|
|
+ [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_STANDBY] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK },
|
||
|
|
+ [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
|
||
|
|
+ [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK },
|
||
|
|
[WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK },
|
||
|
|
[WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK },
|
||
|
|
[WIN_IDENTIFY] = { cmd_identify, ALL_OK },
|
||
|
|
[WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC },
|
||
|
|
[IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
|
||
|
|
[CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
|
||
|
|
- [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, ALL_OK | SET_DSC },
|
||
|
|
+ [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
|
||
|
|
};
|
||
|
|
|
||
|
|
static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
|