@@ -383,7 +383,12 @@ struct MemoryRegion {
RAMBlock *ram_block;
Object *owner;
- const MemoryRegionOps *ops;
+ /*
+ * XXX this must be 'const' but to counter side effects of
+ * CVE-2020-13754, make it non-const to allow monkey patching
+ * the access sizes. Only allowed for QEMU release v5.1 :(
+ */
+ MemoryRegionOps *ops;
void *opaque;
MemoryRegion *container;
Int128 size;
@@ -1218,7 +1218,7 @@ static void memory_region_initfn(Object *obj)
MemoryRegion *mr = MEMORY_REGION(obj);
ObjectProperty *op;
- mr->ops = &unassigned_mem_ops;
+ mr->ops = g_memdup(&unassigned_mem_ops, sizeof(MemoryRegionOps));
mr->enabled = true;
mr->romd_mode = true;
mr->global_locking = true;
@@ -1485,7 +1485,11 @@ void memory_region_init_io(MemoryRegion *mr,
uint64_t size)
{
memory_region_init(mr, owner, name, size);
- mr->ops = ops ? ops : &unassigned_mem_ops;
+ if (ops) {
+ mr->ops = g_memdup(ops, sizeof(MemoryRegionOps));
+ } else {
+ mr->ops = g_memdup(&unassigned_mem_ops, sizeof(MemoryRegionOps));
+ }
mr->opaque = opaque;
mr->terminates = true;
}
@@ -1622,7 +1626,7 @@ void memory_region_init_ram_device_ptr(MemoryRegion *mr,
mr->ram = true;
mr->terminates = true;
mr->ram_device = true;
- mr->ops = &ram_device_mem_ops;
+ mr->ops = g_memdup(&ram_device_mem_ops, sizeof(MemoryRegionOps));
mr->opaque = mr;
mr->destructor = memory_region_destructor_ram;
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
@@ -1664,7 +1668,7 @@ void memory_region_init_rom_device_nomigrate(MemoryRegion *mr,
Error *err = NULL;
assert(ops);
memory_region_init(mr, owner, name, size);
- mr->ops = ops;
+ mr->ops = g_memdup(ops, sizeof(MemoryRegionOps));
mr->opaque = opaque;
mr->terminates = true;
mr->rom_device = true;
To fixes CVE-2020-13754, commit 5d971f9e67 refuses mismatching sizes in memory_region_access_valid(). This gives troubles when a device is on an ISA bus, because the CPU is free to use 8/16-bit accesses on the bus (or up to 32-bit on EISA bus), regardless what range is valid for the device. To allow surgical change for the 5.1 release, allow monkey patching of the MemoryRegionOps (by making the MemoryRegion field not const). This should be reverted after the release and fixed in a more elegant manner. Fixes: 5d971f9e67 ('memory: Revert "accept mismatching sizes in memory_region_access_valid"') Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- include/exec/memory.h | 7 ++++++- softmmu/memory.c | 12 ++++++++---- 2 files changed, 14 insertions(+), 5 deletions(-)