Qemu重入漏洞梳理 & CVE-2024-3446分析

struct QEMUBH {    AioContext *ctx;    // 下半部所在的context（qemu_aio_context）    const char *name;    QEMUBHFunc *cb;    // 下半部要执行的函数    void *opaque;        // 函数参数    QSLIST_ENTRY(QEMUBH) next;    // 下一个要执行的下半部    unsigned flags;        // 调用qemu_bh_schedule后赋值为BH_PENDING | BH_SCHEDULED，使用后变为0    MemReentrancyGuard *reentrancy_guard;    // 新增防护重入};

static void bh_test_cb(void *opaque){    bhtestState *obj = opaque;    print_timestamp_ms();    qemu_bh_schedule(obj->bh);}static void pci_bhtest_realize(PCIDevice *pdev, Error **errp){    bhtestState *obj = DO_UPCAST(bhtestState, pdev, pdev);    // 初始化    obj->bh = qemu_bh_new(bh_test_cb, obj);    // 激活    qemu_bh_schedule(obj->bh);}

static void timer_cb(void *opaque){    mmiotestState *obj = opaque;    printf("in timer_cbn");}static void pci_mmiotest_realize(PCIDevice *pdev, Error **errp){    mmiotestState *obj = DO_UPCAST(mmiotestState, pdev, pdev);    // 初始化    obj->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, timer_cb, obj);}

timer_mod(obj->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));

static const MemoryRegionOps mmiotest_mmio_ops = {    .read = mmiotest_mmio_read,    .write = mmiotest_mmio_write,    .endianness = DEVICE_NATIVE_ENDIAN,        .valid = {        .min_access_size = 1,        .max_access_size = 8,    },    .impl = {        .min_access_size = 1,        .max_access_size = 8,    },};static void pci_mmiotest_realize(PCIDevice *pdev, Error **errp){    mmiotestState *obj = DO_UPCAST(mmiotestState, pdev, pdev);    memory_region_init_io(&obj->mmio, OBJECT(obj), &mmiotest_mmio_ops, obj, "mmiotest-mmio",0x100);    pci_register_bar(pdev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &obj->mmio);}

#0  0x0000555555a3d6c7 in mr_mmio_write (opaque=0x555557779930, addr=3840, val=0, size=8) at ../hw/pci/mr.c:132#1  0x0000555555bf58c3 in memory_region_write_accessor (mr=0x55555777a2a0, addr=3840, value=0x7ffff6acfdf8, size=8, shift=0, mask=18446744073709551615, attrs=...) at ../softmmu/memory.c:492#2  0x0000555555bf5b11 in access_with_adjusted_size (addr=3840, value=0x7ffff6acfdf8, size=8, access_size_min=1, access_size_max=8, access_fn=0x555555bf57c9 <memory_region_write_accessor>, mr=0x55555777a2a0, attrs=...) at ../softmmu/memory.c:554#3  0x0000555555bf8c0f in memory_region_dispatch_write (mr=0x55555777a2a0, addr=3840, data=0, op=MO_64, attrs=...) at ../softmmu/memory.c:1504#4  0x0000555555beb934 in flatview_write_continue (fv=0x7fff302b57c0, addr=4273938176, attrs=..., ptr=0x55555777a500, len=8, addr1=3840, l=8, mr=0x55555777a2a0) at ../softmmu/physmem.c:2782#5  0x0000555555beba7d in flatview_write (fv=0x7fff302b57c0, addr=4273938176, attrs=..., buf=0x55555777a500, len=8) at ../softmmu/physmem.c:2822#6  0x0000555555bebdf7 in address_space_write (as=0x555556768ec0 <address_space_memory>, addr=4273938176, attrs=..., buf=0x55555777a500, len=8) at ../softmmu/physmem.c:2914#7  0x0000555555bebe68 in address_space_rw (as=0x555556768ec0 <address_space_memory>, addr=4273938176, attrs=..., buf=0x55555777a500, len=8, is_write=true) at ../softmmu/physmem.c:2924#8  0x0000555555bebed6 in cpu_physical_memory_rw (addr=4273938176, buf=0x55555777a500, len=8, is_write=true) at ../softmmu/physmem.c:2933#9  0x0000555555a3d167 in cpu_physical_memory_write (addr=4273938176, buf=0x55555777a500, len=8) at /home/test/Desktop/qemu-6.2.0/include/exec/cpu-common.h:82#10 0x0000555555a3d5c2 in mr_mmio_write (opaque=0x555557779930, addr=3840, val=313778176, size=8) at ../hw/pci/mr.c:117#11 0x0000555555bf58c3 in memory_region_write_accessor (mr=0x55555777a2a0, addr=3840, value=0x7ffff6ad0148, size=8, shift=0, mask=18446744073709551615, attrs=...) at ../softmmu/memory.c:492#12 0x0000555555bf5b11 in access_with_adjusted_size (addr=3840, value=0x7ffff6ad0148, size=8, access_size_min=1, access_size_max=8, access_fn=0x555555bf57c9 <memory_region_write_accessor>, mr=0x55555777a2a0, attrs=...) at ../softmmu/memory.c:554#13 0x0000555555bf8c0f in memory_region_dispatch_write (mr=0x55555777a2a0, addr=3840, data=313778176, op=MO_64, attrs=...) at ../softmmu/memory.c:1504#14 0x0000555555d30f75 in io_writex (env=0x555556a49410, iotlbentry=0x7fff307ba9a0, mmu_idx=1, val=313778176, addr=140444038311680, retaddr=140735287403492, op=MO_64) at ../accel/tcg/cputlb.c:1420#15 0x0000555555d33592 in store_helper (env=0x555556a49410, addr=140444038311680, val=313778176, oi=49, retaddr=140735287403492, op=MO_64) at ../accel/tcg/cputlb.c:2355#16 0x0000555555d33a2e in helper_le_stq_mmu (env=0x555556a49410, addr=140444038311680, val=313778176, oi=49, retaddr=140735287403492) at ../accel/tcg/cputlb.c:2469#17 0x00007fff7cd023e4 in code_gen_buffer ()#18 0x0000555555d1e243 in cpu_tb_exec (cpu=0x555556a40b60, itb=0x7fffba817180, tb_exit=0x7ffff6ad0864) at ../accel/tcg/cpu-exec.c:357#19 0x0000555555d1f108 in cpu_loop_exec_tb (cpu=0x555556a40b60, tb=0x7fffba817180, last_tb=0x7ffff6ad0870, tb_exit=0x7ffff6ad0864) at ../accel/tcg/cpu-exec.c:842#20 0x0000555555d1f4c6 in cpu_exec (cpu=0x555556a40b60) at ../accel/tcg/cpu-exec.c:1001#21 0x0000555555d41bea in tcg_cpus_exec (cpu=0x555556a40b60) at ../accel/tcg/tcg-accel-ops.c:67#22 0x0000555555d41f7a in mttcg_cpu_thread_fn (arg=0x555556a40b60) at ../accel/tcg/tcg-accel-ops-mttcg.c:95#23 0x0000555555efd63b in qemu_thread_start (args=0x555556a60820) at ../util/qemu-thread-posix.c:556#24 0x00007ffff7938609 in start_thread () from target:/lib/x86_64-linux-gnu/libpthread.so.0#25 0x00007ffff785d353 in clone () from target:/lib/x86_64-linux-gnu/libc.so.6

static MemTxResult access_with_adjusted_size(hwaddr addr,                                      uint64_t *value,                                      unsigned size,                                      unsigned access_size_min,                                      unsigned access_size_max,                                      MemTxResult (*access_fn)                                                  (MemoryRegion *mr,                                                   hwaddr addr,                                                   uint64_t *value,                                                   unsigned size,                                                   signed shift,                                                   uint64_t mask,                                                   MemTxAttrs attrs),                                      MemoryRegion *mr,                                      MemTxAttrs attrs){    uint64_t access_mask;    unsigned access_size;    unsigned i;    MemTxResult r = MEMTX_OK;    bool reentrancy_guard_applied = false;    if (!access_size_min) {        access_size_min = 1;    }    if (!access_size_max) {        access_size_max = 4;    }    /* Do not allow more than one simultaneous access to a device's IO Regions */    if (mr->dev && !mr->disable_reentrancy_guard &&        !mr->ram_device && !mr->ram && !mr->rom_device && !mr->readonly) {        if (mr->dev->mem_reentrancy_guard.engaged_in_io) {            warn_report_once("Blocked re-entrant IO on MemoryRegion: "                             "%s at addr: 0x%" HWADDR_PRIX,                             memory_region_name(mr), addr);            return MEMTX_ACCESS_ERROR;        }        mr->dev->mem_reentrancy_guard.engaged_in_io = true;        reentrancy_guard_applied = true;    }    /* FIXME: support unaligned access? */    access_size = MAX(MIN(size, access_size_max), access_size_min);    access_mask = MAKE_64BIT_MASK(0, access_size * 8);    if (memory_region_big_endian(mr)) {        for (i = 0; i < size; i += access_size) {            r |= access_fn(mr, addr + i, value, access_size,                        (size - access_size - i) * 8, access_mask, attrs);        }    } else {        for (i = 0; i < size; i += access_size) {            r |= access_fn(mr, addr + i, value, access_size, i * 8,                        access_mask, attrs);        }    }    if (mr->dev && reentrancy_guard_applied) {        mr->dev->mem_reentrancy_guard.engaged_in_io = false;    }    return r;}

void aio_bh_call(QEMUBH *bh){    bool last_engaged_in_io = false;    /* Make a copy of the guard-pointer as cb may free the bh */    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;    if (reentrancy_guard) {        last_engaged_in_io = reentrancy_guard->engaged_in_io;        if (reentrancy_guard->engaged_in_io) {            trace_reentrant_aio(bh->ctx, bh->name);        }        reentrancy_guard->engaged_in_io = true;    }    bh->cb(bh->opaque);    if (reentrancy_guard) {        reentrancy_guard->engaged_in_io = last_engaged_in_io;    }}

1. xen9pfs2. virtio-blk3. xen-block4. virtio-serial-bus5. qxl6. virtio-gpu7. ahci8. imx_rngc9. mac_dbdma10. virtio-net11. nvme12. scsi/*13. usb/*14. virtio-balloon15. virtio-crypto

#define aio_bh_new_guarded(ctx, cb, opaque, guard)     aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,                         MemReentrancyGuard *reentrancy_guard){    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,                           reentrancy_guard);}QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,                        const char *name, MemReentrancyGuard *reentrancy_guard){    QEMUBH *bh;    bh = g_new(QEMUBH, 1);    *bh = (QEMUBH){        .ctx = ctx,        .cb = cb,        .opaque = opaque,        .name = name,        .reentrancy_guard = reentrancy_guard,    };    return bh;}QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev,                                   QEMUBHFunc *cb, void *opaque,                                   const char *name){    DeviceState *transport = qdev_get_parent_bus(dev)->parent;    return qemu_bh_new_full(cb, opaque, name,                            &transport->mem_reentrancy_guard);}

QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev,                                   QEMUBHFunc *cb, void *opaque,                                   const char *name){    // dev->parent_bus->parent(virtio-xx-pci)    DeviceState *transport = qdev_get_parent_bus(dev)->parent;    return qemu_bh_new_full(cb, opaque, name,                            &transport->mem_reentrancy_guard);}

static void virtio_pci_device_plugged(DeviceState *d, Error **errp){    VirtIOPCIProxy *proxy = VIRTIO_PCI(d);    VirtioBusState *bus = &proxy->bus;    bool legacy = virtio_pci_legacy(proxy);    bool modern;    bool modern_pio = proxy->flags & VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY;    uint8_t *config;    uint32_t size;    VirtIODevice *vdev = virtio_bus_get_device(bus);    ...        virtio_pci_modern_regions_init(proxy, vdev->name);        virtio_pci_modern_mem_region_map(proxy, &proxy->common, &cap);        virtio_pci_modern_mem_region_map(proxy, &proxy->isr, &cap);        virtio_pci_modern_mem_region_map(proxy, &proxy->device, &cap);        virtio_pci_modern_mem_region_map(proxy, &proxy->notify, &notify.cap);    ....}static void virtio_pci_modern_regions_init(VirtIOPCIProxy *proxy,                                           const char *vdev_name){    ...    g_string_printf(name, "virtio-pci-common-%s", vdev_name);    memory_region_init_io(&proxy->common.mr, OBJECT(proxy),                          &common_ops,                          proxy,                          name->str,                          proxy->common.size);    g_string_printf(name, "virtio-pci-isr-%s", vdev_name);    memory_region_init_io(&proxy->isr.mr, OBJECT(proxy),                          &isr_ops,                          proxy,                          name->str,                          proxy->isr.size);    g_string_printf(name, "virtio-pci-device-%s", vdev_name);    memory_region_init_io(&proxy->device.mr, OBJECT(proxy),                          &device_ops,                          proxy,                          name->str,                          proxy->device.size);    g_string_printf(name, "virtio-pci-notify-%s", vdev_name);    memory_region_init_io(&proxy->notify.mr, OBJECT(proxy),                          &notify_ops,                          proxy,                          name->str,                          proxy->notify.size);    g_string_printf(name, "virtio-pci-notify-pio-%s", vdev_name);    memory_region_init_io(&proxy->notify_pio.mr, OBJECT(proxy),                          &notify_pio_ops,                          proxy,                          name->str,                          proxy->notify_pio.size);}

/*** @kind path-problem*/class MMIOFn extends Function {  MMIOFn() {    exists(GlobalVariable gv |    gv.getFile().getAbsolutePath().regexpMatch(".*qemu-6.1.0/hw/.*") and    gv.getType().getName().regexpMatch(".*MemoryRegionOps.*") and    gv.getName().regexpMatch(".*mmio.*") and    gv.getInitializer().getExpr().getChild(1).toString() = this.toString()    )  }}class BHTFn extends Function {  BHTFn() {    exists(FunctionCall fc |    fc.getTarget().getName().regexpMatch("qemu_bh_new_full|timer_new_ns") and    fc.getFile().getAbsolutePath().regexpMatch(".*qemu-6.1.0/hw/.*") and    (fc.getChild(0).toString() = this.toString() or fc.getChild(1).toString() = this.toString())    )  }}class FreeFn extends Function {  FreeFn() {    exists(FunctionCall fc |    fc.getTarget().getName().matches("g_free") and    fc.getEnclosingFunction() = this and    not this.getName().regexpMatch(".*shutdown.*") and    not this.getFile()    .getRelativePath()    .regexpMatch(".*error.*|.*test.*|.*replay.*|.*translate-all.*|.*xen.*|.*qapi-visit.*")    )  }}class ReentryFn extends Function {  ReentryFn() {    this.getName()    .regexpMatch("address_space_write|dma_memory_write|stb_dma|stl_be_dma|stl_le_dma|stq_be_dma|stq_le_dma|stw_be_dma|stw_le_dma|pci_dma_write|dma_buf_read|...")  }}query predicate edges(Function a, Function b) {  a.calls(b)}from MMIOFn entry_fn, ReentryFn end_fnwhere edges+(entry_fn, end_fn)select end_fn, entry_fn, end_fn, "MMIO -> Reentry: from " + entry_fn.getName() + " to " +end_fn.getName()