* [PATCH 1/3] qemu: fix CVE-2015-5225
2015-11-16 7:32 [PATCH 0/3] qemu: fix CVE-2015-5225, CVE-2015-6855, CVE-2015-7295 wenzong.fan
@ 2015-11-16 7:32 ` wenzong.fan
2015-11-16 7:32 ` [PATCH 2/3] qemu: fix CVE-2015-6855 wenzong.fan
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: wenzong.fan @ 2015-11-16 7:32 UTC (permalink / raw)
To: openembedded-core
From: Wenzong Fan <wenzong.fan@windriver.com>
Buffer overflow in the vnc_refresh_server_surface function in the VNC
display driver in QEMU before 2.4.0.1 allows guest users to cause a
denial of service (heap memory corruption and process crash) or
possibly execute arbitrary code on the host via unspecified vectors,
related to refreshing the server display surface.
Backport upstream commit:
http://git.qemu.org/?p=qemu.git;a=commit;h=eb8934b0418b3b1d125edddc4fc334a54334a49b
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
.../qemu/qemu/qemu-CVE-2015-5225.patch | 91 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 92 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-5225.patch
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-5225.patch b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-5225.patch
new file mode 100644
index 0000000..561a960
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-5225.patch
@@ -0,0 +1,91 @@
+From efec4dcd2552e85ed57f276b58f09fc385727450 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 17 Aug 2015 19:56:53 +0200
+Subject: [PATCH] vnc: fix memory corruption (CVE-2015-5225)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential
+memory corruption issues" can become negative. Result is (possibly
+exploitable) memory corruption. Reason for that is it uses the stride
+instead of bytes per scanline to apply limits.
+
+For the server surface is is actually fine. vnc creates that itself,
+there is never any padding and thus scanline length always equals stride.
+
+For the guest surface scanline length and stride are typically identical
+too, but it doesn't has to be that way. So add and use a new variable
+(guest_ll) for the guest scanline length. Also rename min_stride to
+line_bytes to make more clear what it actually is. Finally sprinkle
+in an assert() to make sure we never use a negative _cmp_bytes again.
+
+Reported-by: 范祚至(库特) <zuozhi.fzz@alibaba-inc.com>
+Reviewed-by: P J P <ppandit@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit eb8934b0418b3b1d125edddc4fc334a54334a49b)
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+
+Upstream-Status: Backport
+
+Backport upstream commit:
+http://git.qemu.org/?p=qemu.git;a=commit;h=eb8934b0418b3b1d125edddc4fc334a54334a49b
+
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+---
+ ui/vnc.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index e26973a..caf82f5 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -2872,7 +2872,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
+ pixman_image_get_width(vd->server));
+ int height = MIN(pixman_image_get_height(vd->guest.fb),
+ pixman_image_get_height(vd->server));
+- int cmp_bytes, server_stride, min_stride, guest_stride, y = 0;
++ int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
+ uint8_t *guest_row0 = NULL, *server_row0;
+ VncState *vs;
+ int has_dirty = 0;
+@@ -2891,17 +2891,21 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
+ * Update server dirty map.
+ */
+ server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
+- server_stride = guest_stride = pixman_image_get_stride(vd->server);
++ server_stride = guest_stride = guest_ll =
++ pixman_image_get_stride(vd->server);
+ cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
+ server_stride);
+ if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
+ int width = pixman_image_get_width(vd->server);
+ tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
+ } else {
++ int guest_bpp =
++ PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
+ guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
+ guest_stride = pixman_image_get_stride(vd->guest.fb);
++ guest_ll = pixman_image_get_width(vd->guest.fb) * ((guest_bpp + 7) / 8);
+ }
+- min_stride = MIN(server_stride, guest_stride);
++ line_bytes = MIN(server_stride, guest_ll);
+
+ for (;;) {
+ int x;
+@@ -2932,9 +2936,10 @@ static int vnc_refresh_server_surface(VncDisplay *vd)
+ if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
+ continue;
+ }
+- if ((x + 1) * cmp_bytes > min_stride) {
+- _cmp_bytes = min_stride - x * cmp_bytes;
++ if ((x + 1) * cmp_bytes > line_bytes) {
++ _cmp_bytes = line_bytes - x * cmp_bytes;
+ }
++ assert(_cmp_bytes >= 0);
+ if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
+ continue;
+ }
+--
+2.3.5
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 1505b80..24e8ef5 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -10,6 +10,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://smc91c111_fix2.patch \
file://smc91c111_fix3.patch \
file://no-valgrind.patch \
+ file://qemu-CVE-2015-5225.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
1.9.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 2/3] qemu: fix CVE-2015-6855
2015-11-16 7:32 [PATCH 0/3] qemu: fix CVE-2015-5225, CVE-2015-6855, CVE-2015-7295 wenzong.fan
2015-11-16 7:32 ` [PATCH 1/3] qemu: fix CVE-2015-5225 wenzong.fan
@ 2015-11-16 7:32 ` wenzong.fan
2015-11-16 7:32 ` [PATCH 3/3] qemu: fix CVE-2015-7295 wenzong.fan
2015-11-16 13:57 ` [PATCH 0/3] qemu: fix CVE-2015-5225, CVE-2015-6855, CVE-2015-7295 Burton, Ross
3 siblings, 0 replies; 7+ messages in thread
From: wenzong.fan @ 2015-11-16 7:32 UTC (permalink / raw)
To: openembedded-core
From: Wenzong Fan <wenzong.fan@windriver.com>
hw/ide/core.c in QEMU does not properly restrict the commands accepted
by an ATAPI device, which allows guest users to cause a denial of
service or possibly have unspecified other impact via certain IDE
commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty
drive, which triggers a divide-by-zero error and instance crash.
Backport upstream commit:
http://git.qemu.org/?p=qemu.git;a=commit;h=d9033e1d3aa666c5071580617a57bd853c5d794a
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
.../qemu/qemu/qemu-CVE-2015-6855.patch | 151 +++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 152 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-6855.patch
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-6855.patch b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-6855.patch
new file mode 100644
index 0000000..f7f6452
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-6855.patch
@@ -0,0 +1,151 @@
+From d9033e1d3aa666c5071580617a57bd853c5d794a Mon Sep 17 00:00:00 2001
+From: John Snow <jsnow@redhat.com>
+Date: Thu, 17 Sep 2015 14:17:05 -0400
+Subject: [PATCH] ide: fix ATAPI command permissions
+
+We're a little too lenient with what we'll let an ATAPI drive handle.
+Clamp down on the IDE command execution table to remove CD_OK permissions
+from commands that are not and have never been ATAPI commands.
+
+For ATAPI command validity, please see:
+- ATA4 Section 6.5 ("PACKET Command feature set")
+- ATA8/ACS Section 4.3 ("The PACKET feature set")
+- ACS3 Section 4.3 ("The PACKET feature set")
+
+ACS3 has a historical command validity table in Table B.4
+("Historical Command Assignments") that can be referenced to find when
+a command was introduced, deprecated, obsoleted, etc.
+
+The only reference for ATAPI command validity is by checking that
+version's PACKET feature set section.
+
+ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
+therefore are assumed to have never been ATAPI commands.
+
+Mandatory commands, as listed in ATA8-ACS3, are:
+
+- DEVICE RESET
+- EXECUTE DEVICE DIAGNOSTIC
+- IDENTIFY DEVICE
+- IDENTIFY PACKET DEVICE
+- NOP
+- PACKET
+- READ SECTOR(S)
+- SET FEATURES
+
+Optional commands as listed in ATA8-ACS3, are:
+
+- FLUSH CACHE
+- READ LOG DMA EXT
+- READ LOG EXT
+- WRITE LOG DMA EXT
+- WRITE LOG EXT
+
+All other commands are illegal to send to an ATAPI device and should
+be rejected by the device.
+
+CD_OK removal justifications:
+
+0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI.
+0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4.
+0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI.
+0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI.
+0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI.
+0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI.
+0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI.
+0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI.
+0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
+0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3.
+0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3.
+0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3.
+0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3.
+0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
+0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.
+
+This patch fixes a divide by zero fault that can be caused by sending
+the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
+attempt to use zeroed CHS values to perform sector arithmetic.
+
+Reported-by: Qinghao Tang <luodalongde@gmail.com>
+Signed-off-by: John Snow <jsnow@redhat.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
+CC: qemu-stable@nongnu.org
+
+Upstream-Status: Backport
+
+Backport upstream commit:
+http://git.qemu.org/?p=qemu.git;a=commit;h=d9033e1d3aa666c5071580617a57bd853c5d794a
+
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+---
+ hw/ide/core.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index 8ba04df..1cc6945 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -1746,11 +1746,11 @@ static const struct {
+ } ide_cmd_table[0x100] = {
+ /* NOP not implemented, mandatory for CD */
+ [CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK },
+- [WIN_DSM] = { cmd_data_set_management, ALL_OK },
++ [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK },
+ [WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK },
+ [WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC},
+ [WIN_READ] = { cmd_read_pio, ALL_OK },
+- [WIN_READ_ONCE] = { cmd_read_pio, ALL_OK },
++ [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK },
+ [WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK },
+ [WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK },
+ [WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
+@@ -1769,12 +1769,12 @@ static const struct {
+ [CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK },
+ [WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK },
+ [WIN_SPECIFY] = { cmd_nop, HD_CFA_OK | SET_DSC },
+- [WIN_STANDBYNOW2] = { cmd_nop, ALL_OK },
+- [WIN_IDLEIMMEDIATE2] = { cmd_nop, ALL_OK },
+- [WIN_STANDBY2] = { cmd_nop, ALL_OK },
+- [WIN_SETIDLE2] = { cmd_nop, ALL_OK },
+- [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, ALL_OK | SET_DSC },
+- [WIN_SLEEPNOW2] = { cmd_nop, ALL_OK },
++ [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK },
++ [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK },
++ [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK },
++ [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK },
++ [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
++ [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK },
+ [WIN_PACKETCMD] = { cmd_packet, CD_OK },
+ [WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK },
+ [WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC },
+@@ -1788,19 +1788,19 @@ static const struct {
+ [WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK },
+ [WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK },
+ [CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK },
+- [WIN_STANDBYNOW1] = { cmd_nop, ALL_OK },
+- [WIN_IDLEIMMEDIATE] = { cmd_nop, ALL_OK },
+- [WIN_STANDBY] = { cmd_nop, ALL_OK },
+- [WIN_SETIDLE1] = { cmd_nop, ALL_OK },
+- [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, ALL_OK | SET_DSC },
+- [WIN_SLEEPNOW1] = { cmd_nop, ALL_OK },
++ [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK },
++ [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK },
++ [WIN_STANDBY] = { cmd_nop, HD_CFA_OK },
++ [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK },
++ [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
++ [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK },
+ [WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK },
+ [WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK },
+ [WIN_IDENTIFY] = { cmd_identify, ALL_OK },
+ [WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC },
+ [IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
+ [CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
+- [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, ALL_OK | SET_DSC },
++ [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
+ };
+
+ static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
+--
+2.3.5
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 24e8ef5..4244ecf 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -11,6 +11,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://smc91c111_fix3.patch \
file://no-valgrind.patch \
file://qemu-CVE-2015-5225.patch \
+ file://qemu-CVE-2015-6855.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
1.9.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 3/3] qemu: fix CVE-2015-7295
2015-11-16 7:32 [PATCH 0/3] qemu: fix CVE-2015-5225, CVE-2015-6855, CVE-2015-7295 wenzong.fan
2015-11-16 7:32 ` [PATCH 1/3] qemu: fix CVE-2015-5225 wenzong.fan
2015-11-16 7:32 ` [PATCH 2/3] qemu: fix CVE-2015-6855 wenzong.fan
@ 2015-11-16 7:32 ` wenzong.fan
2015-11-16 13:57 ` [PATCH 0/3] qemu: fix CVE-2015-5225, CVE-2015-6855, CVE-2015-7295 Burton, Ross
3 siblings, 0 replies; 7+ messages in thread
From: wenzong.fan @ 2015-11-16 7:32 UTC (permalink / raw)
To: openembedded-core
From: Wenzong Fan <wenzong.fan@windriver.com>
hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support
in QEMU, when big or mergeable receive buffers are not supported,
allows remote attackers to cause a denial of service (guest network
consumption) via a flood of jumbo frames on the (1) tuntap or (2)
macvtap interface.
Backport upstream commits:
http://git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c
http://git.qemu.org/?p=qemu.git;a=commit;h=29b9f5efd78ae0f9cc02dd169b6e80d2c404bade
http://git.qemu.org/?p=qemu.git;a=commit;h=0cf33fb6b49a19de32859e2cdc6021334f448fb3
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
.../qemu/qemu/qemu-CVE-2015-7295.patch | 166 +++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 167 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-7295.patch
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-7295.patch b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-7295.patch
new file mode 100644
index 0000000..0f4a1f5
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-7295.patch
@@ -0,0 +1,166 @@
+Fix CVE-2015-7295
+
+Upstream-Status: Backport
+
+Backport upstream commits:
+http://git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c
+http://git.qemu.org/?p=qemu.git;a=commit;h=29b9f5efd78ae0f9cc02dd169b6e80d2c404bade
+http://git.qemu.org/?p=qemu.git;a=commit;h=0cf33fb6b49a19de32859e2cdc6021334f448fb3
+
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+======================================================
+From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:28 +0800
+Subject: [PATCH 1/3] virtio: introduce virtqueue_unmap_sg()
+
+Factor out sg unmapping logic. This will be reused by the patch that
+can discard descriptor.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Andrew James <andrew.james@hpe.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+---
+ hw/virtio/virtio.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 7504f8b..6f2b96c 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -244,14 +244,12 @@ int virtio_queue_empty(VirtQueue *vq)
+ return vring_avail_idx(vq) == vq->last_avail_idx;
+ }
+
+-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+- unsigned int len, unsigned int idx)
++static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len)
+ {
+ unsigned int offset;
+ int i;
+
+- trace_virtqueue_fill(vq, elem, len, idx);
+-
+ offset = 0;
+ for (i = 0; i < elem->in_num; i++) {
+ size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
+@@ -267,6 +265,14 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+ cpu_physical_memory_unmap(elem->out_sg[i].iov_base,
+ elem->out_sg[i].iov_len,
+ 0, elem->out_sg[i].iov_len);
++}
++
++void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len, unsigned int idx)
++{
++ trace_virtqueue_fill(vq, elem, len, idx);
++
++ virtqueue_unmap_sg(vq, elem, len);
+
+ idx = (idx + vring_used_idx(vq)) % vq->vring.num;
+
+--
+2.3.5
+
+
+From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:29 +0800
+Subject: [PATCH 2/3] virtio: introduce virtqueue_discard()
+
+This patch introduces virtqueue_discard() to discard a descriptor and
+unmap the sgs. This will be used by the patch that will discard
+descriptor when packet is truncated.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+---
+ hw/virtio/virtio.c | 7 +++++++
+ include/hw/virtio/virtio.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 6f2b96c..d0bc72e 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -267,6 +267,13 @@ static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
+ 0, elem->out_sg[i].iov_len);
+ }
+
++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len)
++{
++ vq->last_avail_idx--;
++ virtqueue_unmap_sg(vq, elem, len);
++}
++
+ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len, unsigned int idx)
+ {
+diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
+index 6201ee8..9d09115 100644
+--- a/include/hw/virtio/virtio.h
++++ b/include/hw/virtio/virtio.h
+@@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev, int n);
+ void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len);
+ void virtqueue_flush(VirtQueue *vq, unsigned int count);
++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len);
+ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len, unsigned int idx);
+
+--
+2.3.5
+
+
+From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:30 +0800
+Subject: [PATCH 3/3] virtio-net: correctly drop truncated packets
+
+When packet is truncated during receiving, we drop the packets but
+neither discard the descriptor nor add and signal used
+descriptor. This will lead several issues:
+
+- sg mappings are leaked
+- rx will be stalled if a lots of packets were truncated
+
+In order to be consistent with vhost, fix by discarding the descriptor
+in this case.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+---
+ hw/net/virtio-net.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index d388c55..a877614 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1094,13 +1094,7 @@ static ssize_t virtio_net_receive(NetClientState *nc, const uint8_t *buf, size_t
+ * must have consumed the complete packet.
+ * Otherwise, drop it. */
+ if (!n->mergeable_rx_bufs && offset < size) {
+-#if 0
+- error_report("virtio-net truncated non-mergeable packet: "
+- "i %zd mergeable %d offset %zd, size %zd, "
+- "guest hdr len %zd, host hdr len %zd",
+- i, n->mergeable_rx_bufs,
+- offset, size, n->guest_hdr_len, n->host_hdr_len);
+-#endif
++ virtqueue_discard(q->rx_vq, &elem, total);
+ return size;
+ }
+
+--
+2.3.5
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 4244ecf..b8fe99c 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -12,6 +12,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://no-valgrind.patch \
file://qemu-CVE-2015-5225.patch \
file://qemu-CVE-2015-6855.patch \
+ file://qemu-CVE-2015-7295.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
1.9.1
^ permalink raw reply related [flat|nested] 7+ messages in thread