* [PATCH 1/2] qemu: supplementary fix of CVE-2016-5403
2016-10-26 8:12 [PATCH 0/2] Fix qemu cve issues kai.kang
@ 2016-10-26 9:18 ` kai.kang
2016-10-26 9:18 ` [PATCH 2/2] qemu: fix CVE-2016-7423 and CVE-2016-7908 kai.kang
1 sibling, 0 replies; 3+ messages in thread
From: kai.kang @ 2016-10-26 9:18 UTC (permalink / raw)
To: openembedded-core
From: Kai Kang <kai.kang@windriver.com>
Issue: LIN9-1439
It is reported in qemu community that VM always exits with:
| 2016-10-17T07:33:40.393592Z qemu-kvm: Virtqueue size exceede
when VM is suspend and resume. Solution from the maintainer of virtio
is to merge following 3 commits:
http://git.qemu.org/?p=qemu.git;a=commit;h=bccdef6
http://git.qemu.org/?p=qemu.git;a=commit;h=58a83c6
http://git.qemu.org/?p=qemu.git;a=commit;h=4b7f91e
The first 2 commits have been merged in qemu 2.7.0. Then apply the
third one.
(LOCAL REV: NOT UPSTREAM) -- Will send to oe-core on 20161026
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
...0001-virtio-zero-vq-inuse-in-virtio_reset.patch | 57 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.7.0.bb | 1 +
2 files changed, 58 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch
diff --git a/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch b/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch
new file mode 100644
index 0000000..86955d0
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch
@@ -0,0 +1,57 @@
+Upstream-Status: Backport
+
+Supplementary fix of CVE-2016-5403 which is backported from:
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=4b7f91e
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+---
+From 4b7f91ed0270a371e1933efa21ba600b6da23ab9 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Wed, 7 Sep 2016 11:51:25 -0400
+Subject: [PATCH] virtio: zero vq->inuse in virtio_reset()
+
+vq->inuse must be zeroed upon device reset like most other virtqueue
+fields.
+
+In theory, virtio_reset() just needs assert(vq->inuse == 0) since
+devices must clean up in-flight requests during reset (requests cannot
+not be leaked!).
+
+In practice, it is difficult to achieve vq->inuse == 0 across reset
+because balloon, blk, 9p, etc implement various different strategies for
+cleaning up requests. Most devices call g_free(elem) directly without
+telling virtio.c that the VirtQueueElement is cleaned up. Therefore
+vq->inuse is not decremented during reset.
+
+This patch zeroes vq->inuse and trusts that devices are not leaking
+VirtQueueElements across reset.
+
+I will send a follow-up series that refactors request life-cycle across
+all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but
+this more invasive approach is not appropriate for stable trees.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Ladi Prosek <lprosek@redhat.com>
+---
+ hw/virtio/virtio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 74c085c..e8a13a5 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -822,6 +822,7 @@ void virtio_reset(void *opaque)
+ vdev->vq[i].signalled_used_valid = false;
+ vdev->vq[i].notification = true;
+ vdev->vq[i].vring.num = vdev->vq[i].vring.num_default;
++ vdev->vq[i].inuse = 0;
+ }
+ }
+
+--
+2.9.3
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.7.0.bb b/meta/recipes-devtools/qemu/qemu_2.7.0.bb
index 619b8ed..90e4eec 100644
--- a/meta/recipes-devtools/qemu/qemu_2.7.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.7.0.bb
@@ -9,6 +9,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://no-valgrind.patch \
file://pathlimit.patch \
file://qemu-2.5.0-cflags.patch \
+ file://0001-virtio-zero-vq-inuse-in-virtio_reset.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
--
2.10.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 2/2] qemu: fix CVE-2016-7423 and CVE-2016-7908
2016-10-26 8:12 [PATCH 0/2] Fix qemu cve issues kai.kang
2016-10-26 9:18 ` [PATCH 1/2] qemu: supplementary fix of CVE-2016-5403 kai.kang
@ 2016-10-26 9:18 ` kai.kang
1 sibling, 0 replies; 3+ messages in thread
From: kai.kang @ 2016-10-26 9:18 UTC (permalink / raw)
To: openembedded-core
From: Kai Kang <kai.kang@windriver.com>
Issue: LIN9-1716
Issue: LIN9-1722
Backport patches to fix CVE-2016-7423 and CVE-2016-7908 of qemu.
(LOCAL REV: NOT UPSTREAM) -- Will send to oe-core on 20161026
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
.../qemu/qemu/0002-fix-CVE-2016-7423.patch | 45 ++++++++++++++++
.../qemu/qemu/0003-fix-CVE-2016-7908.patch | 62 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.7.0.bb | 2 +
3 files changed, 109 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/0003-fix-CVE-2016-7908.patch
diff --git a/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch b/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch
new file mode 100644
index 0000000..fdf58a3
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch
@@ -0,0 +1,45 @@
+Upstream-Status: Backport
+
+Backport patch to fix CVE-2016-7423 from:
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=670e56d3ed
+
+CVE: CVE-2016-7423
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+---
+From 670e56d3ed2918b3861d9216f2c0540d9e9ae0d5 Mon Sep 17 00:00:00 2001
+From: Li Qiang <liqiang6-s@360.cn>
+Date: Mon, 12 Sep 2016 18:14:11 +0530
+Subject: [PATCH] scsi: mptsas: use g_new0 to allocate MPTSASRequest object
+
+When processing IO request in mptsas, it uses g_new to allocate
+a 'req' object. If an error occurs before 'req->sreq' is
+allocated, It could lead to an OOB write in mptsas_free_request
+function. Use g_new0 to avoid it.
+
+Reported-by: Li Qiang <liqiang6-s@360.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/scsi/mptsas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
+index 0e0a22f..eaae1bb 100644
+--- a/hw/scsi/mptsas.c
++++ b/hw/scsi/mptsas.c
+@@ -304,7 +304,7 @@ static int mptsas_process_scsi_io_request(MPTSASState *s,
+ goto bad;
+ }
+
+- req = g_new(MPTSASRequest, 1);
++ req = g_new0(MPTSASRequest, 1);
+ QTAILQ_INSERT_TAIL(&s->pending, req, next);
+ req->scsi_io = *scsi_io;
+ req->dev = s;
+--
+2.9.3
+
diff --git a/meta/recipes-devtools/qemu/qemu/0003-fix-CVE-2016-7908.patch b/meta/recipes-devtools/qemu/qemu/0003-fix-CVE-2016-7908.patch
new file mode 100644
index 0000000..05cc3d9
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0003-fix-CVE-2016-7908.patch
@@ -0,0 +1,62 @@
+Upstream-Status: Backport
+
+Backport patch to fix CVE-2016-7908 from:
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=070c4b92b8c
+
+CVE: CVE-2016-7908
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+---
+From 070c4b92b8cd5390889716677a0b92444d6e087a Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Thu, 22 Sep 2016 16:02:37 +0530
+Subject: [PATCH] net: mcf: limit buffer descriptor count
+
+ColdFire Fast Ethernet Controller uses buffer descriptors to manage
+data flow to/fro receive & transmit queues. While transmitting
+packets, it could continue to read buffer descriptors if a buffer
+descriptor has length of zero and has crafted values in bd.flags.
+Set upper limit to number of buffer descriptors.
+
+Reported-by: Li Qiang <liqiang6-s@360.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/mcf_fec.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
+index 0ee8ad9..d31fea1 100644
+--- a/hw/net/mcf_fec.c
++++ b/hw/net/mcf_fec.c
+@@ -23,6 +23,7 @@ do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
+ #define DPRINTF(fmt, ...) do {} while(0)
+ #endif
+
++#define FEC_MAX_DESC 1024
+ #define FEC_MAX_FRAME_SIZE 2032
+
+ typedef struct {
+@@ -149,7 +150,7 @@ static void mcf_fec_do_tx(mcf_fec_state *s)
+ uint32_t addr;
+ mcf_fec_bd bd;
+ int frame_size;
+- int len;
++ int len, descnt = 0;
+ uint8_t frame[FEC_MAX_FRAME_SIZE];
+ uint8_t *ptr;
+
+@@ -157,7 +158,7 @@ static void mcf_fec_do_tx(mcf_fec_state *s)
+ ptr = frame;
+ frame_size = 0;
+ addr = s->tx_descriptor;
+- while (1) {
++ while (descnt++ < FEC_MAX_DESC) {
+ mcf_fec_read_bd(&bd, addr);
+ DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
+ addr, bd.flags, bd.length, bd.data);
+--
+2.9.3
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.7.0.bb b/meta/recipes-devtools/qemu/qemu_2.7.0.bb
index 90e4eec..a75bcdf 100644
--- a/meta/recipes-devtools/qemu/qemu_2.7.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.7.0.bb
@@ -10,6 +10,8 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://pathlimit.patch \
file://qemu-2.5.0-cflags.patch \
file://0001-virtio-zero-vq-inuse-in-virtio_reset.patch \
+ file://0002-fix-CVE-2016-7423.patch \
+ file://0003-fix-CVE-2016-7908.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
--
2.10.1
^ permalink raw reply related [flat|nested] 3+ messages in thread