summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLee Chee Yang <chee.yang.lee@intel.com>2020-04-07 05:00:04 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-04-07 20:57:16 (GMT)
commitad030e8ff0be18fa09849db97158a607ffa81492 (patch)
tree2850324f1fd07b2ad634399c63c091c563ef3e25
parentf4e0b265683c091fd1d7d96bc132d76955d89263 (diff)
downloadpoky-ad030e8ff0be18fa09849db97158a607ffa81492.tar.gz
qemu: fix CVE-2020-11102
(From OE-Core rev: 47f8d0da838c59ab419f0cbae941f84693cb53c0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc1
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch148
2 files changed, 149 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 530ee82..f17a046 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -36,6 +36,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
36 file://0001-Add-enable-disable-udev.patch \ 36 file://0001-Add-enable-disable-udev.patch \
37 file://CVE-2020-7211.patch \ 37 file://CVE-2020-7211.patch \
38 file://0001-qemu-Do-not-include-file-if-not-exists.patch \ 38 file://0001-qemu-Do-not-include-file-if-not-exists.patch \
39 file://CVE-2020-11102.patch \
39 " 40 "
40UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 41UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
41 42
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch
new file mode 100644
index 0000000..e8f3e1d
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch
@@ -0,0 +1,148 @@
1From 8ffb7265af64ec81748335ec8f20e7ab542c3850 Mon Sep 17 00:00:00 2001
2From: Prasad J Pandit <pjp@fedoraproject.org>
3Date: Tue, 24 Mar 2020 22:57:22 +0530
4Subject: [PATCH] net: tulip: check frame size and r/w data length
5
6Tulip network driver while copying tx/rx buffers does not check
7frame size against r/w data length. This may lead to OOB buffer
8access. Add check to avoid it.
9
10Limit iterations over descriptors to avoid potential infinite
11loop issue in tulip_xmit_list_update.
12
13Reported-by: Li Qiang <pangpei.lq@antfin.com>
14Reported-by: Ziming Zhang <ezrakiez@gmail.com>
15Reported-by: Jason Wang <jasowang@redhat.com>
16Tested-by: Li Qiang <liq3ea@gmail.com>
17Reviewed-by: Li Qiang <liq3ea@gmail.com>
18Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
19Signed-off-by: Jason Wang <jasowang@redhat.com>
20
21Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=8ffb7265af64ec81748335ec8f20e7ab542c3850]
22CVE: CVE-2020-11102
23Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
24---
25 hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------
26 1 file changed, 27 insertions(+), 9 deletions(-)
27
28diff --git a/hw/net/tulip.c b/hw/net/tulip.c
29index cfac271..1295f51 100644
30--- a/hw/net/tulip.c
31+++ b/hw/net/tulip.c
32@@ -170,6 +170,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
33 } else {
34 len = s->rx_frame_len;
35 }
36+
37+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
38+ return;
39+ }
40 pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
41 (s->rx_frame_size - s->rx_frame_len), len);
42 s->rx_frame_len -= len;
43@@ -181,6 +185,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
44 } else {
45 len = s->rx_frame_len;
46 }
47+
48+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
49+ return;
50+ }
51 pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
52 (s->rx_frame_size - s->rx_frame_len), len);
53 s->rx_frame_len -= len;
54@@ -227,7 +235,8 @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
55
56 trace_tulip_receive(buf, size);
57
58- if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
59+ if (size < 14 || size > sizeof(s->rx_frame) - 4
60+ || s->rx_frame_len || tulip_rx_stopped(s)) {
61 return 0;
62 }
63
64@@ -275,7 +284,6 @@ static ssize_t tulip_receive_nc(NetClientState *nc,
65 return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
66 }
67
68-
69 static NetClientInfo net_tulip_info = {
70 .type = NET_CLIENT_DRIVER_NIC,
71 .size = sizeof(NICState),
72@@ -558,7 +566,7 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
73 if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
74 /* Internal or external Loopback */
75 tulip_receive(s, s->tx_frame, s->tx_frame_len);
76- } else {
77+ } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {
78 qemu_send_packet(qemu_get_queue(s->nic),
79 s->tx_frame, s->tx_frame_len);
80 }
81@@ -570,23 +578,31 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
82 }
83 }
84
85-static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
86+static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
87 {
88 int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
89 int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
90
91+ if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
92+ return -1;
93+ }
94 if (len1) {
95 pci_dma_read(&s->dev, desc->buf_addr1,
96 s->tx_frame + s->tx_frame_len, len1);
97 s->tx_frame_len += len1;
98 }
99
100+ if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
101+ return -1;
102+ }
103 if (len2) {
104 pci_dma_read(&s->dev, desc->buf_addr2,
105 s->tx_frame + s->tx_frame_len, len2);
106 s->tx_frame_len += len2;
107 }
108 desc->status = (len1 + len2) ? 0 : 0x7fffffff;
109+
110+ return 0;
111 }
112
113 static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
114@@ -651,13 +667,15 @@ static uint32_t tulip_ts(TULIPState *s)
115
116 static void tulip_xmit_list_update(TULIPState *s)
117 {
118+#define TULIP_DESC_MAX 128
119+ uint8_t i = 0;
120 struct tulip_descriptor desc;
121
122 if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
123 return;
124 }
125
126- for (;;) {
127+ for (i = 0; i < TULIP_DESC_MAX; i++) {
128 tulip_desc_read(s, s->current_tx_desc, &desc);
129 tulip_dump_tx_descriptor(s, &desc);
130
131@@ -675,10 +693,10 @@ static void tulip_xmit_list_update(TULIPState *s)
132 s->tx_frame_len = 0;
133 }
134
135- tulip_copy_tx_buffers(s, &desc);
136-
137- if (desc.control & TDES1_LS) {
138- tulip_tx(s, &desc);
139+ if (!tulip_copy_tx_buffers(s, &desc)) {
140+ if (desc.control & TDES1_LS) {
141+ tulip_tx(s, &desc);
142+ }
143 }
144 }
145 tulip_desc_write(s, s->current_tx_desc, &desc);
146--
1471.8.3.1
148