diff options
author | Lee Chee Yang <chee.yang.lee@intel.com> | 2020-04-07 13:00:04 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-04-07 21:57:16 +0100 |
commit | ad030e8ff0be18fa09849db97158a607ffa81492 (patch) | |
tree | 2850324f1fd07b2ad634399c63c091c563ef3e25 /meta/recipes-devtools/qemu | |
parent | f4e0b265683c091fd1d7d96bc132d76955d89263 (diff) | |
download | poky-ad030e8ff0be18fa09849db97158a607ffa81492.tar.gz |
qemu: fix CVE-2020-11102
(From OE-Core rev: 47f8d0da838c59ab419f0cbae941f84693cb53c0)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch | 148 |
2 files changed, 149 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 530ee82fa9..f17a046fca 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -36,6 +36,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
36 | file://0001-Add-enable-disable-udev.patch \ | 36 | file://0001-Add-enable-disable-udev.patch \ |
37 | file://CVE-2020-7211.patch \ | 37 | file://CVE-2020-7211.patch \ |
38 | file://0001-qemu-Do-not-include-file-if-not-exists.patch \ | 38 | file://0001-qemu-Do-not-include-file-if-not-exists.patch \ |
39 | file://CVE-2020-11102.patch \ | ||
39 | " | 40 | " |
40 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 41 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
41 | 42 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch new file mode 100644 index 0000000000..e8f3e1dbdb --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch | |||
@@ -0,0 +1,148 @@ | |||
1 | From 8ffb7265af64ec81748335ec8f20e7ab542c3850 Mon Sep 17 00:00:00 2001 | ||
2 | From: Prasad J Pandit <pjp@fedoraproject.org> | ||
3 | Date: Tue, 24 Mar 2020 22:57:22 +0530 | ||
4 | Subject: [PATCH] net: tulip: check frame size and r/w data length | ||
5 | |||
6 | Tulip network driver while copying tx/rx buffers does not check | ||
7 | frame size against r/w data length. This may lead to OOB buffer | ||
8 | access. Add check to avoid it. | ||
9 | |||
10 | Limit iterations over descriptors to avoid potential infinite | ||
11 | loop issue in tulip_xmit_list_update. | ||
12 | |||
13 | Reported-by: Li Qiang <pangpei.lq@antfin.com> | ||
14 | Reported-by: Ziming Zhang <ezrakiez@gmail.com> | ||
15 | Reported-by: Jason Wang <jasowang@redhat.com> | ||
16 | Tested-by: Li Qiang <liq3ea@gmail.com> | ||
17 | Reviewed-by: Li Qiang <liq3ea@gmail.com> | ||
18 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | ||
19 | Signed-off-by: Jason Wang <jasowang@redhat.com> | ||
20 | |||
21 | Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=8ffb7265af64ec81748335ec8f20e7ab542c3850] | ||
22 | CVE: CVE-2020-11102 | ||
23 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
24 | --- | ||
25 | hw/net/tulip.c | 36 +++++++++++++++++++++++++++--------- | ||
26 | 1 file changed, 27 insertions(+), 9 deletions(-) | ||
27 | |||
28 | diff --git a/hw/net/tulip.c b/hw/net/tulip.c | ||
29 | index cfac271..1295f51 100644 | ||
30 | --- a/hw/net/tulip.c | ||
31 | +++ b/hw/net/tulip.c | ||
32 | @@ -170,6 +170,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) | ||
33 | } else { | ||
34 | len = s->rx_frame_len; | ||
35 | } | ||
36 | + | ||
37 | + if (s->rx_frame_len + len > sizeof(s->rx_frame)) { | ||
38 | + return; | ||
39 | + } | ||
40 | pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame + | ||
41 | (s->rx_frame_size - s->rx_frame_len), len); | ||
42 | s->rx_frame_len -= len; | ||
43 | @@ -181,6 +185,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) | ||
44 | } else { | ||
45 | len = s->rx_frame_len; | ||
46 | } | ||
47 | + | ||
48 | + if (s->rx_frame_len + len > sizeof(s->rx_frame)) { | ||
49 | + return; | ||
50 | + } | ||
51 | pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame + | ||
52 | (s->rx_frame_size - s->rx_frame_len), len); | ||
53 | s->rx_frame_len -= len; | ||
54 | @@ -227,7 +235,8 @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size) | ||
55 | |||
56 | trace_tulip_receive(buf, size); | ||
57 | |||
58 | - if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) { | ||
59 | + if (size < 14 || size > sizeof(s->rx_frame) - 4 | ||
60 | + || s->rx_frame_len || tulip_rx_stopped(s)) { | ||
61 | return 0; | ||
62 | } | ||
63 | |||
64 | @@ -275,7 +284,6 @@ static ssize_t tulip_receive_nc(NetClientState *nc, | ||
65 | return tulip_receive(qemu_get_nic_opaque(nc), buf, size); | ||
66 | } | ||
67 | |||
68 | - | ||
69 | static NetClientInfo net_tulip_info = { | ||
70 | .type = NET_CLIENT_DRIVER_NIC, | ||
71 | .size = sizeof(NICState), | ||
72 | @@ -558,7 +566,7 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc) | ||
73 | if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) { | ||
74 | /* Internal or external Loopback */ | ||
75 | tulip_receive(s, s->tx_frame, s->tx_frame_len); | ||
76 | - } else { | ||
77 | + } else if (s->tx_frame_len <= sizeof(s->tx_frame)) { | ||
78 | qemu_send_packet(qemu_get_queue(s->nic), | ||
79 | s->tx_frame, s->tx_frame_len); | ||
80 | } | ||
81 | @@ -570,23 +578,31 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc) | ||
82 | } | ||
83 | } | ||
84 | |||
85 | -static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc) | ||
86 | +static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc) | ||
87 | { | ||
88 | int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK; | ||
89 | int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK; | ||
90 | |||
91 | + if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) { | ||
92 | + return -1; | ||
93 | + } | ||
94 | if (len1) { | ||
95 | pci_dma_read(&s->dev, desc->buf_addr1, | ||
96 | s->tx_frame + s->tx_frame_len, len1); | ||
97 | s->tx_frame_len += len1; | ||
98 | } | ||
99 | |||
100 | + if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) { | ||
101 | + return -1; | ||
102 | + } | ||
103 | if (len2) { | ||
104 | pci_dma_read(&s->dev, desc->buf_addr2, | ||
105 | s->tx_frame + s->tx_frame_len, len2); | ||
106 | s->tx_frame_len += len2; | ||
107 | } | ||
108 | desc->status = (len1 + len2) ? 0 : 0x7fffffff; | ||
109 | + | ||
110 | + return 0; | ||
111 | } | ||
112 | |||
113 | static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n) | ||
114 | @@ -651,13 +667,15 @@ static uint32_t tulip_ts(TULIPState *s) | ||
115 | |||
116 | static void tulip_xmit_list_update(TULIPState *s) | ||
117 | { | ||
118 | +#define TULIP_DESC_MAX 128 | ||
119 | + uint8_t i = 0; | ||
120 | struct tulip_descriptor desc; | ||
121 | |||
122 | if (tulip_ts(s) != CSR5_TS_SUSPENDED) { | ||
123 | return; | ||
124 | } | ||
125 | |||
126 | - for (;;) { | ||
127 | + for (i = 0; i < TULIP_DESC_MAX; i++) { | ||
128 | tulip_desc_read(s, s->current_tx_desc, &desc); | ||
129 | tulip_dump_tx_descriptor(s, &desc); | ||
130 | |||
131 | @@ -675,10 +693,10 @@ static void tulip_xmit_list_update(TULIPState *s) | ||
132 | s->tx_frame_len = 0; | ||
133 | } | ||
134 | |||
135 | - tulip_copy_tx_buffers(s, &desc); | ||
136 | - | ||
137 | - if (desc.control & TDES1_LS) { | ||
138 | - tulip_tx(s, &desc); | ||
139 | + if (!tulip_copy_tx_buffers(s, &desc)) { | ||
140 | + if (desc.control & TDES1_LS) { | ||
141 | + tulip_tx(s, &desc); | ||
142 | + } | ||
143 | } | ||
144 | } | ||
145 | tulip_desc_write(s, s->current_tx_desc, &desc); | ||
146 | -- | ||
147 | 1.8.3.1 | ||
148 | |||