summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
diff options
context:
space:
mode:
authorSakib Sajal <sakib.sajal@windriver.com>2020-07-14 15:51:19 -0400
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-07-18 11:06:31 +0100
commitfe08dca6dba8721b1f1f9c6aabb8ccf6b55693d6 (patch)
tree10d98932cb445d1dd72f3bf00af1f5e20a01b265 /meta/recipes-devtools
parent11ea0bfdd1bdf394fe3b046396fba41e51862359 (diff)
downloadpoky-fe08dca6dba8721b1f1f9c6aabb8ccf6b55693d6.tar.gz
qemu: fix CVE-2020-13791
(From OE-Core rev: d7b315a69aa9b432ebfa7cb98690ae65e24edc35) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools')
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc1
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-13791.patch53
2 files changed, 54 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 618cc50180..57619e8668 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -35,6 +35,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
35 file://CVE-2020-13362.patch \ 35 file://CVE-2020-13362.patch \
36 file://CVE-2020-13659.patch \ 36 file://CVE-2020-13659.patch \
37 file://CVE-2020-13800.patch \ 37 file://CVE-2020-13800.patch \
38 file://CVE-2020-13791.patch \
38 " 39 "
39UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 40UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
40 41
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-13791.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-13791.patch
new file mode 100644
index 0000000000..049dab914d
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-13791.patch
@@ -0,0 +1,53 @@
1From f7d6a635fa3b7797f9d072e280f065bf3cfcd24d Mon Sep 17 00:00:00 2001
2From: Prasad J Pandit <pjp@fedoraproject.org>
3Date: Thu, 4 Jun 2020 17:05:25 +0530
4Subject: [PATCH] pci: assert configuration access is within bounds
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9While accessing PCI configuration bytes, assert that
10'address + len' is within PCI configuration space.
11
12Generally it is within bounds. This is more of a defensive
13assert, in case a buggy device was to send 'address' which
14may go out of bounds.
15
16Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
17Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
18Message-Id: <20200604113525.58898-1-ppandit@redhat.com>
19Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
20Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
21
22Upstream-Status: Backport [f7d6a635fa3b7797f9d072e280f065bf3cfcd24d]
23CVE: CVE-2020-13791
24Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
25---
26 hw/pci/pci.c | 4 ++++
27 1 file changed, 4 insertions(+)
28
29diff --git a/hw/pci/pci.c b/hw/pci/pci.c
30index 70c66965f5..7bf2ae6d92 100644
31--- a/hw/pci/pci.c
32+++ b/hw/pci/pci.c
33@@ -1381,6 +1381,8 @@ uint32_t pci_default_read_config(PCIDevice *d,
34 {
35 uint32_t val = 0;
36
37+ assert(address + len <= pci_config_size(d));
38+
39 if (pci_is_express_downstream_port(d) &&
40 ranges_overlap(address, len, d->exp.exp_cap + PCI_EXP_LNKSTA, 2)) {
41 pcie_sync_bridge_lnk(d);
42@@ -1394,6 +1396,8 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int
43 int i, was_irq_disabled = pci_irq_disabled(d);
44 uint32_t val = val_in;
45
46+ assert(addr + l <= pci_config_size(d));
47+
48 for (i = 0; i < l; val >>= 8, ++i) {
49 uint8_t wmask = d->wmask[addr + i];
50 uint8_t w1cmask = d->w1cmask[addr + i];
51--
522.20.1
53