summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorRichard Purdie <richard.purdie@linuxfoundation.org>2022-09-08 21:59:22 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-09-09 14:09:01 +0100
commit9040d46f59643270695afdb093e8b403b89b898a (patch)
treece3662d2d9015de6b7f1ae7f68f48c79d87da32a /meta
parentc3f4b8195420d755fa75fd408be9fd89b555a046 (diff)
downloadpoky-9040d46f59643270695afdb093e8b403b89b898a.tar.gz
qemu: Upgrade 7.0.0 -> 7.1.0
Drop CVE backports and backported patch for pvrdma which was also applied upstream. Refresh cross.patch. Drop vnc-png option removed upstream. Update ptest path manipulations for target. qmp now has consists of multiple files so install them all as a python module. The upgrade contains fixes for virtio block devices which we hope will address vda device tracebacks on the autobuilder from qemu. (From OE-Core rev: e94d182889ca3c02df913c59f0b66b228ffe588c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/conf/distro/include/tcmode-default.inc2
-rw-r--r--meta/recipes-devtools/qemu/qemu-native_7.1.0.bb (renamed from meta/recipes-devtools/qemu/qemu-native_7.0.0.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_7.0.0.bb)3
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc21
-rw-r--r--meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch57
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch92
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch115
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2022-0216_1.patch42
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2022-0216_2.patch146
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2022-35414.patch53
-rw-r--r--meta/recipes-devtools/qemu/qemu/cross.patch17
-rw-r--r--meta/recipes-devtools/qemu/qemu_7.1.0.bb (renamed from meta/recipes-devtools/qemu/qemu_7.0.0.bb)0
12 files changed, 20 insertions, 528 deletions
diff --git a/meta/conf/distro/include/tcmode-default.inc b/meta/conf/distro/include/tcmode-default.inc
index 9abd121e3a..59b226e62f 100644
--- a/meta/conf/distro/include/tcmode-default.inc
+++ b/meta/conf/distro/include/tcmode-default.inc
@@ -22,7 +22,7 @@ BINUVERSION ?= "2.39%"
22GDBVERSION ?= "12.%" 22GDBVERSION ?= "12.%"
23GLIBCVERSION ?= "2.36" 23GLIBCVERSION ?= "2.36"
24LINUXLIBCVERSION ?= "5.19%" 24LINUXLIBCVERSION ?= "5.19%"
25QEMUVERSION ?= "7.0%" 25QEMUVERSION ?= "7.1%"
26GOVERSION ?= "1.19%" 26GOVERSION ?= "1.19%"
27# This can not use wildcards like 8.0.% since it is also used in mesa to denote 27# This can not use wildcards like 8.0.% since it is also used in mesa to denote
28# llvm version being used, so always bump it with llvm recipe version bump 28# llvm version being used, so always bump it with llvm recipe version bump
diff --git a/meta/recipes-devtools/qemu/qemu-native_7.0.0.bb b/meta/recipes-devtools/qemu/qemu-native_7.1.0.bb
index a94dc0b61e..a94dc0b61e 100644
--- a/meta/recipes-devtools/qemu/qemu-native_7.0.0.bb
+++ b/meta/recipes-devtools/qemu/qemu-native_7.1.0.bb
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_7.0.0.bb b/meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb
index 5ccede5095..04c7c2a6ac 100644
--- a/meta/recipes-devtools/qemu/qemu-system-native_7.0.0.bb
+++ b/meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb
@@ -28,5 +28,6 @@ do_install:append() {
28 rm -rf ${D}${includedir}/qemu-plugin.h 28 rm -rf ${D}${includedir}/qemu-plugin.h
29 29
30 # Install qmp.py to be used with testimage 30 # Install qmp.py to be used with testimage
31 install -D ${S}/python/qemu/qmp/__init__.py ${D}${libdir}/qemu-python/qmp.py 31 install -d ${D}${libdir}/qemu-python/qmp/
32 install -D ${S}/python/qemu/qmp/* ${D}${libdir}/qemu-python/qmp/
32} 33}
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 56fc7aaf55..f22de74ea4 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -26,17 +26,11 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
26 file://0007-qemu-Determinism-fixes.patch \ 26 file://0007-qemu-Determinism-fixes.patch \
27 file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ 27 file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \
28 file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ 28 file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \
29 file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \
30 file://qemu-7.0.0-glibc-2.36.patch \
31 file://CVE-2022-35414.patch \
32 file://CVE-2021-3507_1.patch \
33 file://CVE-2021-3507_2.patch \
34 file://CVE-2022-0216_1.patch \
35 file://CVE-2022-0216_2.patch \
36 " 29 "
30BAR = " file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch "
37UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 31UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
38 32
39SRC_URI[sha256sum] = "f6b375c7951f728402798b0baabb2d86478ca53d44cedbefabbe1c46bf46f839" 33SRC_URI[sha256sum] = "a0634e536bded57cf38ec8a751adb124b89c776fe0846f21ab6c6728f1cbbbe6"
40 34
41SRC_URI:append:class-target = " file://cross.patch" 35SRC_URI:append:class-target = " file://cross.patch"
42SRC_URI:append:class-nativesdk = " file://cross.patch" 36SRC_URI:append:class-nativesdk = " file://cross.patch"
@@ -75,8 +69,14 @@ do_install_ptest() {
75 # Strip the paths from the QEMU variable, we can use PATH 69 # Strip the paths from the QEMU variable, we can use PATH
76 sed -i -e "s#^QEMU=.*/qemu-#QEMU=qemu-#g" ${D}${PTEST_PATH}/tests/tcg/*.mak 70 sed -i -e "s#^QEMU=.*/qemu-#QEMU=qemu-#g" ${D}${PTEST_PATH}/tests/tcg/*.mak
77 71
78 # Strip compiler flags as they break reproducibility 72 # Strip compiler flags as they break reproducibility
79 sed -i -e "s,CROSS_CC_GUEST=.*,CROSS_CC_GUEST=," ${D}${PTEST_PATH}/tests/tcg/*.mak 73 sed -i -e "s,^CC=.*,CC=gcc," \
74 -e "s,^CCAS=.*,CCAS=gcc," \
75 -e "s,^LD=.*,LD=ld," ${D}${PTEST_PATH}/tests/tcg/*.mak
76
77 # Update SRC_PATH variable to the right place on target
78 sed -i -e "s#^SRC_PATH=.*#SRC_PATH=${PTEST_PATH}#g" ${D}${PTEST_PATH}/tests/tcg/*.mak
79
80} 80}
81 81
82# QEMU_TARGETS is overridable variable 82# QEMU_TARGETS is overridable variable
@@ -151,7 +151,6 @@ PACKAGECONFIG[uring] = "--enable-linux-io-uring,--disable-linux-io-uring,liburin
151PACKAGECONFIG[xen] = "--enable-xen,--disable-xen,xen-tools,xen-tools-libxenstore xen-tools-libxenctrl xen-tools-libxenguest" 151PACKAGECONFIG[xen] = "--enable-xen,--disable-xen,xen-tools,xen-tools-libxenstore xen-tools-libxenctrl xen-tools-libxenguest"
152PACKAGECONFIG[vnc-sasl] = "--enable-vnc --enable-vnc-sasl,--disable-vnc-sasl,cyrus-sasl," 152PACKAGECONFIG[vnc-sasl] = "--enable-vnc --enable-vnc-sasl,--disable-vnc-sasl,cyrus-sasl,"
153PACKAGECONFIG[vnc-jpeg] = "--enable-vnc --enable-vnc-jpeg,--disable-vnc-jpeg,jpeg," 153PACKAGECONFIG[vnc-jpeg] = "--enable-vnc --enable-vnc-jpeg,--disable-vnc-jpeg,jpeg,"
154PACKAGECONFIG[vnc-png] = "--enable-vnc --enable-vnc-png,--disable-vnc-png,libpng,"
155PACKAGECONFIG[libcurl] = "--enable-curl,--disable-curl,curl," 154PACKAGECONFIG[libcurl] = "--enable-curl,--disable-curl,curl,"
156PACKAGECONFIG[nss] = "--enable-smartcard,--disable-smartcard,nss," 155PACKAGECONFIG[nss] = "--enable-smartcard,--disable-smartcard,nss,"
157PACKAGECONFIG[curses] = "--enable-curses,--disable-curses,ncurses," 156PACKAGECONFIG[curses] = "--enable-curses,--disable-curses,ncurses,"
diff --git a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
deleted file mode 100644
index 826d42fc20..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
+++ /dev/null
@@ -1,57 +0,0 @@
1From 52c38fa9f3a790a7c2805e7d8cce3ea9262d6ae2 Mon Sep 17 00:00:00 2001
2From: Yuval Shaia <yuval.shaia.ml@gmail.com>
3Date: Tue, 12 Apr 2022 11:01:51 +0100
4Subject: [PATCH 10/12] hw/pvrdma: Protect against buggy or malicious guest
5 driver
6
7Guest driver might execute HW commands when shared buffers are not yet
8allocated.
9This might happen on purpose (malicious guest) or because some other
10guest/host address mapping.
11We need to protect againts such case.
12
13Reported-by: Mauro Matteo Cascella <mcascell@redhat.com>
14Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
15
16CVE: CVE-2022-1050
17Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg05197.html]
18
19---
20 hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
21 hw/rdma/vmw/pvrdma_main.c | 3 ++-
22 2 files changed, 8 insertions(+), 1 deletion(-)
23
24diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
25index da7ddfa54..89db963c4 100644
26--- a/hw/rdma/vmw/pvrdma_cmd.c
27+++ b/hw/rdma/vmw/pvrdma_cmd.c
28@@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
29
30 dsr_info = &dev->dsr_info;
31
32+ if (!dsr_info->dsr) {
33+ /* Buggy or malicious guest driver */
34+ rdma_error_report("Exec command without dsr, req or rsp buffers");
35+ goto out;
36+ }
37+
38 if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
39 sizeof(struct cmd_handler)) {
40 rdma_error_report("Unsupported command");
41diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c
42index 91206dbb8..0b7d908e2 100644
43--- a/hw/rdma/vmw/pvrdma_main.c
44+++ b/hw/rdma/vmw/pvrdma_main.c
45@@ -249,7 +249,8 @@ static void init_dsr_dev_caps(PVRDMADev *dev)
46 {
47 struct pvrdma_device_shared_region *dsr;
48
49- if (dev->dsr_info.dsr == NULL) {
50+ if (!dev->dsr_info.dsr) {
51+ /* Buggy or malicious guest driver */
52 rdma_error_report("Can't initialized DSR");
53 return;
54 }
55--
562.30.2
57
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch
deleted file mode 100644
index 24fd2c5ed3..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_1.patch
+++ /dev/null
@@ -1,92 +0,0 @@
1From 57a89cc36ead7234e540d0ecbe1a792ab6b04cb7 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
3Date: Thu, 18 Nov 2021 12:57:32 +0100
4Subject: [PATCH 1/2] hw/block/fdc: Prevent end-of-track overrun
5 (CVE-2021-3507)
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10Per the 82078 datasheet, if the end-of-track (EOT byte in
11the FIFO) is more than the number of sectors per side, the
12command is terminated unsuccessfully:
13
14* 5.2.5 DATA TRANSFER TERMINATION
15
16 The 82078 supports terminal count explicitly through
17 the TC pin and implicitly through the underrun/over-
18 run and end-of-track (EOT) functions. For full sector
19 transfers, the EOT parameter can define the last
20 sector to be transferred in a single or multisector
21 transfer. If the last sector to be transferred is a par-
22 tial sector, the host can stop transferring the data in
23 mid-sector, and the 82078 will continue to complete
24 the sector as if a hardware TC was received. The
25 only difference between these implicit functions and
26 TC is that they return "abnormal termination" result
27 status. Such status indications can be ignored if they
28 were expected.
29
30* 6.1.3 READ TRACK
31
32 This command terminates when the EOT specified
33 number of sectors have been read. If the 82078
34 does not find an I D Address Mark on the diskette
35 after the second· occurrence of a pulse on the
36 INDX# pin, then it sets the IC code in Status Regis-
37 ter 0 to "01" (Abnormal termination), sets the MA bit
38 in Status Register 1 to "1", and terminates the com-
39 mand.
40
41* 6.1.6 VERIFY
42
43 Refer to Table 6-6 and Table 6-7 for information
44 concerning the values of MT and EC versus SC and
45 EOT value.
46
47* Table 6·6. Result Phase Table
48
49* Table 6-7. Verify Command Result Phase Table
50
51Fix by aborting the transfer when EOT > # Sectors Per Side.
52
53Cc: qemu-stable@nongnu.org
54Cc: Hervé Poussineau <hpoussin@reactos.org>
55Fixes: baca51faff0 ("floppy driver: disk geometry auto detect")
56Reported-by: Alexander Bulekov <alxndr@bu.edu>
57Resolves: https://gitlab.com/qemu-project/qemu/-/issues/339
58Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
59Message-Id: <20211118115733.4038610-2-philmd@redhat.com>
60Reviewed-by: Hanna Reitz <hreitz@redhat.com>
61Signed-off-by: Kevin Wolf <kwolf@redhat.com>
62
63Upstream-Status: Backport [defac5e2fbddf8423a354ff0454283a2115e1367]
64CVE: CVE-2021-3507
65
66Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
67---
68 hw/block/fdc.c | 8 ++++++++
69 1 file changed, 8 insertions(+)
70
71diff --git a/hw/block/fdc.c b/hw/block/fdc.c
72index 347875a0c..57bb35579 100644
73--- a/hw/block/fdc.c
74+++ b/hw/block/fdc.c
75@@ -1530,6 +1530,14 @@ static void fdctrl_start_transfer(FDCtrl *fdctrl, int direction)
76 int tmp;
77 fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]);
78 tmp = (fdctrl->fifo[6] - ks + 1);
79+ if (tmp < 0) {
80+ FLOPPY_DPRINTF("invalid EOT: %d\n", tmp);
81+ fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_MA, 0x00);
82+ fdctrl->fifo[3] = kt;
83+ fdctrl->fifo[4] = kh;
84+ fdctrl->fifo[5] = ks;
85+ return;
86+ }
87 if (fdctrl->fifo[0] & 0x80)
88 tmp += fdctrl->fifo[6];
89 fdctrl->data_len *= tmp;
90--
912.33.0
92
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch
deleted file mode 100644
index acc93e897b..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch
+++ /dev/null
@@ -1,115 +0,0 @@
1From 3e8601ec707dcbc3c768f7733d016dc70c947e4a Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
3Date: Thu, 18 Nov 2021 12:57:33 +0100
4Subject: [PATCH 2/2] tests/qtest/fdc-test: Add a regression test for
5 CVE-2021-3507
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10Add the reproducer from https://gitlab.com/qemu-project/qemu/-/issues/339
11
12Without the previous commit, when running 'make check-qtest-i386'
13with QEMU configured with '--enable-sanitizers' we get:
14
15 ==4028352==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000062a00 at pc 0x5626d03c491a bp 0x7ffdb4199410 sp 0x7ffdb4198bc0
16 READ of size 786432 at 0x619000062a00 thread T0
17 #0 0x5626d03c4919 in __asan_memcpy (qemu-system-i386+0x1e65919)
18 #1 0x5626d1c023cc in flatview_write_continue softmmu/physmem.c:2787:13
19 #2 0x5626d1bf0c0f in flatview_write softmmu/physmem.c:2822:14
20 #3 0x5626d1bf0798 in address_space_write softmmu/physmem.c:2914:18
21 #4 0x5626d1bf0f37 in address_space_rw softmmu/physmem.c:2924:16
22 #5 0x5626d1bf14c8 in cpu_physical_memory_rw softmmu/physmem.c:2933:5
23 #6 0x5626d0bd5649 in cpu_physical_memory_write include/exec/cpu-common.h:82:5
24 #7 0x5626d0bd0a07 in i8257_dma_write_memory hw/dma/i8257.c:452:9
25 #8 0x5626d09f825d in fdctrl_transfer_handler hw/block/fdc.c:1616:13
26 #9 0x5626d0a048b4 in fdctrl_start_transfer hw/block/fdc.c:1539:13
27 #10 0x5626d09f4c3e in fdctrl_write_data hw/block/fdc.c:2266:13
28 #11 0x5626d09f22f7 in fdctrl_write hw/block/fdc.c:829:9
29 #12 0x5626d1c20bc5 in portio_write softmmu/ioport.c:207:17
30
31 0x619000062a00 is located 0 bytes to the right of 512-byte region [0x619000062800,0x619000062a00)
32 allocated by thread T0 here:
33 #0 0x5626d03c66ec in posix_memalign (qemu-system-i386+0x1e676ec)
34 #1 0x5626d2b988d4 in qemu_try_memalign util/oslib-posix.c:210:11
35 #2 0x5626d2b98b0c in qemu_memalign util/oslib-posix.c:226:27
36 #3 0x5626d09fbaf0 in fdctrl_realize_common hw/block/fdc.c:2341:20
37 #4 0x5626d0a150ed in isabus_fdc_realize hw/block/fdc-isa.c:113:5
38 #5 0x5626d2367935 in device_set_realized hw/core/qdev.c:531:13
39
40 SUMMARY: AddressSanitizer: heap-buffer-overflow (qemu-system-i386+0x1e65919) in __asan_memcpy
41 Shadow bytes around the buggy address:
42 0x0c32800044f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
43 0x0c3280004500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
44 0x0c3280004510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
45 0x0c3280004520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
46 0x0c3280004530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
47 =>0x0c3280004540:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
48 0x0c3280004550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
49 0x0c3280004560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
50 0x0c3280004570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
51 0x0c3280004580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
52 0x0c3280004590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
53 Shadow byte legend (one shadow byte represents 8 application bytes):
54 Addressable: 00
55 Heap left redzone: fa
56 Freed heap region: fd
57 ==4028352==ABORTING
58
59[ kwolf: Added snapshot=on to prevent write file lock failure ]
60
61Reported-by: Alexander Bulekov <alxndr@bu.edu>
62Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
63Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
64Signed-off-by: Kevin Wolf <kwolf@redhat.com>
65
66Upstream-Status: Backport [46609b90d9e3a6304def11038a76b58ff43f77bc]
67CVE: CVE-2021-3507
68
69Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
70---
71 tests/qtest/fdc-test.c | 21 +++++++++++++++++++++
72 1 file changed, 21 insertions(+)
73
74diff --git a/tests/qtest/fdc-test.c b/tests/qtest/fdc-test.c
75index b0d40012e..1d4f85212 100644
76--- a/tests/qtest/fdc-test.c
77+++ b/tests/qtest/fdc-test.c
78@@ -583,6 +583,26 @@ static void test_cve_2021_20196(void)
79 qtest_quit(s);
80 }
81
82+static void test_cve_2021_3507(void)
83+{
84+ QTestState *s;
85+
86+ s = qtest_initf("-nographic -m 32M -nodefaults "
87+ "-drive file=%s,format=raw,if=floppy,snapshot=on",
88+ test_image);
89+ qtest_outl(s, 0x9, 0x0a0206);
90+ qtest_outw(s, 0x3f4, 0x1600);
91+ qtest_outw(s, 0x3f4, 0x0000);
92+ qtest_outw(s, 0x3f4, 0x0000);
93+ qtest_outw(s, 0x3f4, 0x0000);
94+ qtest_outw(s, 0x3f4, 0x0200);
95+ qtest_outw(s, 0x3f4, 0x0200);
96+ qtest_outw(s, 0x3f4, 0x0000);
97+ qtest_outw(s, 0x3f4, 0x0000);
98+ qtest_outw(s, 0x3f4, 0x0000);
99+ qtest_quit(s);
100+}
101+
102 int main(int argc, char **argv)
103 {
104 int fd;
105@@ -614,6 +634,7 @@ int main(int argc, char **argv)
106 qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19);
107 qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
108 qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196);
109+ qtest_add_func("/fdc/fuzz/cve_2021_3507", test_cve_2021_3507);
110
111 ret = g_test_run();
112
113--
1142.33.0
115
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_1.patch
deleted file mode 100644
index 56fc34ce5a..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_1.patch
+++ /dev/null
@@ -1,42 +0,0 @@
1From f37ac8619a39498edd225c4a0b3039b28814833d Mon Sep 17 00:00:00 2001
2From: Mauro Matteo Cascella <mcascell@redhat.com>
3Date: Tue, 5 Jul 2022 22:05:43 +0200
4Subject: [PATCH 1/2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout
5 (CVE-2022-0216)
6
7Set current_req->req to NULL to prevent reusing a free'd buffer in case of
8repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.
9
10Fixes: CVE-2022-0216
11Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
12Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
13Reviewed-by: Thomas Huth <thuth@redhat.com>
14Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
15Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
16
17Upstream-Status: Backport [6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8]
18CVE: CVE-2022-0216
19
20Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
21---
22 hw/scsi/lsi53c895a.c | 3 ++-
23 1 file changed, 2 insertions(+), 1 deletion(-)
24
25diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
26index c8773f73f..99ea42d49 100644
27--- a/hw/scsi/lsi53c895a.c
28+++ b/hw/scsi/lsi53c895a.c
29@@ -1028,8 +1028,9 @@ static void lsi_do_msgout(LSIState *s)
30 case 0x0d:
31 /* The ABORT TAG message clears the current I/O process only. */
32 trace_lsi_do_msgout_abort(current_tag);
33- if (current_req) {
34+ if (current_req && current_req->req) {
35 scsi_req_cancel(current_req->req);
36+ current_req->req = NULL;
37 }
38 lsi_disconnect(s);
39 break;
40--
412.33.0
42
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_2.patch
deleted file mode 100644
index f332154b6a..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2022-0216_2.patch
+++ /dev/null
@@ -1,146 +0,0 @@
1From 5451bf6db85ce3da1238e9154d051ebccec8f171 Mon Sep 17 00:00:00 2001
2From: Mauro Matteo Cascella <mcascell@redhat.com>
3Date: Mon, 11 Jul 2022 14:33:16 +0200
4Subject: [PATCH 2/2] scsi/lsi53c895a: really fix use-after-free in
5 lsi_do_msgout (CVE-2022-0216)
6
7Set current_req to NULL, not current_req->req, to prevent reusing a free'd
8buffer in case of repeated SCSI cancel requests. Also apply the fix to
9CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel
10the request.
11
12Thanks to Alexander Bulekov for providing a reproducer.
13
14Fixes: CVE-2022-0216
15Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
16Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
17Tested-by: Alexander Bulekov <alxndr@bu.edu>
18Message-Id: <20220711123316.421279-1-mcascell@redhat.com>
19Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
20
21Upstream-Status: Backport [4367a20cc442c56b05611b4224de9a61908f9eac]
22CVE: CVE-2022-0216
23
24Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
25---
26 hw/scsi/lsi53c895a.c | 3 +-
27 tests/qtest/fuzz-lsi53c895a-test.c | 76 ++++++++++++++++++++++++++++++
28 2 files changed, 78 insertions(+), 1 deletion(-)
29
30diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
31index 99ea42d49..ad5f5e5f3 100644
32--- a/hw/scsi/lsi53c895a.c
33+++ b/hw/scsi/lsi53c895a.c
34@@ -1030,7 +1030,7 @@ static void lsi_do_msgout(LSIState *s)
35 trace_lsi_do_msgout_abort(current_tag);
36 if (current_req && current_req->req) {
37 scsi_req_cancel(current_req->req);
38- current_req->req = NULL;
39+ current_req = NULL;
40 }
41 lsi_disconnect(s);
42 break;
43@@ -1056,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s)
44 /* clear the current I/O process */
45 if (s->current) {
46 scsi_req_cancel(s->current->req);
47+ current_req = NULL;
48 }
49
50 /* As the current implemented devices scsi_disk and scsi_generic
51diff --git a/tests/qtest/fuzz-lsi53c895a-test.c b/tests/qtest/fuzz-lsi53c895a-test.c
52index ba5d46897..c1af0ab1c 100644
53--- a/tests/qtest/fuzz-lsi53c895a-test.c
54+++ b/tests/qtest/fuzz-lsi53c895a-test.c
55@@ -8,6 +8,79 @@
56 #include "qemu/osdep.h"
57 #include "libqos/libqtest.h"
58
59+/*
60+ * This used to trigger a UAF in lsi_do_msgout()
61+ * https://gitlab.com/qemu-project/qemu/-/issues/972
62+ */
63+static void test_lsi_do_msgout_cancel_req(void)
64+{
65+ QTestState *s;
66+
67+ if (sizeof(void *) == 4) {
68+ g_test_skip("memory size too big for 32-bit build");
69+ return;
70+ }
71+
72+ s = qtest_init("-M q35 -m 4G -display none -nodefaults "
73+ "-device lsi53c895a,id=scsi "
74+ "-device scsi-hd,drive=disk0 "
75+ "-drive file=null-co://,id=disk0,if=none,format=raw");
76+
77+ qtest_outl(s, 0xcf8, 0x80000810);
78+ qtest_outl(s, 0xcf8, 0xc000);
79+ qtest_outl(s, 0xcf8, 0x80000810);
80+ qtest_outw(s, 0xcfc, 0x7);
81+ qtest_outl(s, 0xcf8, 0x80000810);
82+ qtest_outl(s, 0xcfc, 0xc000);
83+ qtest_outl(s, 0xcf8, 0x80000804);
84+ qtest_outw(s, 0xcfc, 0x05);
85+ qtest_writeb(s, 0x69736c10, 0x08);
86+ qtest_writeb(s, 0x69736c13, 0x58);
87+ qtest_writeb(s, 0x69736c1a, 0x01);
88+ qtest_writeb(s, 0x69736c1b, 0x06);
89+ qtest_writeb(s, 0x69736c22, 0x01);
90+ qtest_writeb(s, 0x69736c23, 0x07);
91+ qtest_writeb(s, 0x69736c2b, 0x02);
92+ qtest_writeb(s, 0x69736c48, 0x08);
93+ qtest_writeb(s, 0x69736c4b, 0x58);
94+ qtest_writeb(s, 0x69736c52, 0x04);
95+ qtest_writeb(s, 0x69736c53, 0x06);
96+ qtest_writeb(s, 0x69736c5b, 0x02);
97+ qtest_outl(s, 0xc02d, 0x697300);
98+ qtest_writeb(s, 0x5a554662, 0x01);
99+ qtest_writeb(s, 0x5a554663, 0x07);
100+ qtest_writeb(s, 0x5a55466a, 0x10);
101+ qtest_writeb(s, 0x5a55466b, 0x22);
102+ qtest_writeb(s, 0x5a55466c, 0x5a);
103+ qtest_writeb(s, 0x5a55466d, 0x5a);
104+ qtest_writeb(s, 0x5a55466e, 0x34);
105+ qtest_writeb(s, 0x5a55466f, 0x5a);
106+ qtest_writeb(s, 0x5a345a5a, 0x77);
107+ qtest_writeb(s, 0x5a345a5b, 0x55);
108+ qtest_writeb(s, 0x5a345a5c, 0x51);
109+ qtest_writeb(s, 0x5a345a5d, 0x27);
110+ qtest_writeb(s, 0x27515577, 0x41);
111+ qtest_outl(s, 0xc02d, 0x5a5500);
112+ qtest_writeb(s, 0x364001d0, 0x08);
113+ qtest_writeb(s, 0x364001d3, 0x58);
114+ qtest_writeb(s, 0x364001da, 0x01);
115+ qtest_writeb(s, 0x364001db, 0x26);
116+ qtest_writeb(s, 0x364001dc, 0x0d);
117+ qtest_writeb(s, 0x364001dd, 0xae);
118+ qtest_writeb(s, 0x364001de, 0x41);
119+ qtest_writeb(s, 0x364001df, 0x5a);
120+ qtest_writeb(s, 0x5a41ae0d, 0xf8);
121+ qtest_writeb(s, 0x5a41ae0e, 0x36);
122+ qtest_writeb(s, 0x5a41ae0f, 0xd7);
123+ qtest_writeb(s, 0x5a41ae10, 0x36);
124+ qtest_writeb(s, 0x36d736f8, 0x0c);
125+ qtest_writeb(s, 0x36d736f9, 0x80);
126+ qtest_writeb(s, 0x36d736fa, 0x0d);
127+ qtest_outl(s, 0xc02d, 0x364000);
128+
129+ qtest_quit(s);
130+}
131+
132 /*
133 * This used to trigger the assert in lsi_do_dma()
134 * https://bugs.launchpad.net/qemu/+bug/697510
135@@ -48,5 +121,8 @@ int main(int argc, char **argv)
136 test_lsi_do_dma_empty_queue);
137 }
138
139+ qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
140+ test_lsi_do_msgout_cancel_req);
141+
142 return g_test_run();
143 }
144--
1452.33.0
146
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-35414.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-35414.patch
deleted file mode 100644
index fe79a749ae..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2022-35414.patch
+++ /dev/null
@@ -1,53 +0,0 @@
1From a10c33942dc8cb31b3762b9dd4adde4c490eed9c Mon Sep 17 00:00:00 2001
2From: Hitendra Prajapati <hprajapati@mvista.com>
3Date: Wed, 3 Aug 2022 10:11:11 +0530
4Subject: [PATCH] CVE-2022-35414
5
6Upstream-Status: Backport [https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c]
7CVE: CVE-2022-35414
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 softmmu/physmem.c | 13 ++++++++++++-
11 1 file changed, 12 insertions(+), 1 deletion(-)
12
13diff --git a/softmmu/physmem.c b/softmmu/physmem.c
14index 4e1b27a20..ad8a90dec 100644
15--- a/softmmu/physmem.c
16+++ b/softmmu/physmem.c
17@@ -669,7 +669,7 @@ void tcg_iommu_init_notifier_list(CPUState *cpu)
18
19 /* Called from RCU critical section */
20 MemoryRegionSection *
21-address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
22+address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
23 hwaddr *xlat, hwaddr *plen,
24 MemTxAttrs attrs, int *prot)
25 {
26@@ -678,6 +678,7 @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
27 IOMMUMemoryRegionClass *imrc;
28 IOMMUTLBEntry iotlb;
29 int iommu_idx;
30+ hwaddr addr = orig_addr;
31 AddressSpaceDispatch *d =
32 qatomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch);
33
34@@ -722,6 +723,16 @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
35 return section;
36
37 translate_fail:
38+ /*
39+ * We should be given a page-aligned address -- certainly
40+ * tlb_set_page_with_attrs() does so. The page offset of xlat
41+ * is used to index sections[], and PHYS_SECTION_UNASSIGNED = 0.
42+ * The page portion of xlat will be logged by memory_region_access_valid()
43+ * when this memory access is rejected, so use the original untranslated
44+ * physical address.
45+ */
46+ assert((orig_addr & ~TARGET_PAGE_MASK) == 0);
47+ *xlat = orig_addr;
48 return &d->map.sections[PHYS_SECTION_UNASSIGNED];
49 }
50
51--
522.25.1
53
diff --git a/meta/recipes-devtools/qemu/qemu/cross.patch b/meta/recipes-devtools/qemu/qemu/cross.patch
index d1256a1229..ca2ad361ef 100644
--- a/meta/recipes-devtools/qemu/qemu/cross.patch
+++ b/meta/recipes-devtools/qemu/qemu/cross.patch
@@ -14,19 +14,19 @@ Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
14 configure | 4 ---- 14 configure | 4 ----
15 1 file changed, 4 deletions(-) 15 1 file changed, 4 deletions(-)
16 16
17diff --git a/configure b/configure 17Index: qemu-7.1.0/configure
18index 7c08c1835..0613279f9 100755 18===================================================================
19--- a/configure 19--- qemu-7.1.0.orig/configure
20+++ b/configure 20+++ qemu-7.1.0/configure
21@@ -3118,7 +3118,6 @@ if test "$skip_meson" = no; then 21@@ -2710,7 +2710,6 @@ if test "$skip_meson" = no; then
22 fi
23 echo "strip = [$(meson_quote $strip)]" >> $cross 22 echo "strip = [$(meson_quote $strip)]" >> $cross
23 echo "widl = [$(meson_quote $widl)]" >> $cross
24 echo "windres = [$(meson_quote $windres)]" >> $cross 24 echo "windres = [$(meson_quote $windres)]" >> $cross
25- if test "$cross_compile" = "yes"; then 25- if test "$cross_compile" = "yes"; then
26 cross_arg="--cross-file config-meson.cross" 26 cross_arg="--cross-file config-meson.cross"
27 echo "[host_machine]" >> $cross 27 echo "[host_machine]" >> $cross
28 echo "system = '$targetos'" >> $cross 28 echo "system = '$targetos'" >> $cross
29@@ -3136,9 +3135,6 @@ if test "$skip_meson" = no; then 29@@ -2728,9 +2727,6 @@ if test "$skip_meson" = no; then
30 else 30 else
31 echo "endian = 'little'" >> $cross 31 echo "endian = 'little'" >> $cross
32 fi 32 fi
@@ -36,6 +36,3 @@ index 7c08c1835..0613279f9 100755
36 mv $cross config-meson.cross 36 mv $cross config-meson.cross
37 37
38 rm -rf meson-private meson-info meson-logs 38 rm -rf meson-private meson-info meson-logs
39--
402.30.2
41
diff --git a/meta/recipes-devtools/qemu/qemu_7.0.0.bb b/meta/recipes-devtools/qemu/qemu_7.1.0.bb
index 42e133967e..42e133967e 100644
--- a/meta/recipes-devtools/qemu/qemu_7.0.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_7.1.0.bb
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-15 20:03:19 +0000