diff options
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch | 92 |
2 files changed, 93 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 5e8d3e09ff..7647e44726 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -54,6 +54,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
54 | file://CVE-2020-24352.patch \ | 54 | file://CVE-2020-24352.patch \ |
55 | file://CVE-2020-25723.patch \ | 55 | file://CVE-2020-25723.patch \ |
56 | file://CVE-2021-20203.patch \ | 56 | file://CVE-2021-20203.patch \ |
57 | file://CVE-2021-3392.patch \ | ||
57 | " | 58 | " |
58 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 59 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
59 | 60 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch new file mode 100644 index 0000000000..45b8a4f1dd --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch | |||
@@ -0,0 +1,92 @@ | |||
1 | From 3791642c8d60029adf9b00bcb4e34d7d8a1aea4d Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Tokarev <mjt@tls.msk.ru> | ||
3 | Date: Mon, 19 Apr 2021 15:42:47 +0200 | ||
4 | Subject: [PATCH] mptsas: Remove unused MPTSASState 'pending' field | ||
5 | (CVE-2021-3392) | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=utf8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | While processing SCSI i/o requests in mptsas_process_scsi_io_request(), | ||
11 | the Megaraid emulator appends new MPTSASRequest object 'req' to | ||
12 | the 's->pending' queue. In case of an error, this same object gets | ||
13 | dequeued in mptsas_free_request() only if SCSIRequest object | ||
14 | 'req->sreq' is initialised. This may lead to a use-after-free issue. | ||
15 | |||
16 | Since s->pending is actually not used, simply remove it from | ||
17 | MPTSASState. | ||
18 | |||
19 | Cc: qemu-stable@nongnu.org | ||
20 | Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> | ||
21 | Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
22 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
23 | Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> | ||
24 | Message-id: 20210419134247.1467982-1-f4bug@amsat.org | ||
25 | Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> | ||
26 | Suggested-by: Paolo Bonzini <pbonzini@redhat.com> | ||
27 | Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> | ||
28 | BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) | ||
29 | Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") | ||
30 | [PMD: Reworded description, added more tags] | ||
31 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
32 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
33 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
34 | |||
35 | Upstream-Status: Backport [ https://git.qemu.org/?p=qemu.git;a=commit;h=3791642c8d60029adf9b00bcb4e34d7d8a1aea4d ] | ||
36 | CVE: CVE-2021-3392 | ||
37 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
38 | --- | ||
39 | hw/scsi/mptsas.c | 6 ------ | ||
40 | hw/scsi/mptsas.h | 1 - | ||
41 | 2 files changed, 7 deletions(-) | ||
42 | |||
43 | diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c | ||
44 | index 7416e78..db3219e 100644 | ||
45 | --- a/hw/scsi/mptsas.c | ||
46 | +++ b/hw/scsi/mptsas.c | ||
47 | @@ -251,13 +251,10 @@ static int mptsas_build_sgl(MPTSASState *s, MPTSASRequest *req, hwaddr addr) | ||
48 | |||
49 | static void mptsas_free_request(MPTSASRequest *req) | ||
50 | { | ||
51 | - MPTSASState *s = req->dev; | ||
52 | - | ||
53 | if (req->sreq != NULL) { | ||
54 | req->sreq->hba_private = NULL; | ||
55 | scsi_req_unref(req->sreq); | ||
56 | req->sreq = NULL; | ||
57 | - QTAILQ_REMOVE(&s->pending, req, next); | ||
58 | } | ||
59 | qemu_sglist_destroy(&req->qsg); | ||
60 | g_free(req); | ||
61 | @@ -303,7 +300,6 @@ static int mptsas_process_scsi_io_request(MPTSASState *s, | ||
62 | } | ||
63 | |||
64 | req = g_new0(MPTSASRequest, 1); | ||
65 | - QTAILQ_INSERT_TAIL(&s->pending, req, next); | ||
66 | req->scsi_io = *scsi_io; | ||
67 | req->dev = s; | ||
68 | |||
69 | @@ -1319,8 +1315,6 @@ static void mptsas_scsi_realize(PCIDevice *dev, Error **errp) | ||
70 | |||
71 | s->request_bh = qemu_bh_new(mptsas_fetch_requests, s); | ||
72 | |||
73 | - QTAILQ_INIT(&s->pending); | ||
74 | - | ||
75 | scsi_bus_new(&s->bus, sizeof(s->bus), &dev->qdev, &mptsas_scsi_info, NULL); | ||
76 | } | ||
77 | |||
78 | diff --git a/hw/scsi/mptsas.h b/hw/scsi/mptsas.h | ||
79 | index b85ac1a..c046497 100644 | ||
80 | --- a/hw/scsi/mptsas.h | ||
81 | +++ b/hw/scsi/mptsas.h | ||
82 | @@ -79,7 +79,6 @@ struct MPTSASState { | ||
83 | uint16_t reply_frame_size; | ||
84 | |||
85 | SCSIBus bus; | ||
86 | - QTAILQ_HEAD(, MPTSASRequest) pending; | ||
87 | }; | ||
88 | |||
89 | void mptsas_fix_scsi_io_endianness(MPIMsgSCSIIORequest *req); | ||
90 | -- | ||
91 | 1.8.3.1 | ||
92 | |||