diff options
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 2 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch | 43 |
2 files changed, 44 insertions, 1 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index f22de74ea4..14e2a79235 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -26,8 +26,8 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
26 | file://0007-qemu-Determinism-fixes.patch \ | 26 | file://0007-qemu-Determinism-fixes.patch \ |
27 | file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ | 27 | file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ |
28 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ | 28 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ |
29 | file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ | ||
29 | " | 30 | " |
30 | BAR = " file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch " | ||
31 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 31 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
32 | 32 | ||
33 | SRC_URI[sha256sum] = "a0634e536bded57cf38ec8a751adb124b89c776fe0846f21ab6c6728f1cbbbe6" | 33 | SRC_URI[sha256sum] = "a0634e536bded57cf38ec8a751adb124b89c776fe0846f21ab6c6728f1cbbbe6" |
diff --git a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch new file mode 100644 index 0000000000..810c74fabd --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch | |||
@@ -0,0 +1,43 @@ | |||
1 | CVE: CVE-2022-1050 | ||
2 | Upstream-Status: Submitted [https://lore.kernel.org/qemu-devel/20220403095234.2210-1-yuval.shaia.ml@gmail.com/] | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From dbdef95c272e8f3ec037c3db4197c66002e30995 Mon Sep 17 00:00:00 2001 | ||
6 | From: Yuval Shaia <yuval.shaia.ml@gmail.com> | ||
7 | Date: Sun, 3 Apr 2022 12:52:34 +0300 | ||
8 | Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver | ||
9 | |||
10 | Guest driver might execute HW commands when shared buffers are not yet | ||
11 | allocated. | ||
12 | This could happen on purpose (malicious guest) or because of some other | ||
13 | guest/host address mapping error. | ||
14 | We need to protect againts such case. | ||
15 | |||
16 | Fixes: CVE-2022-1050 | ||
17 | |||
18 | Reported-by: Raven <wxhusst@gmail.com> | ||
19 | Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com> | ||
20 | --- | ||
21 | hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++ | ||
22 | 1 file changed, 6 insertions(+) | ||
23 | |||
24 | diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c | ||
25 | index da7ddfa548..89db963c46 100644 | ||
26 | --- a/hw/rdma/vmw/pvrdma_cmd.c | ||
27 | +++ b/hw/rdma/vmw/pvrdma_cmd.c | ||
28 | @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev) | ||
29 | |||
30 | dsr_info = &dev->dsr_info; | ||
31 | |||
32 | + if (!dsr_info->dsr) { | ||
33 | + /* Buggy or malicious guest driver */ | ||
34 | + rdma_error_report("Exec command without dsr, req or rsp buffers"); | ||
35 | + goto out; | ||
36 | + } | ||
37 | + | ||
38 | if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) / | ||
39 | sizeof(struct cmd_handler)) { | ||
40 | rdma_error_report("Unsupported command"); | ||
41 | -- | ||
42 | 2.34.1 | ||
43 | |||