diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch b/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch new file mode 100644 index 0000000000..86955d0437 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch | |||
@@ -0,0 +1,57 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | Supplementary fix of CVE-2016-5403 which is backported from: | ||
4 | |||
5 | http://git.qemu.org/?p=qemu.git;a=commit;h=4b7f91e | ||
6 | |||
7 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
8 | --- | ||
9 | From 4b7f91ed0270a371e1933efa21ba600b6da23ab9 Mon Sep 17 00:00:00 2001 | ||
10 | From: Stefan Hajnoczi <stefanha@redhat.com> | ||
11 | Date: Wed, 7 Sep 2016 11:51:25 -0400 | ||
12 | Subject: [PATCH] virtio: zero vq->inuse in virtio_reset() | ||
13 | |||
14 | vq->inuse must be zeroed upon device reset like most other virtqueue | ||
15 | fields. | ||
16 | |||
17 | In theory, virtio_reset() just needs assert(vq->inuse == 0) since | ||
18 | devices must clean up in-flight requests during reset (requests cannot | ||
19 | not be leaked!). | ||
20 | |||
21 | In practice, it is difficult to achieve vq->inuse == 0 across reset | ||
22 | because balloon, blk, 9p, etc implement various different strategies for | ||
23 | cleaning up requests. Most devices call g_free(elem) directly without | ||
24 | telling virtio.c that the VirtQueueElement is cleaned up. Therefore | ||
25 | vq->inuse is not decremented during reset. | ||
26 | |||
27 | This patch zeroes vq->inuse and trusts that devices are not leaking | ||
28 | VirtQueueElements across reset. | ||
29 | |||
30 | I will send a follow-up series that refactors request life-cycle across | ||
31 | all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but | ||
32 | this more invasive approach is not appropriate for stable trees. | ||
33 | |||
34 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
35 | Cc: qemu-stable <qemu-stable@nongnu.org> | ||
36 | Reviewed-by: Michael S. Tsirkin <mst@redhat.com> | ||
37 | Signed-off-by: Michael S. Tsirkin <mst@redhat.com> | ||
38 | Reviewed-by: Ladi Prosek <lprosek@redhat.com> | ||
39 | --- | ||
40 | hw/virtio/virtio.c | 1 + | ||
41 | 1 file changed, 1 insertion(+) | ||
42 | |||
43 | diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c | ||
44 | index 74c085c..e8a13a5 100644 | ||
45 | --- a/hw/virtio/virtio.c | ||
46 | +++ b/hw/virtio/virtio.c | ||
47 | @@ -822,6 +822,7 @@ void virtio_reset(void *opaque) | ||
48 | vdev->vq[i].signalled_used_valid = false; | ||
49 | vdev->vq[i].notification = true; | ||
50 | vdev->vq[i].vring.num = vdev->vq[i].vring.num_default; | ||
51 | + vdev->vq[i].inuse = 0; | ||
52 | } | ||
53 | } | ||
54 | |||
55 | -- | ||
56 | 2.9.3 | ||
57 | |||