diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2017-13711.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2017-13711.patch | 87 |
1 files changed, 87 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2017-13711.patch b/meta/recipes-devtools/qemu/qemu/CVE-2017-13711.patch new file mode 100644 index 0000000000..352f73f624 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2017-13711.patch | |||
@@ -0,0 +1,87 @@ | |||
1 | From 1201d308519f1e915866d7583d5136d03cc1d384 Mon Sep 17 00:00:00 2001 | ||
2 | From: Samuel Thibault <samuel.thibault@ens-lyon.org> | ||
3 | Date: Fri, 25 Aug 2017 01:35:53 +0200 | ||
4 | Subject: [PATCH] slirp: fix clearing ifq_so from pending packets | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | The if_fastq and if_batchq contain not only packets, but queues of packets | ||
10 | for the same socket. When sofree frees a socket, it thus has to clear ifq_so | ||
11 | from all the packets from the queues, not only the first. | ||
12 | |||
13 | Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> | ||
14 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
15 | Cc: qemu-stable@nongnu.org | ||
16 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
17 | |||
18 | Upstream-Status: Backport | ||
19 | [https://git.qemu.org/?p=qemu.git;a=commit;h=1201d308519f1e915866d7583d5136d03cc1d384] | ||
20 | |||
21 | CVE: CVE-2017-13711 | ||
22 | |||
23 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
24 | --- | ||
25 | slirp/socket.c | 39 +++++++++++++++++++++++---------------- | ||
26 | 1 file changed, 23 insertions(+), 16 deletions(-) | ||
27 | |||
28 | diff --git a/slirp/socket.c b/slirp/socket.c | ||
29 | index ecec029..cb7b5b6 100644 | ||
30 | --- a/slirp/socket.c | ||
31 | +++ b/slirp/socket.c | ||
32 | @@ -60,29 +60,36 @@ socreate(Slirp *slirp) | ||
33 | } | ||
34 | |||
35 | /* | ||
36 | + * Remove references to so from the given message queue. | ||
37 | + */ | ||
38 | +static void | ||
39 | +soqfree(struct socket *so, struct quehead *qh) | ||
40 | +{ | ||
41 | + struct mbuf *ifq; | ||
42 | + | ||
43 | + for (ifq = (struct mbuf *) qh->qh_link; | ||
44 | + (struct quehead *) ifq != qh; | ||
45 | + ifq = ifq->ifq_next) { | ||
46 | + if (ifq->ifq_so == so) { | ||
47 | + struct mbuf *ifm; | ||
48 | + ifq->ifq_so = NULL; | ||
49 | + for (ifm = ifq->ifs_next; ifm != ifq; ifm = ifm->ifs_next) { | ||
50 | + ifm->ifq_so = NULL; | ||
51 | + } | ||
52 | + } | ||
53 | + } | ||
54 | +} | ||
55 | + | ||
56 | +/* | ||
57 | * remque and free a socket, clobber cache | ||
58 | */ | ||
59 | void | ||
60 | sofree(struct socket *so) | ||
61 | { | ||
62 | Slirp *slirp = so->slirp; | ||
63 | - struct mbuf *ifm; | ||
64 | |||
65 | - for (ifm = (struct mbuf *) slirp->if_fastq.qh_link; | ||
66 | - (struct quehead *) ifm != &slirp->if_fastq; | ||
67 | - ifm = ifm->ifq_next) { | ||
68 | - if (ifm->ifq_so == so) { | ||
69 | - ifm->ifq_so = NULL; | ||
70 | - } | ||
71 | - } | ||
72 | - | ||
73 | - for (ifm = (struct mbuf *) slirp->if_batchq.qh_link; | ||
74 | - (struct quehead *) ifm != &slirp->if_batchq; | ||
75 | - ifm = ifm->ifq_next) { | ||
76 | - if (ifm->ifq_so == so) { | ||
77 | - ifm->ifq_so = NULL; | ||
78 | - } | ||
79 | - } | ||
80 | + soqfree(so, &slirp->if_fastq); | ||
81 | + soqfree(so, &slirp->if_batchq); | ||
82 | |||
83 | if (so->so_emu==EMU_RSH && so->extra) { | ||
84 | sofree(so->extra); | ||
85 | -- | ||
86 | 2.7.4 | ||
87 | |||