diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch | 72 |
1 files changed, 0 insertions, 72 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch b/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch deleted file mode 100644 index 416771cdcb..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch +++ /dev/null | |||
@@ -1,72 +0,0 @@ | |||
1 | From 758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43 Mon Sep 17 00:00:00 2001 | ||
2 | From: Prasad J Pandit <pjp@fedoraproject.org> | ||
3 | Date: Wed, 29 Nov 2017 23:14:27 +0530 | ||
4 | Subject: [PATCH] virtio: check VirtQueue Vring object is set | ||
5 | |||
6 | A guest could attempt to use an uninitialised VirtQueue object | ||
7 | or unset Vring.align leading to a arithmetic exception. Add check | ||
8 | to avoid it. | ||
9 | |||
10 | Upstream-Status: Backport | ||
11 | CVE: CVE-2017-17381 | ||
12 | |||
13 | Reported-by: Zhangboxian <zhangboxian@huawei.com> | ||
14 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | ||
15 | Reviewed-by: Michael S. Tsirkin <mst@redhat.com> | ||
16 | Signed-off-by: Michael S. Tsirkin <mst@redhat.com> | ||
17 | Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
18 | Reviewed-by: Cornelia Huck <cohuck@redhat.com> | ||
19 | Signed-off-by: Catalin Enache <catalin.enache@windriver.com> | ||
20 | --- | ||
21 | hw/virtio/virtio.c | 14 +++++++++++--- | ||
22 | 1 file changed, 11 insertions(+), 3 deletions(-) | ||
23 | |||
24 | diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c | ||
25 | index 703e672..ad564b0 100644 | ||
26 | --- a/hw/virtio/virtio.c | ||
27 | +++ b/hw/virtio/virtio.c | ||
28 | @@ -182,7 +182,7 @@ void virtio_queue_update_rings(VirtIODevice *vdev, int n) | ||
29 | { | ||
30 | VRing *vring = &vdev->vq[n].vring; | ||
31 | |||
32 | - if (!vring->desc) { | ||
33 | + if (!vring->num || !vring->desc || !vring->align) { | ||
34 | /* not yet setup -> nothing to do */ | ||
35 | return; | ||
36 | } | ||
37 | @@ -1414,6 +1414,9 @@ void virtio_config_modern_writel(VirtIODevice *vdev, | ||
38 | |||
39 | void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr) | ||
40 | { | ||
41 | + if (!vdev->vq[n].vring.num) { | ||
42 | + return; | ||
43 | + } | ||
44 | vdev->vq[n].vring.desc = addr; | ||
45 | virtio_queue_update_rings(vdev, n); | ||
46 | } | ||
47 | @@ -1426,6 +1429,9 @@ hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n) | ||
48 | void virtio_queue_set_rings(VirtIODevice *vdev, int n, hwaddr desc, | ||
49 | hwaddr avail, hwaddr used) | ||
50 | { | ||
51 | + if (!vdev->vq[n].vring.num) { | ||
52 | + return; | ||
53 | + } | ||
54 | vdev->vq[n].vring.desc = desc; | ||
55 | vdev->vq[n].vring.avail = avail; | ||
56 | vdev->vq[n].vring.used = used; | ||
57 | @@ -1494,8 +1500,10 @@ void virtio_queue_set_align(VirtIODevice *vdev, int n, int align) | ||
58 | */ | ||
59 | assert(k->has_variable_vring_alignment); | ||
60 | |||
61 | - vdev->vq[n].vring.align = align; | ||
62 | - virtio_queue_update_rings(vdev, n); | ||
63 | + if (align) { | ||
64 | + vdev->vq[n].vring.align = align; | ||
65 | + virtio_queue_update_rings(vdev, n); | ||
66 | + } | ||
67 | } | ||
68 | |||
69 | static bool virtio_queue_notify_aio_vq(VirtQueue *vq) | ||
70 | -- | ||
71 | 2.10.2 | ||
72 | |||