diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch | 114 |
1 files changed, 114 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch new file mode 100644 index 0000000000..db02210fa4 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-5088.patch | |||
@@ -0,0 +1,114 @@ | |||
1 | From 7d7512019fc40c577e2bdd61f114f31a9eb84a8e Mon Sep 17 00:00:00 2001 | ||
2 | From: Fiona Ebner <f.ebner@proxmox.com> | ||
3 | Date: Wed, 6 Sep 2023 15:09:21 +0200 | ||
4 | Subject: [PATCH] hw/ide: reset: cancel async DMA operation before resetting | ||
5 | state | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | If there is a pending DMA operation during ide_bus_reset(), the fact | ||
11 | that the IDEState is already reset before the operation is canceled | ||
12 | can be problematic. In particular, ide_dma_cb() might be called and | ||
13 | then use the reset IDEState which contains the signature after the | ||
14 | reset. When used to construct the IO operation this leads to | ||
15 | ide_get_sector() returning 0 and nsector being 1. This is particularly | ||
16 | bad, because a write command will thus destroy the first sector which | ||
17 | often contains a partition table or similar. | ||
18 | |||
19 | Traces showing the unsolicited write happening with IDEState | ||
20 | 0x5595af6949d0 being used after reset: | ||
21 | |||
22 | > ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300 | ||
23 | > ahci_reset_port ahci(0x5595af6923f0)[0]: reset port | ||
24 | > ide_reset IDEstate 0x5595af6949d0 | ||
25 | > ide_reset IDEstate 0x5595af694da8 | ||
26 | > ide_bus_reset_aio aio_cancel | ||
27 | > dma_aio_cancel dbs=0x7f64600089a0 | ||
28 | > dma_blk_cb dbs=0x7f64600089a0 ret=0 | ||
29 | > dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30 | ||
30 | > ahci_populate_sglist ahci(0x5595af6923f0)[0] | ||
31 | > ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512 | ||
32 | > ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE | ||
33 | > dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1 | ||
34 | > dma_blk_cb dbs=0x7f6420802010 ret=0 | ||
35 | |||
36 | > (gdb) p *qiov | ||
37 | > $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0, | ||
38 | > iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000", | ||
39 | > size = 512}}} | ||
40 | > (gdb) bt | ||
41 | > #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0, | ||
42 | > cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010) | ||
43 | > at ../block/block-backend.c:1682 | ||
44 | > #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>) | ||
45 | > at ../softmmu/dma-helpers.c:179 | ||
46 | > #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0, | ||
47 | > sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, | ||
48 | > io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>, | ||
49 | > io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30, | ||
50 | > cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0, | ||
51 | > dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244 | ||
52 | > #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30, | ||
53 | > sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, | ||
54 | > cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0) | ||
55 | > at ../softmmu/dma-helpers.c:280 | ||
56 | > #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>) | ||
57 | > at ../hw/ide/core.c:953 | ||
58 | > #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0) | ||
59 | > at ../softmmu/dma-helpers.c:107 | ||
60 | > #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127 | ||
61 | > #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10) | ||
62 | > at ../block/block-backend.c:1527 | ||
63 | > #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524 | ||
64 | > #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594 | ||
65 | > #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>, | ||
66 | > i1=<optimized out>) at ../util/coroutine-ucontext.c:177 | ||
67 | |||
68 | Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> | ||
69 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
70 | Tested-by: simon.rowe@nutanix.com | ||
71 | Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com> | ||
72 | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
73 | |||
74 | Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e] | ||
75 | CVE: CVE-2023-5088 | ||
76 | Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> | ||
77 | --- | ||
78 | hw/ide/core.c | 14 +++++++------- | ||
79 | 1 file changed, 7 insertions(+), 7 deletions(-) | ||
80 | |||
81 | diff --git a/hw/ide/core.c b/hw/ide/core.c | ||
82 | index b5e0dcd29b2..63ba665f3d2 100644 | ||
83 | --- a/hw/ide/core.c | ||
84 | +++ b/hw/ide/core.c | ||
85 | @@ -2515,19 +2515,19 @@ static void ide_dummy_transfer_stop(IDEState *s) | ||
86 | |||
87 | void ide_bus_reset(IDEBus *bus) | ||
88 | { | ||
89 | - bus->unit = 0; | ||
90 | - bus->cmd = 0; | ||
91 | - ide_reset(&bus->ifs[0]); | ||
92 | - ide_reset(&bus->ifs[1]); | ||
93 | - ide_clear_hob(bus); | ||
94 | - | ||
95 | - /* pending async DMA */ | ||
96 | + /* pending async DMA - needs the IDEState before it is reset */ | ||
97 | if (bus->dma->aiocb) { | ||
98 | trace_ide_bus_reset_aio(); | ||
99 | blk_aio_cancel(bus->dma->aiocb); | ||
100 | bus->dma->aiocb = NULL; | ||
101 | } | ||
102 | |||
103 | + bus->unit = 0; | ||
104 | + bus->cmd = 0; | ||
105 | + ide_reset(&bus->ifs[0]); | ||
106 | + ide_reset(&bus->ifs[1]); | ||
107 | + ide_clear_hob(bus); | ||
108 | + | ||
109 | /* reset dma provider too */ | ||
110 | if (bus->dma->ops->reset) { | ||
111 | bus->dma->ops->reset(bus->dma); | ||
112 | -- | ||
113 | GitLab | ||
114 | |||