diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0001-CVE-2023-40360-hw-nvme-fix-null-pointer-access-in-di.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/0001-CVE-2023-40360-hw-nvme-fix-null-pointer-access-in-di.patch b/meta/recipes-devtools/qemu/qemu/0001-CVE-2023-40360-hw-nvme-fix-null-pointer-access-in-di.patch new file mode 100644 index 0000000000..731b0281f4 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-CVE-2023-40360-hw-nvme-fix-null-pointer-access-in-di.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | From 83dd3da9fac872fac9739b9dcb96232c93675824 Mon Sep 17 00:00:00 2001 | ||
2 | From: Klaus Jensen <k.jensen@samsung.com> | ||
3 | Date: Tue, 8 Aug 2023 17:16:13 +0200 | ||
4 | Subject: [PATCH] CVE-2023-40360 hw/nvme: fix null pointer access in directive | ||
5 | receive | ||
6 | |||
7 | nvme_directive_receive() does not check if an endurance group has been | ||
8 | configured (set) prior to testing if flexible data placement is enabled | ||
9 | or not. | ||
10 | |||
11 | Fix this. | ||
12 | |||
13 | CVE: CVE-2023-40360 | ||
14 | Upstream-Status: Backport [https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee5211881426496da7b98] | ||
15 | Cc: qemu-stable@nongnu.org | ||
16 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1815 | ||
17 | Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") | ||
18 | Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com> | ||
19 | Signed-off-by: Klaus Jensen <k.jensen@samsung.com> | ||
20 | --- | ||
21 | hw/nvme/ctrl.c | 2 +- | ||
22 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
23 | |||
24 | diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c | ||
25 | index 2097fb131..36a2846c3 100644 | ||
26 | --- a/hw/nvme/ctrl.c | ||
27 | +++ b/hw/nvme/ctrl.c | ||
28 | @@ -6862,7 +6862,7 @@ static uint16_t nvme_directive_receive(NvmeCtrl *n, NvmeRequest *req) | ||
29 | case NVME_DIRECTIVE_IDENTIFY: | ||
30 | switch (doper) { | ||
31 | case NVME_DIRECTIVE_RETURN_PARAMS: | ||
32 | - if (ns->endgrp->fdp.enabled) { | ||
33 | + if (ns->endgrp && ns->endgrp->fdp.enabled) { | ||
34 | id.supported |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT; | ||
35 | id.enabled |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT; | ||
36 | id.persistent |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT; | ||
37 | -- | ||
38 | 2.42.0 | ||
39 | |||