summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSakib Sajal <sakib.sajal@windriver.com>2021-04-23 00:45:03 -0400
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-04-24 17:53:05 +0100
commitea7850cd837571a58a10aa0d674a8ddbac1c337b (patch)
treeb3be3f90389661e49a8d5424d8966540f9683886
parent2c01852bcbf95729a8cfdf271dbe70e4aa093a77 (diff)
downloadpoky-ea7850cd837571a58a10aa0d674a8ddbac1c337b.tar.gz
qemu: fix CVE-2021-3409
(From OE-Core rev: e2fb8c15a64e1f5db678e8e95924da8c88a188c0) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc6
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_1.patch56
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_2.patch92
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_3.patch109
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_4.patch75
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_5.patch56
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2021-3409_6.patch99
7 files changed, 493 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index f118772208..0ac33f87fc 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -37,6 +37,12 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
37 file://CVE-2021-20181.patch \ 37 file://CVE-2021-20181.patch \
38 file://CVE-2020-29443.patch \ 38 file://CVE-2020-29443.patch \
39 file://CVE-2021-20221.patch \ 39 file://CVE-2021-20221.patch \
40 file://CVE-2021-3409_1.patch \
41 file://CVE-2021-3409_2.patch \
42 file://CVE-2021-3409_3.patch \
43 file://CVE-2021-3409_4.patch \
44 file://CVE-2021-3409_5.patch \
45 file://CVE-2021-3409_6.patch \
40 " 46 "
41UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 47UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
42 48
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_1.patch
new file mode 100644
index 0000000000..f9395add43
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_1.patch
@@ -0,0 +1,56 @@
1From c01ae9a35b3c6b4a8e1f1bfa0a0caafe394f8b5c Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Tue, 16 Feb 2021 11:46:52 +0800
4Subject: [PATCH 1/6] hw/sd: sdhci: Simplify updating s->prnsts in
5 sdhci_sdma_transfer_multi_blocks()
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10s->prnsts is updated in both branches of the if () else () statement.
11Move the common bits outside so that it is cleaner.
12
13Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
14Tested-by: Alexander Bulekov <alxndr@bu.edu>
15Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
16Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
17Message-Id: <1613447214-81951-5-git-send-email-bmeng.cn@gmail.com>
18Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
19
20Upstream-Status: Backport [8bc1f1aa51d32c3184e7b19d5b94c35ecc06f056]
21CVE: CVE-2021-3409
22
23Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
24---
25 hw/sd/sdhci.c | 7 +++----
26 1 file changed, 3 insertions(+), 4 deletions(-)
27
28diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
29index 2f8b74a84..f83c5e295 100644
30--- a/hw/sd/sdhci.c
31+++ b/hw/sd/sdhci.c
32@@ -596,9 +596,9 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
33 page_aligned = true;
34 }
35
36+ s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE;
37 if (s->trnmod & SDHC_TRNS_READ) {
38- s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
39- SDHC_DAT_LINE_ACTIVE;
40+ s->prnsts |= SDHC_DOING_READ;
41 while (s->blkcnt) {
42 if (s->data_count == 0) {
43 sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size);
44@@ -625,8 +625,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
45 }
46 }
47 } else {
48- s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT |
49- SDHC_DAT_LINE_ACTIVE;
50+ s->prnsts |= SDHC_DOING_WRITE;
51 while (s->blkcnt) {
52 begin = s->data_count;
53 if (((boundary_count + begin) < block_size) && page_aligned) {
54--
552.29.2
56
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_2.patch
new file mode 100644
index 0000000000..f3d2bb1375
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_2.patch
@@ -0,0 +1,92 @@
1From b9bb4700798bce98888c51d7b6dbc19ec49159d5 Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Wed, 3 Mar 2021 20:26:35 +0800
4Subject: [PATCH 2/6] hw/sd: sdhci: Don't transfer any data when command time
5 out
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10At the end of sdhci_send_command(), it starts a data transfer if the
11command register indicates data is associated. But the data transfer
12should only be initiated when the command execution has succeeded.
13
14With this fix, the following reproducer:
15
16outl 0xcf8 0x80001810
17outl 0xcfc 0xe1068000
18outl 0xcf8 0x80001804
19outw 0xcfc 0x7
20write 0xe106802c 0x1 0x0f
21write 0xe1068004 0xc 0x2801d10101fffffbff28a384
22write 0xe106800c 0x1f 0x9dacbbcad9e8f7061524334251606f7e8d9cabbac9d8e7f60514233241505f
23write 0xe1068003 0x28 0x80d000251480d000252280d000253080d000253e80d000254c80d000255a80d000256880d0002576
24write 0xe1068003 0x1 0xfe
25
26cannot be reproduced with the following QEMU command line:
27
28$ qemu-system-x86_64 -nographic -M pc-q35-5.0 \
29 -device sdhci-pci,sd-spec-version=3 \
30 -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
31 -device sd-card,drive=mydrive \
32 -monitor none -serial none -qtest stdio
33
34Cc: qemu-stable@nongnu.org
35Fixes: CVE-2020-17380
36Fixes: CVE-2020-25085
37Fixes: CVE-2021-3409
38Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller")
39Reported-by: Alexander Bulekov <alxndr@bu.edu>
40Reported-by: Cornelius Aschermann (Ruhr-Universität Bochum)
41Reported-by: Sergej Schumilo (Ruhr-Universität Bochum)
42Reported-by: Simon Wörner (Ruhr-Universität Bochum)
43Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
44Buglink: https://bugs.launchpad.net/qemu/+bug/1909418
45Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146
46Acked-by: Alistair Francis <alistair.francis@wdc.com>
47Tested-by: Alexander Bulekov <alxndr@bu.edu>
48Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
49Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
50Message-Id: <20210303122639.20004-2-bmeng.cn@gmail.com>
51Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
52
53Upstream-Status: Backport [b263d8f928001b5cfa2a993ea43b7a5b3a1811e8]
54CVE: CVE-2021-3409
55
56Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
57---
58 hw/sd/sdhci.c | 4 +++-
59 1 file changed, 3 insertions(+), 1 deletion(-)
60
61diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
62index f83c5e295..44f8a82ea 100644
63--- a/hw/sd/sdhci.c
64+++ b/hw/sd/sdhci.c
65@@ -326,6 +326,7 @@ static void sdhci_send_command(SDHCIState *s)
66 SDRequest request;
67 uint8_t response[16];
68 int rlen;
69+ bool timeout = false;
70
71 s->errintsts = 0;
72 s->acmd12errsts = 0;
73@@ -349,6 +350,7 @@ static void sdhci_send_command(SDHCIState *s)
74 trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
75 s->rspreg[1], s->rspreg[0]);
76 } else {
77+ timeout = true;
78 trace_sdhci_error("timeout waiting for command response");
79 if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
80 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
81@@ -369,7 +371,7 @@ static void sdhci_send_command(SDHCIState *s)
82
83 sdhci_update_irq(s);
84
85- if (s->blksize && (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
86+ if (!timeout && s->blksize && (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
87 s->data_count = 0;
88 sdhci_data_transfer(s);
89 }
90--
912.29.2
92
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_3.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_3.patch
new file mode 100644
index 0000000000..c3b37ed616
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_3.patch
@@ -0,0 +1,109 @@
1From 405ca416ccc8135544a4fe5732974497244128c9 Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Wed, 3 Mar 2021 20:26:36 +0800
4Subject: [PATCH 3/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when
5 transfer is in progress
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10Per "SD Host Controller Standard Specification Version 7.00"
11chapter 2.2.1 SDMA System Address Register:
12
13This register can be accessed only if no transaction is executing
14(i.e., after a transaction has stopped).
15
16With this fix, the following reproducer:
17
18outl 0xcf8 0x80001010
19outl 0xcfc 0xfbefff00
20outl 0xcf8 0x80001001
21outl 0xcfc 0x06000000
22write 0xfbefff2c 0x1 0x05
23write 0xfbefff0f 0x1 0x37
24write 0xfbefff0a 0x1 0x01
25write 0xfbefff0f 0x1 0x29
26write 0xfbefff0f 0x1 0x02
27write 0xfbefff0f 0x1 0x03
28write 0xfbefff04 0x1 0x01
29write 0xfbefff05 0x1 0x01
30write 0xfbefff07 0x1 0x02
31write 0xfbefff0c 0x1 0x33
32write 0xfbefff0e 0x1 0x20
33write 0xfbefff0f 0x1 0x00
34write 0xfbefff2a 0x1 0x01
35write 0xfbefff0c 0x1 0x00
36write 0xfbefff03 0x1 0x00
37write 0xfbefff05 0x1 0x00
38write 0xfbefff2a 0x1 0x02
39write 0xfbefff0c 0x1 0x32
40write 0xfbefff01 0x1 0x01
41write 0xfbefff02 0x1 0x01
42write 0xfbefff03 0x1 0x01
43
44cannot be reproduced with the following QEMU command line:
45
46$ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
47 -nodefaults -device sdhci-pci,sd-spec-version=3 \
48 -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
49 -device sd-card,drive=mydrive -qtest stdio
50
51Cc: qemu-stable@nongnu.org
52Fixes: CVE-2020-17380
53Fixes: CVE-2020-25085
54Fixes: CVE-2021-3409
55Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller")
56Reported-by: Alexander Bulekov <alxndr@bu.edu>
57Reported-by: Cornelius Aschermann (Ruhr-Universität Bochum)
58Reported-by: Sergej Schumilo (Ruhr-Universität Bochum)
59Reported-by: Simon Wörner (Ruhr-Universität Bochum)
60Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
61Buglink: https://bugs.launchpad.net/qemu/+bug/1909418
62Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146
63Tested-by: Alexander Bulekov <alxndr@bu.edu>
64Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
65Message-Id: <20210303122639.20004-3-bmeng.cn@gmail.com>
66Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
67
68Upstream-Status: Backport [8be45cc947832b3c02144c9d52921f499f2d77fe]
69CVE: CVE-2021-3409
70
71Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
72---
73 hw/sd/sdhci.c | 20 +++++++++++---------
74 1 file changed, 11 insertions(+), 9 deletions(-)
75
76diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
77index 44f8a82ea..d8a46f307 100644
78--- a/hw/sd/sdhci.c
79+++ b/hw/sd/sdhci.c
80@@ -1121,15 +1121,17 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
81
82 switch (offset & ~0x3) {
83 case SDHC_SYSAD:
84- s->sdmasysad = (s->sdmasysad & mask) | value;
85- MASKED_WRITE(s->sdmasysad, mask, value);
86- /* Writing to last byte of sdmasysad might trigger transfer */
87- if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt &&
88- s->blksize && SDHC_DMA_TYPE(s->hostctl1) == SDHC_CTRL_SDMA) {
89- if (s->trnmod & SDHC_TRNS_MULTI) {
90- sdhci_sdma_transfer_multi_blocks(s);
91- } else {
92- sdhci_sdma_transfer_single_block(s);
93+ if (!TRANSFERRING_DATA(s->prnsts)) {
94+ s->sdmasysad = (s->sdmasysad & mask) | value;
95+ MASKED_WRITE(s->sdmasysad, mask, value);
96+ /* Writing to last byte of sdmasysad might trigger transfer */
97+ if (!(mask & 0xFF000000) && s->blkcnt && s->blksize &&
98+ SDHC_DMA_TYPE(s->hostctl1) == SDHC_CTRL_SDMA) {
99+ if (s->trnmod & SDHC_TRNS_MULTI) {
100+ sdhci_sdma_transfer_multi_blocks(s);
101+ } else {
102+ sdhci_sdma_transfer_single_block(s);
103+ }
104 }
105 }
106 break;
107--
1082.29.2
109
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_4.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_4.patch
new file mode 100644
index 0000000000..d5be99759d
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_4.patch
@@ -0,0 +1,75 @@
1From b672bcaf5522294a4d8de3e88e0932d55585ee3b Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Wed, 3 Mar 2021 20:26:37 +0800
4Subject: [PATCH 4/6] hw/sd: sdhci: Correctly set the controller status for
5 ADMA
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10When an ADMA transfer is started, the codes forget to set the
11controller status to indicate a transfer is in progress.
12
13With this fix, the following 2 reproducers:
14
15https://paste.debian.net/plain/1185136
16https://paste.debian.net/plain/1185141
17
18cannot be reproduced with the following QEMU command line:
19
20$ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
21 -nodefaults -device sdhci-pci,sd-spec-version=3 \
22 -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
23 -device sd-card,drive=mydrive -qtest stdio
24
25Cc: qemu-stable@nongnu.org
26Fixes: CVE-2020-17380
27Fixes: CVE-2020-25085
28Fixes: CVE-2021-3409
29Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller")
30Reported-by: Alexander Bulekov <alxndr@bu.edu>
31Reported-by: Cornelius Aschermann (Ruhr-Universität Bochum)
32Reported-by: Sergej Schumilo (Ruhr-Universität Bochum)
33Reported-by: Simon Wörner (Ruhr-Universität Bochum)
34Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
35Buglink: https://bugs.launchpad.net/qemu/+bug/1909418
36Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146
37Tested-by: Alexander Bulekov <alxndr@bu.edu>
38Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
39Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
40Message-Id: <20210303122639.20004-4-bmeng.cn@gmail.com>
41Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
42
43Upstream-Status: Backport [bc6f28995ff88f5d82c38afcfd65406f0ae375aa]
44CVE: CVE-2021-3409
45
46Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
47---
48 hw/sd/sdhci.c | 3 +++
49 1 file changed, 3 insertions(+)
50
51diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
52index d8a46f307..7de03c6dd 100644
53--- a/hw/sd/sdhci.c
54+++ b/hw/sd/sdhci.c
55@@ -768,7 +768,9 @@ static void sdhci_do_adma(SDHCIState *s)
56
57 switch (dscr.attr & SDHC_ADMA_ATTR_ACT_MASK) {
58 case SDHC_ADMA_ATTR_ACT_TRAN: /* data transfer */
59+ s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE;
60 if (s->trnmod & SDHC_TRNS_READ) {
61+ s->prnsts |= SDHC_DOING_READ;
62 while (length) {
63 if (s->data_count == 0) {
64 sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size);
65@@ -796,6 +798,7 @@ static void sdhci_do_adma(SDHCIState *s)
66 }
67 }
68 } else {
69+ s->prnsts |= SDHC_DOING_WRITE;
70 while (length) {
71 begin = s->data_count;
72 if ((length + begin) < block_size) {
73--
742.29.2
75
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_5.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_5.patch
new file mode 100644
index 0000000000..7199056838
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_5.patch
@@ -0,0 +1,56 @@
1From c2298884cf6bcf2b047b4bae5f78432b052b5729 Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Wed, 3 Mar 2021 20:26:38 +0800
4Subject: [PATCH 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE
5 register is writable
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10The codes to limit the maximum block size is only necessary when
11SDHC_BLKSIZE register is writable.
12
13Tested-by: Alexander Bulekov <alxndr@bu.edu>
14Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
15Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
16Message-Id: <20210303122639.20004-5-bmeng.cn@gmail.com>
17Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
18
19Upstream-Status: Backport [5cd7aa3451b76bb19c0f6adc2b931f091e5d7fcd]
20CVE: CVE-2021-3409
21
22Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
23---
24 hw/sd/sdhci.c | 14 +++++++-------
25 1 file changed, 7 insertions(+), 7 deletions(-)
26
27diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
28index 7de03c6dd..6c780126e 100644
29--- a/hw/sd/sdhci.c
30+++ b/hw/sd/sdhci.c
31@@ -1142,15 +1142,15 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
32 if (!TRANSFERRING_DATA(s->prnsts)) {
33 MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
34 MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
35- }
36
37- /* Limit block size to the maximum buffer size */
38- if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
39- qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than "
40- "the maximum buffer 0x%x\n", __func__, s->blksize,
41- s->buf_maxsz);
42+ /* Limit block size to the maximum buffer size */
43+ if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
44+ qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than "
45+ "the maximum buffer 0x%x\n", __func__, s->blksize,
46+ s->buf_maxsz);
47
48- s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
49+ s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
50+ }
51 }
52
53 break;
54--
552.29.2
56
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_6.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_6.patch
new file mode 100644
index 0000000000..624c1f6496
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3409_6.patch
@@ -0,0 +1,99 @@
1From db916870a839346767b6d5ca7d0eed3128ba5fea Mon Sep 17 00:00:00 2001
2From: Bin Meng <bmeng.cn@gmail.com>
3Date: Wed, 3 Mar 2021 20:26:39 +0800
4Subject: [PATCH 6/6] hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[]
5 when a different block size is programmed
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10If the block size is programmed to a different value from the
11previous one, reset the data pointer of s->fifo_buffer[] so that
12s->fifo_buffer[] can be filled in using the new block size in
13the next transfer.
14
15With this fix, the following reproducer:
16
17outl 0xcf8 0x80001010
18outl 0xcfc 0xe0000000
19outl 0xcf8 0x80001001
20outl 0xcfc 0x06000000
21write 0xe000002c 0x1 0x05
22write 0xe0000005 0x1 0x02
23write 0xe0000007 0x1 0x01
24write 0xe0000028 0x1 0x10
25write 0x0 0x1 0x23
26write 0x2 0x1 0x08
27write 0xe000000c 0x1 0x01
28write 0xe000000e 0x1 0x20
29write 0xe000000f 0x1 0x00
30write 0xe000000c 0x1 0x32
31write 0xe0000004 0x2 0x0200
32write 0xe0000028 0x1 0x00
33write 0xe0000003 0x1 0x40
34
35cannot be reproduced with the following QEMU command line:
36
37$ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
38 -nodefaults -device sdhci-pci,sd-spec-version=3 \
39 -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
40 -device sd-card,drive=mydrive -qtest stdio
41
42Cc: qemu-stable@nongnu.org
43Fixes: CVE-2020-17380
44Fixes: CVE-2020-25085
45Fixes: CVE-2021-3409
46Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller")
47Reported-by: Alexander Bulekov <alxndr@bu.edu>
48Reported-by: Cornelius Aschermann (Ruhr-Universität Bochum)
49Reported-by: Sergej Schumilo (Ruhr-Universität Bochum)
50Reported-by: Simon Wörner (Ruhr-Universität Bochum)
51Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
52Buglink: https://bugs.launchpad.net/qemu/+bug/1909418
53Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146
54Tested-by: Alexander Bulekov <alxndr@bu.edu>
55Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
56Message-Id: <20210303122639.20004-6-bmeng.cn@gmail.com>
57Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
58
59Upstream-Status: Backport [cffb446e8fd19a14e1634c7a3a8b07be3f01d5c9]
60CVE: CVE-2021-3409
61
62Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
63---
64 hw/sd/sdhci.c | 12 ++++++++++++
65 1 file changed, 12 insertions(+)
66
67diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
68index 6c780126e..216842420 100644
69--- a/hw/sd/sdhci.c
70+++ b/hw/sd/sdhci.c
71@@ -1140,6 +1140,8 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
72 break;
73 case SDHC_BLKSIZE:
74 if (!TRANSFERRING_DATA(s->prnsts)) {
75+ uint16_t blksize = s->blksize;
76+
77 MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
78 MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
79
80@@ -1151,6 +1153,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
81
82 s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
83 }
84+
85+ /*
86+ * If the block size is programmed to a different value from
87+ * the previous one, reset the data pointer of s->fifo_buffer[]
88+ * so that s->fifo_buffer[] can be filled in using the new block
89+ * size in the next transfer.
90+ */
91+ if (blksize != s->blksize) {
92+ s->data_count = 0;
93+ }
94 }
95
96 break;
97--
982.29.2
99
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-02 15:06:42 +0000