mirror of
https://git.yoctoproject.org/git/poky
synced 2026-01-04 16:10:04 +00:00
qemu: Security fix CVE-2015-7295
CVE-2015-7295 Qemu: net: virtio-net possible remote DoS (From OE-Core rev: 74771f8c41aaede0ddfb86983c6841bd1f1c1f0f) (From OE-Core rev: 3a7c84952d40f95b0f34bc35eef4490ecc8da07e) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
Richard Purdie
parent
27aeaab726
commit
3c686ae014
63
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch
Normal file
63
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001
|
||||
From: Jason Wang <jasowang@redhat.com>
|
||||
Date: Fri, 25 Sep 2015 13:21:28 +0800
|
||||
Subject: [PATCH] virtio: introduce virtqueue_unmap_sg()
|
||||
|
||||
Factor out sg unmapping logic. This will be reused by the patch that
|
||||
can discard descriptor.
|
||||
|
||||
Cc: Michael S. Tsirkin <mst@redhat.com>
|
||||
Cc: Andrew James <andrew.james@hpe.com>
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c
|
||||
|
||||
CVE: CVE-2015-7295 patch #1
|
||||
[Yocto # 9013]
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
||||
|
||||
---
|
||||
hw/virtio/virtio.c | 14 ++++++++++----
|
||||
1 file changed, 10 insertions(+), 4 deletions(-)
|
||||
|
||||
Index: qemu-2.2.0/hw/virtio/virtio.c
|
||||
===================================================================
|
||||
--- qemu-2.2.0.orig/hw/virtio/virtio.c
|
||||
+++ qemu-2.2.0/hw/virtio/virtio.c
|
||||
@@ -240,14 +240,12 @@ int virtio_queue_empty(VirtQueue *vq)
|
||||
return vring_avail_idx(vq) == vq->last_avail_idx;
|
||||
}
|
||||
|
||||
-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
- unsigned int len, unsigned int idx)
|
||||
+static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
+ unsigned int len)
|
||||
{
|
||||
unsigned int offset;
|
||||
int i;
|
||||
|
||||
- trace_virtqueue_fill(vq, elem, len, idx);
|
||||
-
|
||||
offset = 0;
|
||||
for (i = 0; i < elem->in_num; i++) {
|
||||
size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
|
||||
@@ -263,6 +261,14 @@ void virtqueue_fill(VirtQueue *vq, const
|
||||
cpu_physical_memory_unmap(elem->out_sg[i].iov_base,
|
||||
elem->out_sg[i].iov_len,
|
||||
0, elem->out_sg[i].iov_len);
|
||||
+}
|
||||
+
|
||||
+void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
+ unsigned int len, unsigned int idx)
|
||||
+{
|
||||
+ trace_virtqueue_fill(vq, elem, len, idx);
|
||||
+
|
||||
+ virtqueue_unmap_sg(vq, elem, len);
|
||||
|
||||
idx = (idx + vring_used_idx(vq)) % vq->vring.num;
|
||||
|
||||
58
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch
Normal file
58
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001
|
||||
From: Jason Wang <jasowang@redhat.com>
|
||||
Date: Fri, 25 Sep 2015 13:21:29 +0800
|
||||
Subject: [PATCH] virtio: introduce virtqueue_discard()
|
||||
|
||||
This patch introduces virtqueue_discard() to discard a descriptor and
|
||||
unmap the sgs. This will be used by the patch that will discard
|
||||
descriptor when packet is truncated.
|
||||
|
||||
Cc: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
Upstream-Status: Backport
|
||||
|
||||
git.qemu.org/?p=qemu.git;a=commit;h=29b9f5efd78ae0f9cc02dd169b6e80d2c404bade
|
||||
|
||||
CVE: CVE-2015-7295 patch #2
|
||||
[Yocto # 9013]
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
||||
|
||||
---
|
||||
hw/virtio/virtio.c | 7 +++++++
|
||||
include/hw/virtio/virtio.h | 2 ++
|
||||
2 files changed, 9 insertions(+)
|
||||
|
||||
Index: qemu-2.2.0/hw/virtio/virtio.c
|
||||
===================================================================
|
||||
--- qemu-2.2.0.orig/hw/virtio/virtio.c
|
||||
+++ qemu-2.2.0/hw/virtio/virtio.c
|
||||
@@ -263,6 +263,13 @@ static void virtqueue_unmap_sg(VirtQueue
|
||||
0, elem->out_sg[i].iov_len);
|
||||
}
|
||||
|
||||
+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
+ unsigned int len)
|
||||
+{
|
||||
+ vq->last_avail_idx--;
|
||||
+ virtqueue_unmap_sg(vq, elem, len);
|
||||
+}
|
||||
+
|
||||
void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
unsigned int len, unsigned int idx)
|
||||
{
|
||||
Index: qemu-2.2.0/include/hw/virtio/virtio.h
|
||||
===================================================================
|
||||
--- qemu-2.2.0.orig/include/hw/virtio/virtio.h
|
||||
+++ qemu-2.2.0/include/hw/virtio/virtio.h
|
||||
@@ -180,6 +180,8 @@ void virtio_del_queue(VirtIODevice *vdev
|
||||
void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
unsigned int len);
|
||||
void virtqueue_flush(VirtQueue *vq, unsigned int count);
|
||||
+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
+ unsigned int len);
|
||||
void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
|
||||
unsigned int len, unsigned int idx);
|
||||
|
||||
52
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch
Normal file
52
meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001
|
||||
From: Jason Wang <jasowang@redhat.com>
|
||||
Date: Fri, 25 Sep 2015 13:21:30 +0800
|
||||
Subject: [PATCH] virtio-net: correctly drop truncated packets
|
||||
|
||||
When packet is truncated during receiving, we drop the packets but
|
||||
neither discard the descriptor nor add and signal used
|
||||
descriptor. This will lead several issues:
|
||||
|
||||
- sg mappings are leaked
|
||||
- rx will be stalled if a lots of packets were truncated
|
||||
|
||||
In order to be consistent with vhost, fix by discarding the descriptor
|
||||
in this case.
|
||||
|
||||
Cc: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
git.qemu.org/?p=qemu.git;a=commit;h=0cf33fb6b49a19de32859e2cdc6021334f448fb3
|
||||
|
||||
CVE: CVE-2015-7295 patch #3
|
||||
[Yocto # 9013]
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
||||
|
||||
---
|
||||
hw/net/virtio-net.c | 8 +-------
|
||||
1 file changed, 1 insertion(+), 7 deletions(-)
|
||||
|
||||
Index: qemu-2.2.0/hw/net/virtio-net.c
|
||||
===================================================================
|
||||
--- qemu-2.2.0.orig/hw/net/virtio-net.c
|
||||
+++ qemu-2.2.0/hw/net/virtio-net.c
|
||||
@@ -1070,13 +1070,7 @@ static ssize_t virtio_net_receive(NetCli
|
||||
* must have consumed the complete packet.
|
||||
* Otherwise, drop it. */
|
||||
if (!n->mergeable_rx_bufs && offset < size) {
|
||||
-#if 0
|
||||
- error_report("virtio-net truncated non-mergeable packet: "
|
||||
- "i %zd mergeable %d offset %zd, size %zd, "
|
||||
- "guest hdr len %zd, host hdr len %zd",
|
||||
- i, n->mergeable_rx_bufs,
|
||||
- offset, size, n->guest_hdr_len, n->host_hdr_len);
|
||||
-#endif
|
||||
+ virtqueue_discard(q->rx_vq, &elem, total);
|
||||
return size;
|
||||
}
|
||||
|
||||
|
|
@ -25,6 +25,9 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
|
|||
file://CVE-2015-7512.patch \
|
||||
file://CVE-2015-8345.patch \
|
||||
file://CVE-2016-1568.patch \
|
||||
file://CVE-2015-7295_1.patch \
|
||||
file://CVE-2015-7295_2.patch \
|
||||
file://CVE-2015-7295_3.patch \
|
||||
"
|
||||
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
|
||||
SRC_URI[md5sum] = "f7a5e2da22d057eb838a91da7aff43c8"
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user