cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
958e1b
From 713d4d69d84774949c7306289724c2463dbeab1d Mon Sep 17 00:00:00 2001
91048c
From: Laszlo Ersek <lersek@redhat.com>
91048c
Date: Mon, 1 Sep 2014 13:36:53 +0200
958e1b
Subject: [PATCH 06/12] vmstate_xhci_event: bug compat with RHEL-7.0 (RHEL only)
91048c
91048c
Message-id: <1409578613-11909-3-git-send-email-lersek@redhat.com>
91048c
Patchwork-id: 60782
91048c
O-Subject: [PATCH RHEL-7.0.z/RHEL-7.1.0 qemu-kvm 2/2] vmstate_xhci_event: bug compat with RHEL-7.0 (RHEL only)
958e1b
Bugzilla: 1122147
91048c
RH-Acked-by: Dr. David Alan Gilbert (git) <dgilbert@redhat.com>
91048c
RH-Acked-by: Amit Shah <amit.shah@redhat.com>
91048c
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
91048c
91048c
The "vmstate_xhci_event.fields" member is a pointer to an array of
91048c
VMStateField elements. The unnamed array (of static storage duration)
91048c
comes from a compound literal. The previous patch fixed the undefined
91048c
behavior by adding a terminator element to this array, but in RHEL-7 we
91048c
also need to look into the practical details of that undefined behavior.
91048c
91048c
In debug builds (./configure --enable-debug), the compiler places the
91048c
"vmstate_xhci_intr.fields" member's unnamed initializer array right after
91048c
the "vmstate_xhci_event.fields" member's. This leads to infinite recursion
91048c
(see the previous patch for details), but in RHEL-7 we don't ship debug
91048c
builds.
91048c
91048c
In a normal (optimized, official) build, the layout changes. The
91048c
"vmstate_xhci_event.fields" member's unterminated initializer array is
91048c
followed by the one of the "vmstate_xhci_slot.fields" member:
91048c
91048c
  (gdb) print (intptr_t)&vmstate_xhci_event.fields[7] - \
91048c
              (intptr_t)&vmstate_xhci_slot.fields[0]
91048c
  $3 = 0
91048c
91048c
where "vmstate_xhci_slot.fields" is initialized from
91048c
91048c
    .fields = (VMStateField[]) {
91048c
        VMSTATE_BOOL(enabled,   XHCISlot),
91048c
        VMSTATE_BOOL(addressed, XHCISlot),
91048c
        VMSTATE_END_OF_LIST()
91048c
    }
91048c
91048c
The elements of this array are (only relevant members quoted):
91048c
91048c
  (gdb) print vmstate_xhci_slot.fields[0].offset
91048c
  $16 = 0
91048c
  (gdb) print vmstate_xhci_slot.fields[0].size
91048c
  $17 = 1
91048c
  (gdb) print vmstate_xhci_slot.fields[1].offset
91048c
  $18 = 1
91048c
  (gdb) print vmstate_xhci_slot.fields[1].size
91048c
  $19 = 1
91048c
91048c
This means that the wire format for "vmstate_xhci_event" will include the
91048c
byte at offset 0 and the byte at offset 1 from XHCIEvent, corresponding to
91048c
part of the "XHCIEvent.type" member:
91048c
91048c
  (gdb) print vmstate_xhci_event.fields[0].name
91048c
  $23 = 0x5555558b12e7 "type"
91048c
  (gdb) print vmstate_xhci_event.fields[0].offset
91048c
  $24 = 0
91048c
  (gdb) print vmstate_xhci_event.fields[0].size
91048c
  $25 = 4
91048c
91048c
In order to accommodate these bogus bytes, coming from an unpatched source
91048c
side, we introduce two dummy XHCIEvent fields; otherwise the patched
91048c
destination would reject the migration stream.
91048c
91048c
For the reverse direction, we explicitly set the dummy bytes to the values
91048c
that they used to take in an unpatched source, so that when the unpatched
91048c
destination deserializes them into part of "XHCIEvent.type", said victim
91048c
member still receives a correct value.
91048c
91048c
The dummy fields have type uint8_t, not bool. The reason is that
91048c
assignment to bool (in xhci_event_pre_save()) would entail conversion to
91048c
bool, hence result in values 0 or 1. (See _Bool conversion rules and
91048c
<stdbool.h>.)
91048c
91048c
RHEL-only because we control the compiler version and the build flags only
91048c
in RHEL.
91048c
91048c
This is for CVE-2014-5263.
91048c
91048c
Suggested-by: Amit Shah <amit.shah@redhat.com>
91048c
Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
91048c
Suggested-by: Markus Armbruster <armbru@redhat.com>
91048c
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
91048c
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
91048c
---
91048c
 hw/usb/hcd-xhci.c |   27 ++++++++++++++++++++-------
91048c
 1 files changed, 20 insertions(+), 7 deletions(-)
91048c
91048c
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
958e1b
index 0ef2bc4..2c9e36a 100644
91048c
--- a/hw/usb/hcd-xhci.c
91048c
+++ b/hw/usb/hcd-xhci.c
91048c
@@ -420,6 +420,8 @@ typedef struct XHCIEvent {
91048c
     uint32_t flags;
91048c
     uint8_t slotid;
91048c
     uint8_t epid;
91048c
+    uint8_t cve_2014_5263_a;
91048c
+    uint8_t cve_2014_5263_b;
91048c
 } XHCIEvent;
91048c
 
91048c
 typedef struct XHCIInterrupter {
91048c
@@ -3515,17 +3517,28 @@ static const VMStateDescription vmstate_xhci_slot = {
91048c
     }
91048c
 };
91048c
 
91048c
+static void xhci_event_pre_save(void *opaque)
91048c
+{
91048c
+    XHCIEvent *s = opaque;
91048c
+
91048c
+    s->cve_2014_5263_a = ((uint8_t *)&s->type)[0];
91048c
+    s->cve_2014_5263_b = ((uint8_t *)&s->type)[1];
91048c
+}
91048c
+
91048c
 static const VMStateDescription vmstate_xhci_event = {
91048c
     .name = "xhci-event",
91048c
     .version_id = 1,
91048c
+    .pre_save = xhci_event_pre_save,
91048c
     .fields = (VMStateField[]) {
91048c
-        VMSTATE_UINT32(type,   XHCIEvent),
91048c
-        VMSTATE_UINT32(ccode,  XHCIEvent),
91048c
-        VMSTATE_UINT64(ptr,    XHCIEvent),
91048c
-        VMSTATE_UINT32(length, XHCIEvent),
91048c
-        VMSTATE_UINT32(flags,  XHCIEvent),
91048c
-        VMSTATE_UINT8(slotid,  XHCIEvent),
91048c
-        VMSTATE_UINT8(epid,    XHCIEvent),
91048c
+        VMSTATE_UINT32(type,           XHCIEvent),
91048c
+        VMSTATE_UINT32(ccode,          XHCIEvent),
91048c
+        VMSTATE_UINT64(ptr,            XHCIEvent),
91048c
+        VMSTATE_UINT32(length,         XHCIEvent),
91048c
+        VMSTATE_UINT32(flags,          XHCIEvent),
91048c
+        VMSTATE_UINT8(slotid,          XHCIEvent),
91048c
+        VMSTATE_UINT8(epid,            XHCIEvent),
91048c
+        VMSTATE_UINT8(cve_2014_5263_a, XHCIEvent),
91048c
+        VMSTATE_UINT8(cve_2014_5263_b, XHCIEvent),
91048c
         VMSTATE_END_OF_LIST()
91048c
     }
91048c
 };
91048c
-- 
91048c
1.7.1
91048c