|
 |
432cb7 |
From 2db3d0de1be018f14cb91fdd4a368996b09d8bec Mon Sep 17 00:00:00 2001
|
|
|
432cb7 |
From: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
Date: Wed, 13 Apr 2022 14:51:06 -0400
|
|
|
432cb7 |
Subject: [PATCH 1/3] hw/intc/arm_gicv3: Check for !MEMTX_OK instead of
|
|
|
432cb7 |
MEMTX_ERROR
|
|
|
432cb7 |
MIME-Version: 1.0
|
|
|
432cb7 |
Content-Type: text/plain; charset=UTF-8
|
|
|
432cb7 |
Content-Transfer-Encoding: 8bit
|
|
|
432cb7 |
|
|
|
432cb7 |
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
RH-MergeRequest: 151: hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR
|
|
|
432cb7 |
RH-Commit: [1/3] 561c9c2b1249f07d33013040b1c495ed1fbf825b (jmaloy/qemu-kvm)
|
|
|
432cb7 |
RH-Bugzilla: 1999236
|
|
|
432cb7 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
432cb7 |
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
|
432cb7 |
|
|
|
432cb7 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
|
|
|
432cb7 |
Upstream: Merged
|
|
|
432cb7 |
CVE: CVE-2021-3750
|
|
|
432cb7 |
|
|
|
432cb7 |
commit b9d383ab797f54ae5fa8746117770709921dc529
|
|
|
432cb7 |
Author: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
432cb7 |
Date: Wed Dec 15 19:24:19 2021 +0100
|
|
|
432cb7 |
|
|
|
432cb7 |
hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR
|
|
|
432cb7 |
|
|
|
432cb7 |
Quoting Peter Maydell:
|
|
|
432cb7 |
|
|
|
432cb7 |
"These MEMTX_* aren't from the memory transaction
|
|
|
432cb7 |
API functions; they're just being used by gicd_readl() and
|
|
|
432cb7 |
friends as a way to indicate a success/failure so that the
|
|
|
432cb7 |
actual MemoryRegionOps read/write fns like gicv3_dist_read()
|
|
|
432cb7 |
can log a guest error."
|
|
|
432cb7 |
|
|
|
432cb7 |
We are going to introduce more MemTxResult bits, so it is
|
|
|
432cb7 |
safer to check for !MEMTX_OK rather than MEMTX_ERROR.
|
|
|
432cb7 |
|
|
|
432cb7 |
Reviewed-by: Peter Xu <peterx@redhat.com>
|
|
|
432cb7 |
Reviewed-by: David Hildenbrand <david@redhat.com>
|
|
|
432cb7 |
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
432cb7 |
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
432cb7 |
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
432cb7 |
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
432cb7 |
|
|
|
432cb7 |
(cherry picked from commit b9d383ab797f54ae5fa8746117770709921dc529)
|
|
|
432cb7 |
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
---
|
|
|
432cb7 |
hw/intc/arm_gicv3_redist.c | 4 ++--
|
|
|
432cb7 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
432cb7 |
|
|
|
432cb7 |
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
|
|
|
432cb7 |
index c8ff3eca08..99b11ca5ee 100644
|
|
|
432cb7 |
--- a/hw/intc/arm_gicv3_redist.c
|
|
|
432cb7 |
+++ b/hw/intc/arm_gicv3_redist.c
|
|
|
432cb7 |
@@ -462,7 +462,7 @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
|
|
|
432cb7 |
break;
|
|
|
432cb7 |
}
|
|
|
432cb7 |
|
|
|
432cb7 |
- if (r == MEMTX_ERROR) {
|
|
|
432cb7 |
+ if (r != MEMTX_OK) {
|
|
|
432cb7 |
qemu_log_mask(LOG_GUEST_ERROR,
|
|
|
432cb7 |
"%s: invalid guest read at offset " TARGET_FMT_plx
|
|
|
432cb7 |
" size %u\n", __func__, offset, size);
|
|
|
432cb7 |
@@ -521,7 +521,7 @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
|
|
|
432cb7 |
break;
|
|
|
432cb7 |
}
|
|
|
432cb7 |
|
|
|
432cb7 |
- if (r == MEMTX_ERROR) {
|
|
|
432cb7 |
+ if (r != MEMTX_OK) {
|
|
|
432cb7 |
qemu_log_mask(LOG_GUEST_ERROR,
|
|
|
432cb7 |
"%s: invalid guest write at offset " TARGET_FMT_plx
|
|
|
432cb7 |
" size %u\n", __func__, offset, size);
|
|
|
432cb7 |
--
|
|
|
432cb7 |
2.27.0
|
|
|
432cb7 |
|