Blame SOURCES/kvm-vmstate_xhci_event-fix-unterminated-field-list.patch

91048c
From 41d2d56a0fda46b582eab0845f064ba85c9c2456 Mon Sep 17 00:00:00 2001
91048c
From: Laszlo Ersek <lersek@redhat.com>
91048c
Date: Mon, 1 Sep 2014 13:36:52 +0200
91048c
Subject: [PATCH 1/6] vmstate_xhci_event: fix unterminated field list
91048c
91048c
Message-id: <1409578613-11909-2-git-send-email-lersek@redhat.com>
91048c
Patchwork-id: 60781
91048c
O-Subject: [PATCH RHEL-7.0.z/RHEL-7.1.0 qemu-kvm 1/2] vmstate_xhci_event: fix unterminated field list
91048c
Bugzilla: 1145055
91048c
RH-Acked-by: Amit Shah <amit.shah@redhat.com>
91048c
RH-Acked-by: Juan Quintela <quintela@redhat.com>
91048c
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
91048c
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
91048c
91048c
"vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live
91048c
migration support"), and first released in v1.6.0. The field list in this
91048c
VMSD is not terminated with the VMSTATE_END_OF_LIST() macro.
91048c
91048c
During normal use (ie. migration), the issue is practically invisible,
91048c
because the "vmstate_xhci_event" object (with the unterminated field list)
91048c
is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full()
91048c
returns true, for the "ev_buffer" test. Since that field_exists() check
91048c
(apparently) almost always returns false, we almost never traverse
91048c
"vmstate_xhci_event" during migration, which hides the bug.
91048c
91048c
However, Amit's vmstate checker forces recursion into this VMSD as well,
91048c
and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator
91048c
check (field->name != NULL) in dump_vmstate_vmsd(). The result is
91048c
undefined behavior, which in my case translates to infinite recursion
91048c
(because the loop happens to overflow into "vmstate_xhci_intr", which then
91048c
links back to "vmstate_xhci_event").
91048c
91048c
Add the missing terminator.
91048c
91048c
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
91048c
Reviewed-by: Amit Shah <amit.shah@redhat.com>
91048c
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
91048c
Cc: qemu-stable@nongnu.org
91048c
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
91048c
(cherry picked from commit 3afca1d6d413592c2b78cf28f52fa24a586d8f56)
91048c
91048c
RHEL-7 note: this is for CVE-2014-5263.
91048c
91048c
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
91048c
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
91048c
---
91048c
 hw/usb/hcd-xhci.c |    1 +
91048c
 1 files changed, 1 insertions(+), 0 deletions(-)
91048c
91048c
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
91048c
index 87ba7af..dbdf6b1 100644
91048c
--- a/hw/usb/hcd-xhci.c
91048c
+++ b/hw/usb/hcd-xhci.c
91048c
@@ -3526,6 +3526,7 @@ static const VMStateDescription vmstate_xhci_event = {
91048c
         VMSTATE_UINT32(flags,  XHCIEvent),
91048c
         VMSTATE_UINT8(slotid,  XHCIEvent),
91048c
         VMSTATE_UINT8(epid,    XHCIEvent),
91048c
+        VMSTATE_END_OF_LIST()
91048c
     }
91048c
 };
91048c
 
91048c
-- 
91048c
1.7.1
91048c