diff --git a/SOURCES/kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch b/SOURCES/kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch new file mode 100644 index 0000000..286031e --- /dev/null +++ b/SOURCES/kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch @@ -0,0 +1,115 @@ +From 1cd1297bf694c0a91d75a87b4fd22c2b80807b49 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 10 Feb 2017 08:30:14 +0100 +Subject: [PATCH 2/3] Revert "cirrus: allow zero source pitch in pattern fill + rops" + +RH-Author: Gerd Hoffmann +Message-id: <1486715415-3462-3-git-send-email-kraxel@redhat.com> +Patchwork-id: 73774 +O-Subject: [virt-devel] [RHEL-7.4 qemu-kvm PATCH 2/3] Revert "cirrus: allow zero source pitch in pattern fill rops" +Bugzilla: 1420490 +CVE: CVE-2017-2620/20170221 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Laurent Vivier + +This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. + +Signed-off-by: Miroslav Rezanina + +Conflicts: + hw/display/cirrus_vga.c + +Cc: Wolfgang Bumiller +Cc: Dr. David Alan Gilbert +Signed-off-by: Gerd Hoffmann + +Upstream: WIP (https://patchwork.ozlabs.org/patch/726074/) +--- + hw/display/cirrus_vga.c | 26 ++++++++------------------ + 1 file changed, 8 insertions(+), 18 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index fff9bf0..9a9501f 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -267,6 +267,9 @@ static void cirrus_update_memory_access(CirrusVGAState *s); + static bool blit_region_is_unsafe(struct CirrusVGAState *s, + int32_t pitch, int32_t addr) + { ++ if (!pitch) { ++ return true; ++ } + if (pitch < 0) { + int64_t min = addr + + ((int64_t)s->cirrus_blt_height - 1) * pitch +@@ -285,11 +288,8 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + return false; + } + +-static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, +- bool zero_src_pitch_ok) ++static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + { +- int32_t check_pitch; +- + /* should be the case, see cirrus_bitblt_start */ + assert(s->cirrus_blt_width > 0); + assert(s->cirrus_blt_height > 0); +@@ -298,10 +298,6 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, + return true; + } + +- if (!s->cirrus_blt_dstpitch) { +- return true; +- } +- + if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch, + s->cirrus_blt_dstaddr)) { + return true; +@@ -309,13 +305,7 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, + if (dst_only) { + return false; + } +- +- check_pitch = s->cirrus_blt_srcpitch; +- if (!zero_src_pitch_ok && !check_pitch) { +- check_pitch = s->cirrus_blt_width; +- } +- +- if (blit_region_is_unsafe(s, check_pitch, ++ if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, + s->cirrus_blt_srcaddr)) { + return true; + } +@@ -710,7 +700,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s, bool videosrc) + src = s->cirrus_bltbuf; + } + +- if (blit_is_unsafe(s, true, true)) { ++ if (blit_is_unsafe(s, true)) { + return 0; + } + +@@ -729,7 +719,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + { + cirrus_fill_t rop_func; + +- if (blit_is_unsafe(s, true, true)) { ++ if (blit_is_unsafe(s, true)) { + return 0; + } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; +@@ -829,7 +819,7 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (blit_is_unsafe(s, false, false)) ++ if (blit_is_unsafe(s, false)) + return 0; + + return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +-- +1.8.3.1 + diff --git a/SOURCES/kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch b/SOURCES/kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch new file mode 100644 index 0000000..9540f26 --- /dev/null +++ b/SOURCES/kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch @@ -0,0 +1,138 @@ +From 75255574498fad12727529c4ecbd4ccdabe86839 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:26 +0200 +Subject: [PATCH 4/8] balloon: fix segfault and harden the stats queue + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-5-git-send-email-lprosek@redhat.com> +Patchwork-id: 72483 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 4/6] balloon: fix segfault and harden the stats queue +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +The segfault here is triggered by the driver notifying the stats queue +twice after adding a buffer to it. This effectively resets stats_vq_elem +back to NULL and QEMU crashes on the next stats timer tick in +balloon_stats_poll_cb. + +This is a regression introduced in 51b19ebe4320f3dc, although admittedly +the device assumed too much about the stats queue protocol even before +that commit. This commit adds a few more checks and ensures that the one +stats buffer gets deallocated on device reset. + +Cc: qemu-stable@nongnu.org +Signed-off-by: Ladi Prosek +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 4eae2a657d1ff5ada56eb9b4966eae0eff333b0b) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina + +Conflicts: + * 1.5.3 does not return pointers from virtqueue_pop so only the + "harden the stats queue" part of the upstream patch description + applies + * a new field stats_vq_elem_pending is introduced to keep track + of the state of stats_vq_elem in lieu of its nullness upstream + * virtio_balloon_device_reset only resets stats_vq_elem_pending + because there is nothing to free +--- + hw/virtio/virtio-balloon.c | 27 +++++++++++++++++++++++---- + include/hw/virtio/virtio-balloon.h | 1 + + 2 files changed, 24 insertions(+), 4 deletions(-) + +diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c +index 016dc60..17b3029 100644 +--- a/hw/virtio/virtio-balloon.c ++++ b/hw/virtio/virtio-balloon.c +@@ -95,13 +95,14 @@ static void balloon_stats_poll_cb(void *opaque) + VirtIOBalloon *s = opaque; + VirtIODevice *vdev = VIRTIO_DEVICE(s); + +- if (!balloon_stats_supported(s)) { ++ if (!s->stats_vq_elem_pending || !balloon_stats_supported(s)) { + /* re-schedule */ + balloon_stats_change_timer(s, s->stats_poll_interval); + return; + } + + virtqueue_push(s->svq, &s->stats_vq_elem, s->stats_vq_offset); ++ s->stats_vq_elem_pending = false; + virtio_notify(vdev, s->svq); + } + +@@ -220,14 +221,22 @@ static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq) + static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq) + { + VirtIOBalloon *s = VIRTIO_BALLOON(vdev); +- VirtQueueElement *elem = &s->stats_vq_elem; ++ VirtQueueElement elem; + VirtIOBalloonStat stat; + size_t offset = 0; + qemu_timeval tv; + +- if (!virtqueue_pop(vq, elem)) { ++ if (!virtqueue_pop(vq, &elem)) { + goto out; + } ++ if (s->stats_vq_elem_pending) { ++ /* This should never happen if the driver follows the spec. */ ++ virtqueue_push(vq, &s->stats_vq_elem, 0); ++ virtio_notify(vdev, vq); ++ } ++ ++ s->stats_vq_elem = elem; ++ s->stats_vq_elem_pending = true; + + /* Initialize the stats to get rid of any stale values. This is only + * needed to handle the case where a guest supports fewer stats than it +@@ -235,7 +244,7 @@ static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq) + */ + reset_stats(s); + +- while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat)) ++ while (iov_to_buf(elem.out_sg, elem.out_num, offset, &stat, sizeof(stat)) + == sizeof(stat)) { + uint16_t tag = tswap16(stat.tag); + uint64_t val = tswap64(stat.val); +@@ -384,6 +393,15 @@ static void virtio_balloon_device_exit(VirtIODevice *vdev) + virtio_cleanup(vdev); + } + ++static void virtio_balloon_device_reset(VirtIODevice *vdev) ++{ ++ VirtIOBalloon *s = VIRTIO_BALLOON(vdev); ++ ++ if (s->stats_vq_elem_pending) { ++ s->stats_vq_elem_pending = false; ++ } ++} ++ + static Property virtio_balloon_properties[] = { + DEFINE_PROP_END_OF_LIST(), + }; +@@ -396,6 +414,7 @@ static void virtio_balloon_class_init(ObjectClass *klass, void *data) + set_bit(DEVICE_CATEGORY_MISC, dc->categories); + vdc->init = virtio_balloon_device_init; + vdc->exit = virtio_balloon_device_exit; ++ vdc->reset = virtio_balloon_device_reset; + vdc->get_config = virtio_balloon_get_config; + vdc->set_config = virtio_balloon_set_config; + vdc->get_features = virtio_balloon_get_features; +diff --git a/include/hw/virtio/virtio-balloon.h b/include/hw/virtio/virtio-balloon.h +index f863bfe..a84736b 100644 +--- a/include/hw/virtio/virtio-balloon.h ++++ b/include/hw/virtio/virtio-balloon.h +@@ -63,6 +63,7 @@ typedef struct VirtIOBalloon { + uint32_t actual; + uint64_t stats[VIRTIO_BALLOON_S_NR]; + VirtQueueElement stats_vq_elem; ++ bool stats_vq_elem_pending; + size_t stats_vq_offset; + QEMUTimer *stats_timer; + int64_t stats_last_update; +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch b/SOURCES/kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch new file mode 100644 index 0000000..6e2023a --- /dev/null +++ b/SOURCES/kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch @@ -0,0 +1,70 @@ +From e894ec03d7e6229488ae24d83809009162a0f9e0 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 10 Feb 2017 08:30:15 +0100 +Subject: [PATCH 3/3] cirrus: add blit_is_unsafe call to + cirrus_bitblt_cputovideo + +RH-Author: Gerd Hoffmann +Message-id: <1486715415-3462-4-git-send-email-kraxel@redhat.com> +Patchwork-id: 73773 +O-Subject: [virt-devel] [EMBARGOED RHEL-7.4 qemu-kvm PATCH 3/3] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo +Bugzilla: 1420490 +CVE: CVE-2017-2620/20170221 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Laurent Vivier +RH-Acked-by: Dr. David Alan Gilbert + +CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination +and blit width, at all. Oops. Fix it. + +Security impact: high. + +The missing blit destination check allows to write to host memory. +Basically same as CVE-2014-8106 for the other blit variants. + +The missing blit width check allows to overflow cirrus_bltbuf, +with the attractive target cirrus_srcptr (current cirrus_bltbuf write +position) being located right after cirrus_bltbuf in CirrusVGAState. + +Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker +hasn't full control over cirrus_srcptr though, only one byte can be +changed. Once the first byte has been modified further writes land +elsewhere. + +Signed-off-by: Gerd Hoffmann + +Upstream: TBD (embargoed until Feb 21st) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 9a9501f..1b972db 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -894,6 +894,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) + { + int w; + ++ if (blit_is_unsafe(s, true)) { ++ return 0; ++ } ++ + s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC; + s->cirrus_srcptr = &s->cirrus_bltbuf[0]; + s->cirrus_srcptr_end = &s->cirrus_bltbuf[0]; +@@ -919,6 +923,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) + } + s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height; + } ++ ++ /* the blit_is_unsafe call above should catch this */ ++ assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE); ++ + s->cirrus_srcptr = s->cirrus_bltbuf; + s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch; + cirrus_update_memory_access(s); +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch b/SOURCES/kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch new file mode 100644 index 0000000..ed65c41 --- /dev/null +++ b/SOURCES/kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch @@ -0,0 +1,115 @@ +From 9fd5f5b599e19c4485c3c7e6689081965e833df6 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:50 +0100 +Subject: [PATCH 6/8] cirrus: allow zero source pitch in pattern fill rops + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-6-git-send-email-kraxel@redhat.com> +Patchwork-id: 73569 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 5/7] cirrus: allow zero source pitch in pattern fill rops +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Wolfgang Bumiller + +The rops used by cirrus_bitblt_common_patterncopy only use +the destination pitch, so the source pitch shoul allowed to +be zero and the blit with used for the range check around the +source address. + +Signed-off-by: Wolfgang Bumiller +Message-id: 1485272138-23249-1-git-send-email-w.bumiller@proxmox.com +Signed-off-by: Gerd Hoffmann +(cherry picked from commit 5858dd1801883309bdd208d72ddb81c4e9fee30c) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index e09076a..b040ab1 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -267,9 +267,6 @@ static void cirrus_update_memory_access(CirrusVGAState *s); + static bool blit_region_is_unsafe(struct CirrusVGAState *s, + int32_t pitch, int32_t addr) + { +- if (!pitch) { +- return true; +- } + if (pitch < 0) { + int64_t min = addr + + ((int64_t)s->cirrus_blt_height-1) * pitch; +@@ -289,8 +286,11 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + return false; + } + +-static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) ++static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, ++ bool zero_src_pitch_ok) + { ++ int32_t check_pitch; ++ + /* should be the case, see cirrus_bitblt_start */ + assert(s->cirrus_blt_width > 0); + assert(s->cirrus_blt_height > 0); +@@ -299,6 +299,10 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + return true; + } + ++ if (!s->cirrus_blt_dstpitch) { ++ return true; ++ } ++ + if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch, + s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { + return true; +@@ -306,7 +310,13 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + if (dst_only) { + return false; + } +- if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, ++ ++ check_pitch = s->cirrus_blt_srcpitch; ++ if (!zero_src_pitch_ok && !check_pitch) { ++ check_pitch = s->cirrus_blt_width; ++ } ++ ++ if (blit_region_is_unsafe(s, check_pitch, + s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) { + return true; + } +@@ -676,8 +686,9 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, + + dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask); + +- if (blit_is_unsafe(s, false)) ++ if (blit_is_unsafe(s, false, true)) { + return 0; ++ } + + (*s->cirrus_rop) (s, dst, src, + s->cirrus_blt_dstpitch, 0, +@@ -694,7 +705,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + { + cirrus_fill_t rop_func; + +- if (blit_is_unsafe(s, true)) { ++ if (blit_is_unsafe(s, true, true)) { + return 0; + } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; +@@ -798,7 +809,7 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (blit_is_unsafe(s, false)) ++ if (blit_is_unsafe(s, false, false)) + return 0; + + return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-fix-blit-address-mask-handling.patch b/SOURCES/kvm-cirrus-fix-blit-address-mask-handling.patch new file mode 100644 index 0000000..8bc4b87 --- /dev/null +++ b/SOURCES/kvm-cirrus-fix-blit-address-mask-handling.patch @@ -0,0 +1,115 @@ +From fdb1ec384fe65b7ca2ab7303b56c2731e5999058 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:51 +0100 +Subject: [PATCH 7/8] cirrus: fix blit address mask handling + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-7-git-send-email-kraxel@redhat.com> +Patchwork-id: 73570 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 6/7] cirrus: fix blit address mask handling +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr +right after assigning them, in cirrus_bitblt_start(), instead of having +this all over the place in the cirrus code, and missing a few places. + +Reported-by: Wolfgang Bumiller +Signed-off-by: Gerd Hoffmann +Message-id: 1485338996-17095-1-git-send-email-kraxel@redhat.com +(cherry picked from commit 60cd23e85151525ab26591394c4e7e06fa07d216) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index b040ab1..6aa29a3 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -304,7 +304,7 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, + } + + if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch, +- s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { ++ s->cirrus_blt_dstaddr)) { + return true; + } + if (dst_only) { +@@ -317,7 +317,7 @@ static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only, + } + + if (blit_region_is_unsafe(s, check_pitch, +- s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) { ++ s->cirrus_blt_srcaddr)) { + return true; + } + +@@ -684,7 +684,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, + { + uint8_t *dst; + +- dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask); ++ dst = s->vga.vram_ptr + s->cirrus_blt_dstaddr; + + if (blit_is_unsafe(s, false, true)) { + return 0; +@@ -709,7 +709,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + return 0; + } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; +- rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask), ++ rop_func(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr, + s->cirrus_blt_dstpitch, + s->cirrus_blt_width, s->cirrus_blt_height); + cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, +@@ -727,9 +727,8 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + + static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s) + { +- return cirrus_bitblt_common_patterncopy(s, +- s->vga.vram_ptr + ((s->cirrus_blt_srcaddr & ~7) & +- s->cirrus_addr_mask)); ++ return cirrus_bitblt_common_patterncopy(s, s->vga.vram_ptr + ++ (s->cirrus_blt_srcaddr & ~7)); + } + + static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) +@@ -783,10 +782,8 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + if (notify) + graphic_hw_update(s->vga.con); + +- (*s->cirrus_rop) (s, s->vga.vram_ptr + +- (s->cirrus_blt_dstaddr & s->cirrus_addr_mask), +- s->vga.vram_ptr + +- (s->cirrus_blt_srcaddr & s->cirrus_addr_mask), ++ (*s->cirrus_rop) (s, s->vga.vram_ptr + s->cirrus_blt_dstaddr, ++ s->vga.vram_ptr + s->cirrus_blt_srcaddr, + s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch, + s->cirrus_blt_width, s->cirrus_blt_height); + +@@ -837,8 +834,7 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s) + } else { + /* at least one scan line */ + do { +- (*s->cirrus_rop)(s, s->vga.vram_ptr + +- (s->cirrus_blt_dstaddr & s->cirrus_addr_mask), ++ (*s->cirrus_rop)(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr, + s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1); + cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0, + s->cirrus_blt_width, 1); +@@ -957,6 +953,9 @@ static void cirrus_bitblt_start(CirrusVGAState * s) + s->cirrus_blt_modeext = s->vga.gr[0x33]; + blt_rop = s->vga.gr[0x32]; + ++ s->cirrus_blt_dstaddr &= s->cirrus_addr_mask; ++ s->cirrus_blt_srcaddr &= s->cirrus_addr_mask; ++ + #ifdef DEBUG_BITBLT + printf("rop=0x%02x mode=0x%02x modeext=0x%02x w=%d h=%d dpitch=%d spitch=%d daddr=0x%08x saddr=0x%08x writemask=0x%02x\n", + blt_rop, +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch b/SOURCES/kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch new file mode 100644 index 0000000..2e4cca6 --- /dev/null +++ b/SOURCES/kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch @@ -0,0 +1,61 @@ +From 55c542cca671a5a130c44359c73d1e908353418e Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:52 +0100 +Subject: [PATCH 8/8] cirrus: fix oob access issue (CVE-2017-2615) + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-8-git-send-email-kraxel@redhat.com> +Patchwork-id: 73565 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 7/7] cirrus: fix oob access issue (CVE-2017-2615) +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Li Qiang + +When doing bitblt copy in backward mode, we should minus the +blt width first just like the adding in the forward mode. This +can avoid the oob access of the front of vga's vram. + +Signed-off-by: Li Qiang + +{ kraxel: with backward blits (negative pitch) addr is the topmost + address, so check it as-is against vram size ] + +Cc: qemu-stable@nongnu.org +Cc: P J P +Cc: Laszlo Ersek +Cc: Paolo Bonzini +Cc: Wolfgang Bumiller +Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) +Signed-off-by: Gerd Hoffmann +Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com +Reviewed-by: Laszlo Ersek +(cherry picked from commit 62d4c6bd5263bb8413a06c80144fc678df6dfb64) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 6aa29a3..e0e39ef 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -269,10 +269,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + { + if (pitch < 0) { + int64_t min = addr +- + ((int64_t)s->cirrus_blt_height-1) * pitch; +- int32_t max = addr +- + s->cirrus_blt_width; +- if (min < 0 || max > s->vga.vram_size) { ++ + ((int64_t)s->cirrus_blt_height - 1) * pitch ++ - s->cirrus_blt_width; ++ if (min < -1 || addr >= s->vga.vram_size) { + return true; + } + } else { +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-fix-patterncopy-checks.patch b/SOURCES/kvm-cirrus-fix-patterncopy-checks.patch new file mode 100644 index 0000000..993204c --- /dev/null +++ b/SOURCES/kvm-cirrus-fix-patterncopy-checks.patch @@ -0,0 +1,113 @@ +From 46da39c9f9a9a72cf9e833d46ce10d785581ce63 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 10 Feb 2017 08:30:13 +0100 +Subject: [PATCH 1/3] cirrus: fix patterncopy checks + +RH-Author: Gerd Hoffmann +Message-id: <1486715415-3462-2-git-send-email-kraxel@redhat.com> +Patchwork-id: 73775 +O-Subject: [virt-devel] [RHEL-7.4 qemu-kvm PATCH 1/3] cirrus: fix patterncopy checks +Bugzilla: 1420490 +CVE: CVE-2017-2620/20170221 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Laurent Vivier + +The blit_region_is_unsafe checks don't work correctly for the +patterncopy source. It's a fixed-sized region, which doesn't +depend on cirrus_blt_{width,height}. So go do the check in +cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that +it doesn't need to verify the source. Also handle the case where we +blit from cirrus_bitbuf correctly. + +This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. + +Security impact: I think for the most part error on the safe side this +time, refusing blits which should have been allowed. + +Only exception is placing the blit source at the end of the video ram, +so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But +even in that case I'm not fully sure this actually allows read access to +host memory. To trick the commit 5858dd18 security checks one has to +pick very small cirrus_blt_{width,height} values, which in turn implies +only a fraction of the blit source will actually be used. + +Cc: Wolfgang Bumiller +Cc: Dr. David Alan Gilbert +Signed-off-by: Gerd Hoffmann + +Upstream: WIP (https://patchwork.ozlabs.org/patch/726080/) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 36 ++++++++++++++++++++++++++++++------ + 1 file changed, 30 insertions(+), 6 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index e0e39ef..fff9bf0 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -678,14 +678,39 @@ static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin, + } + } + +-static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, +- const uint8_t * src) ++static int cirrus_bitblt_common_patterncopy(CirrusVGAState *s, bool videosrc) + { ++ uint32_t patternsize; + uint8_t *dst; ++ uint8_t *src; + + dst = s->vga.vram_ptr + s->cirrus_blt_dstaddr; + +- if (blit_is_unsafe(s, false, true)) { ++ if (videosrc) { ++ switch (s->vga.get_bpp(&s->vga)) { ++ case 8: ++ patternsize = 64; ++ break; ++ case 15: ++ case 16: ++ patternsize = 128; ++ break; ++ case 24: ++ case 32: ++ default: ++ patternsize = 256; ++ break; ++ } ++ s->cirrus_blt_srcaddr &= ~(patternsize - 1); ++ if (s->cirrus_blt_srcaddr + patternsize > s->vga.vram_size) { ++ return 0; ++ } ++ src = s->vga.vram_ptr + s->cirrus_blt_srcaddr; ++ } else { ++ src = s->cirrus_bltbuf; ++ } ++ ++ if (blit_is_unsafe(s, true, true)) { + return 0; + } + +@@ -726,8 +751,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + + static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s) + { +- return cirrus_bitblt_common_patterncopy(s, s->vga.vram_ptr + +- (s->cirrus_blt_srcaddr & ~7)); ++ return cirrus_bitblt_common_patterncopy(s, true); + } + + static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) +@@ -826,7 +850,7 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s) + + if (s->cirrus_srccounter > 0) { + if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) { +- cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf); ++ cirrus_bitblt_common_patterncopy(s, false); + the_end: + s->cirrus_srccounter = 0; + cirrus_bitblt_reset(s); +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch b/SOURCES/kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch new file mode 100644 index 0000000..023cff5 --- /dev/null +++ b/SOURCES/kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch @@ -0,0 +1,64 @@ +From 1d7bdd730d1537f931a95897b14fdb6c5754ea2c Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:49 +0100 +Subject: [PATCH 5/8] cirrus: handle negative pitch in + cirrus_invalidate_region() + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-5-git-send-email-kraxel@redhat.com> +Patchwork-id: 73566 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 4/7] cirrus: handle negative pitch in cirrus_invalidate_region() +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Wolfgang Bumiller + +cirrus_invalidate_region() calls memory_region_set_dirty() +on a per-line basis, always ranging from off_begin to +off_begin+bytesperline. With a negative pitch off_begin +marks the top most used address and thus we need to do an +initial shift backwards by a line for negative pitches of +backward blits, otherwise the first iteration covers the +line going from the start offset forwards instead of +backwards. +Additionally since the start address is inclusive, if we +shift by a full `bytesperline` we move to the first address +*not* included in the blit, so we only shift by one less +than bytesperline. + +Signed-off-by: Wolfgang Bumiller +Message-id: 1485352137-29367-1-git-send-email-w.bumiller@proxmox.com + +[ kraxel: codestyle fixes ] + +Signed-off-by: Gerd Hoffmann +(cherry picked from commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index c8f2f26..e09076a 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -656,9 +656,14 @@ static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin, + int off_cur; + int off_cur_end; + ++ if (off_pitch < 0) { ++ off_begin -= bytesperline - 1; ++ } ++ + for (y = 0; y < lines; y++) { + off_cur = off_begin; + off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask; ++ assert(off_cur_end >= off_cur); + memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - off_cur); + off_begin += off_pitch; + } +-- +1.8.3.1 + diff --git a/SOURCES/kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch b/SOURCES/kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch new file mode 100644 index 0000000..5b0accf --- /dev/null +++ b/SOURCES/kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch @@ -0,0 +1,59 @@ +From 900ccf5cf6497234e1d3b1e80f4dfa8a60bcfb06 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:46 +0100 +Subject: [PATCH 2/8] cirrus_vga: fix off-by-one in blit_region_is_unsafe + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-2-git-send-email-kraxel@redhat.com> +Patchwork-id: 73564 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 1/7] cirrus_vga: fix off-by-one in blit_region_is_unsafe +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Paolo Bonzini + +The "max" value is being compared with >=, but addr + width points to +the first byte that will _not_ be copied. Laszlo suggested using a +"greater than" comparison, instead of subtracting one like it is +already done above for the height, so that max remains always positive. + +The mistake is "safe"---it will reject some blits, but will never cause +out-of-bounds writes. + +Cc: Gerd Hoffmann +Signed-off-by: Paolo Bonzini +Reviewed-by: Laszlo Ersek +Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com +Signed-off-by: Gerd Hoffmann +(cherry picked from commit d2ba7ecb348d3b996fcd920cf1ca7b72722c1dfd) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 717ecdb..c42dfcf 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -272,14 +272,14 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + + ((int64_t)s->cirrus_blt_height-1) * pitch; + int32_t max = addr + + s->cirrus_blt_width; +- if (min < 0 || max >= s->vga.vram_size) { ++ if (min < 0 || max > s->vga.vram_size) { + return true; + } + } else { + int64_t max = addr + + ((int64_t)s->cirrus_blt_height-1) * pitch + + s->cirrus_blt_width; +- if (max >= s->vga.vram_size) { ++ if (max > s->vga.vram_size) { + return true; + } + } +-- +1.8.3.1 + diff --git a/SOURCES/kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch b/SOURCES/kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch new file mode 100644 index 0000000..569f78a --- /dev/null +++ b/SOURCES/kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch @@ -0,0 +1,89 @@ +From e0ec8bdaf64a147c83334ae6f59e279c4560d01b Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:47 +0100 +Subject: [PATCH 3/8] display: cirrus: check vga bits per pixel(bpp) value + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-3-git-send-email-kraxel@redhat.com> +Patchwork-id: 73568 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 2/7] display: cirrus: check vga bits per pixel(bpp) value +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Prasad J Pandit + +In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, +'cirrus_get_bpp' returns zero(0), which could lead to a divide +by zero error in while copying pixel data. The same could occur +via blit pitch values. Add check to avoid it. + +Reported-by: Huawei PSIRT +Signed-off-by: Prasad J Pandit +Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com +Signed-off-by: Gerd Hoffmann +(cherry picked from commit 4299b90e9ba9ce5ca9024572804ba751aa1a7e70) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index c42dfcf..dacfac6 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -267,6 +267,9 @@ static void cirrus_update_memory_access(CirrusVGAState *s); + static bool blit_region_is_unsafe(struct CirrusVGAState *s, + int32_t pitch, int32_t addr) + { ++ if (!pitch) { ++ return true; ++ } + if (pitch < 0) { + int64_t min = addr + + ((int64_t)s->cirrus_blt_height-1) * pitch; +@@ -710,7 +713,7 @@ static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s) + s->cirrus_addr_mask)); + } + +-static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) ++static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + { + int sx = 0, sy = 0; + int dx = 0, dy = 0; +@@ -724,6 +727,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + int width, height; + + depth = s->vga.get_bpp(&s->vga) / 8; ++ if (!depth) { ++ return 0; ++ } + s->vga.get_resolution(&s->vga, &width, &height); + + /* extra x, y */ +@@ -778,6 +784,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, + s->cirrus_blt_dstpitch, s->cirrus_blt_width, + s->cirrus_blt_height); ++ ++ return 1; + } + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) +@@ -785,11 +793,9 @@ static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + if (blit_is_unsafe(s)) + return 0; + +- cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, ++ return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, + s->cirrus_blt_srcaddr - s->vga.start_addr, + s->cirrus_blt_width, s->cirrus_blt_height); +- +- return 1; + } + + /*************************************** +-- +1.8.3.1 + diff --git a/SOURCES/kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch b/SOURCES/kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch new file mode 100644 index 0000000..eeaf45f --- /dev/null +++ b/SOURCES/kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch @@ -0,0 +1,85 @@ +From 3178cae91f9fc3ddd025f1daa415b74ed387b6ca Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 7 Feb 2017 10:07:48 +0100 +Subject: [PATCH 4/8] display: cirrus: ignore source pitch value as needed in + blit_is_unsafe + +RH-Author: Gerd Hoffmann +Message-id: <1486462072-32174-4-git-send-email-kraxel@redhat.com> +Patchwork-id: 73563 +O-Subject: [RHEL-7.4 qemu-kvm PATCH 3/7] display: cirrus: ignore source pitch value as needed in blit_is_unsafe +Bugzilla: 1418232 +RH-Acked-by: Dr. David Alan Gilbert +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Miroslav Rezanina + +From: Bruce Rogers + +Commit 4299b90 added a check which is too broad, given that the source +pitch value is not required to be initialized for solid fill operations. +This patch refines the blit_is_unsafe() check to ignore source pitch in +that case. After applying the above commit as a security patch, we +noticed the SLES 11 SP4 guest gui failed to initialize properly. + +Signed-off-by: Bruce Rogers +Message-id: 20170109203520.5619-1-brogers@suse.com +Signed-off-by: Gerd Hoffmann +(cherry picked from commit 913a87885f589d263e682c2eb6637c6e14538061) +Signed-off-by: Miroslav Rezanina +--- + hw/display/cirrus_vga.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index dacfac6..c8f2f26 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -289,7 +289,7 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + return false; + } + +-static bool blit_is_unsafe(struct CirrusVGAState *s) ++static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + { + /* should be the case, see cirrus_bitblt_start */ + assert(s->cirrus_blt_width > 0); +@@ -303,6 +303,9 @@ static bool blit_is_unsafe(struct CirrusVGAState *s) + s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { + return true; + } ++ if (dst_only) { ++ return false; ++ } + if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, + s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) { + return true; +@@ -668,7 +671,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, + + dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask); + +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; + + (*s->cirrus_rop) (s, dst, src, +@@ -686,7 +689,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + { + cirrus_fill_t rop_func; + +- if (blit_is_unsafe(s)) { ++ if (blit_is_unsafe(s, true)) { + return 0; + } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; +@@ -790,7 +793,7 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; + + return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +-- +1.8.3.1 + diff --git a/SOURCES/kvm-net-check-packet-payload-length.patch b/SOURCES/kvm-net-check-packet-payload-length.patch new file mode 100644 index 0000000..5ef1070 --- /dev/null +++ b/SOURCES/kvm-net-check-packet-payload-length.patch @@ -0,0 +1,64 @@ +From 6d126da8f958c57413a4505d98cb4a3ff48cbbfe Mon Sep 17 00:00:00 2001 +From: "wexu@redhat.com" +Date: Wed, 21 Dec 2016 06:04:24 +0100 +Subject: [PATCH] net: check packet payload length + +RH-Author: wexu@redhat.com +Message-id: <1482300264-29708-2-git-send-email-wexu@redhat.com> +Patchwork-id: 73088 +O-Subject: [RHEL-7.4/7.3.z qemu-kvm Patch v2] net: check packet payload length +Bugzilla: 1398217 +RH-Acked-by: Laurent Vivier +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +From: Prasad J Pandit + +While computing IP checksum, 'net_checksum_calculate' reads +payload length from the packet. It could exceed the given 'data' +buffer size. Add a check to avoid it. + +This patch is to fix CVE-2016-2857. +https://access.redhat.com/security/cve/CVE-2016-2857 + +Reported-by: Liu Ling +Signed-off-by: Prasad J Pandit +Signed-off-by: Jason Wang +(cherry picked from commit 362786f14a753d8a5256ef97d7c10ed576d6572b) +Signed-off-by: Wei Xu +Signed-off-by: Miroslav Rezanina +--- + net/checksum.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/net/checksum.c b/net/checksum.c +index 14c0855..0942437 100644 +--- a/net/checksum.c ++++ b/net/checksum.c +@@ -59,6 +59,11 @@ void net_checksum_calculate(uint8_t *data, int length) + int hlen, plen, proto, csum_offset; + uint16_t csum; + ++ /* Ensure data has complete L2 & L3 headers. */ ++ if (length < 14 + 20) { ++ return; ++ } ++ + if ((data[14] & 0xf0) != 0x40) + return; /* not IPv4 */ + hlen = (data[14] & 0x0f) * 4; +@@ -76,8 +81,9 @@ void net_checksum_calculate(uint8_t *data, int length) + return; + } + +- if (plen < csum_offset+2) +- return; ++ if (plen < csum_offset + 2 || 14 + hlen + plen > length) { ++ return; ++ } + + data[14+hlen+csum_offset] = 0; + data[14+hlen+csum_offset+1] = 0; +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-add-virtqueue_rewind.patch b/SOURCES/kvm-virtio-add-virtqueue_rewind.patch new file mode 100644 index 0000000..1915e93 --- /dev/null +++ b/SOURCES/kvm-virtio-add-virtqueue_rewind.patch @@ -0,0 +1,86 @@ +From f7d6a76475d29e0edb5456e62492117b87f4bc41 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Thu, 10 Nov 2016 23:00:50 +0100 +Subject: [PATCH 7/8] virtio: add virtqueue_rewind() + +RH-Author: Ladi Prosek +Message-id: <1478797251-10302-1-git-send-email-lprosek@redhat.com> +Patchwork-id: 72818 +O-Subject: [PATCH v2 7/6] virtio: add virtqueue_rewind() +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Miroslav Rezanina + +From: Stefan Hajnoczi + +virtqueue_discard() requires a VirtQueueElement but virtio-balloon does +not migrate its in-use element. Introduce a new function that is +similar to virtqueue_discard() but doesn't require a VirtQueueElement. + +This will allow virtio-balloon to access element again after migration +with the usual proviso that the guest may have modified the vring since +last time. + +Cc: Michael S. Tsirkin +Cc: Roman Kagan +Cc: Stefan Hajnoczi +Signed-off-by: Ladi Prosek +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 297a75e6c55d91db2704a3d6e4029d99c7df51fd) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio.c | 22 ++++++++++++++++++++++ + include/hw/virtio/virtio.h | 1 + + 2 files changed, 23 insertions(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index cdb21b1..fe6b032 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -259,6 +259,28 @@ void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, + virtqueue_unmap_sg(vq, elem, len); + } + ++/* virtqueue_rewind: ++ * @vq: The #VirtQueue ++ * @num: Number of elements to push back ++ * ++ * Pretend that elements weren't popped from the virtqueue. The next ++ * virtqueue_pop() will refetch the oldest element. ++ * ++ * Use virtqueue_discard() instead if you have a VirtQueueElement. ++ * ++ * Returns: true on success, false if @num is greater than the number of in use ++ * elements. ++ */ ++bool virtqueue_rewind(VirtQueue *vq, unsigned int num) ++{ ++ if (num > vq->inuse) { ++ return false; ++ } ++ vq->last_avail_idx -= num; ++ vq->inuse -= num; ++ return true; ++} ++ + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx) + { +diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h +index de32425..d9bfe4c 100644 +--- a/include/hw/virtio/virtio.h ++++ b/include/hw/virtio/virtio.h +@@ -167,6 +167,7 @@ void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, + void virtqueue_flush(VirtQueue *vq, unsigned int count); + void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len); ++bool virtqueue_rewind(VirtQueue *vq, unsigned int num); + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx); + +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch b/SOURCES/kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch new file mode 100644 index 0000000..a076d4e --- /dev/null +++ b/SOURCES/kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch @@ -0,0 +1,54 @@ +From a1c91f04449eea0e678aeef78914213f092b7a19 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:27 +0200 +Subject: [PATCH 5/8] virtio-balloon: discard virtqueue element on reset + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-6-git-send-email-lprosek@redhat.com> +Patchwork-id: 72484 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 5/6] virtio-balloon: discard virtqueue element on reset +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +The one pending element is being freed but not discarded on device +reset, which causes svq->inuse to creep up, eventually hitting the +"Virtqueue size exceeded" error. + +Properly discarding the element on device reset makes sure that its +buffers are unmapped and the inuse counter stays balanced. + +Cc: Michael S. Tsirkin +Cc: Roman Kagan +Cc: Stefan Hajnoczi +Signed-off-by: Ladi Prosek +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 104e70cae78bd4afd95d948c6aff188f10508a9c) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina + +Conflicts: + * s->stats_vq_elem => &s->stats_vq_elem because the field is not + s pointer in 1.5.3 +--- + hw/virtio/virtio-balloon.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c +index 17b3029..faf93f7 100644 +--- a/hw/virtio/virtio-balloon.c ++++ b/hw/virtio/virtio-balloon.c +@@ -398,6 +398,7 @@ static void virtio_balloon_device_reset(VirtIODevice *vdev) + VirtIOBalloon *s = VIRTIO_BALLOON(vdev); + + if (s->stats_vq_elem_pending) { ++ virtqueue_discard(s->svq, &s->stats_vq_elem, 0); + s->stats_vq_elem_pending = false; + } + } +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-balloon-fix-stats-vq-migration.patch b/SOURCES/kvm-virtio-balloon-fix-stats-vq-migration.patch new file mode 100644 index 0000000..bd3b2e7 --- /dev/null +++ b/SOURCES/kvm-virtio-balloon-fix-stats-vq-migration.patch @@ -0,0 +1,75 @@ +From 6d5c0e0e98907244d72e7828337d7ff6160b6b80 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Thu, 10 Nov 2016 23:00:51 +0100 +Subject: [PATCH 8/8] virtio-balloon: fix stats vq migration + +RH-Author: Ladi Prosek +Message-id: <1478797251-10302-2-git-send-email-lprosek@redhat.com> +Patchwork-id: 72819 +O-Subject: [PATCH v2 8/6] virtio-balloon: fix stats vq migration +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Miroslav Rezanina + +The statistics virtqueue is not migrated properly because virtio-balloon +does not include s->stats_vq_elem in the migration stream. + +After migration the statistics virtqueue hangs because the host never +completes the last element (s->stats_vq_elem is NULL on the destination +QEMU). Therefore the guest never submits new elements and the virtqueue +is hung. + +Instead of changing the migration stream format in an incompatible way, +detect the migration case and rewind the virtqueue so the last element +can be completed. + +Cc: Michael S. Tsirkin +Cc: Roman Kagan +Cc: Stefan Hajnoczi +Suggested-by: Roman Kagan +Signed-off-by: Ladi Prosek +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 4a1e48becab81020adfb74b22c76a595f2d02a01) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio-balloon.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c +index faf93f7..1a60d3c 100644 +--- a/hw/virtio/virtio-balloon.c ++++ b/hw/virtio/virtio-balloon.c +@@ -403,6 +403,18 @@ static void virtio_balloon_device_reset(VirtIODevice *vdev) + } + } + ++static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status) ++{ ++ VirtIOBalloon *s = VIRTIO_BALLOON(vdev); ++ ++ if (!s->stats_vq_elem_pending && vdev->vm_running && ++ (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) { ++ /* poll stats queue for the element we have discarded when the VM ++ * was stopped */ ++ virtio_balloon_receive_stats(vdev, s->svq); ++ } ++} ++ + static Property virtio_balloon_properties[] = { + DEFINE_PROP_END_OF_LIST(), + }; +@@ -419,6 +431,7 @@ static void virtio_balloon_class_init(ObjectClass *klass, void *data) + vdc->get_config = virtio_balloon_get_config; + vdc->set_config = virtio_balloon_set_config; + vdc->get_features = virtio_balloon_get_features; ++ vdc->set_status = virtio_balloon_set_status; + } + + static const TypeInfo virtio_balloon_info = { +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch b/SOURCES/kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch new file mode 100644 index 0000000..a58ed36 --- /dev/null +++ b/SOURCES/kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch @@ -0,0 +1,68 @@ +From cc9a8ce29ba364abcf019f6fe44b218255b9e4d7 Mon Sep 17 00:00:00 2001 +From: Fam Zheng +Date: Wed, 8 Feb 2017 07:05:34 +0100 +Subject: [PATCH 1/8] virtio-blk: Release s->rq queue at system_reset + +RH-Author: Fam Zheng +Message-id: <20170208070534.10571-1-famz@redhat.com> +Patchwork-id: 73642 +O-Subject: [RHEL-7.3.z qemu-kvm PATCH] virtio-blk: Release s->rq queue at system_reset +Bugzilla: 1420049 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Laszlo Ersek +RH-Acked-by: Laurent Vivier + +At system_reset, there is no point in retrying the queued request, +because the driver that issued the request won't be around any more. + +Analyzed-by: Laszlo Ersek +Reported-by: Laszlo Ersek +Signed-off-by: Fam Zheng +Reviewed-by: Laszlo Ersek +Message-id: 1470278654-13525-2-git-send-email-famz@redhat.com +Signed-off-by: Stefan Hajnoczi +(cherry picked from commit 26307f6aa451708b8c60a49d605a78bbd29f70ef) + + Conflicts: + hw/block/virtio-blk.c + +The context is different. The hunk is placed below bdrv_drain_all() with +the comment updated to match downstream. + +There is no virtio_blk_free_request in qemu-kvm in RHEL 7, use g_free(). + +Signed-off-by: Fam Zheng +Signed-off-by: Miroslav Rezanina +--- + hw/block/virtio-blk.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c +index 4f6aa22..462ac81 100644 +--- a/hw/block/virtio-blk.c ++++ b/hw/block/virtio-blk.c +@@ -474,6 +474,7 @@ static void virtio_blk_dma_restart_cb(void *opaque, int running, + static void virtio_blk_reset(VirtIODevice *vdev) + { + VirtIOBlock *s = VIRTIO_BLK(vdev); ++ VirtIOBlockReq *req; + + #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE + if (s->dataplane) { +@@ -487,6 +488,13 @@ static void virtio_blk_reset(VirtIODevice *vdev) + */ + bdrv_drain_all(); + bdrv_set_enable_write_cache(s->bs, s->original_wce); ++ /* We drop queued requests after bdrv_drain_all() because bdrv_drain_all() ++ * itself can produce them. */ ++ while (s->rq) { ++ req = s->rq; ++ s->rq = req->next; ++ g_free(req); ++ } + } + + /* coalesce internal state, copy to pci i/o region 0 +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch b/SOURCES/kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch new file mode 100644 index 0000000..1822127 --- /dev/null +++ b/SOURCES/kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch @@ -0,0 +1,48 @@ +From c24e1c927bad95d84e0ffab665baff98d91fb916 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:25 +0200 +Subject: [PATCH 3/8] virtio: decrement vq->inuse in virtqueue_discard() + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-4-git-send-email-lprosek@redhat.com> +Patchwork-id: 72482 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 3/6] virtio: decrement vq->inuse in virtqueue_discard() +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +From: Stefan Hajnoczi + +virtqueue_discard() moves vq->last_avail_idx back so the element can be +popped again. It's necessary to decrement vq->inuse to avoid "leaking" +the element count. + +Cc: qemu-stable@nongnu.org +Signed-off-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Cornelia Huck +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 58a83c61496eeb0d31571a07a51bc1947e3379ac) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 91c9642..87a7639 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -255,6 +255,7 @@ void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len) + { + vq->last_avail_idx--; ++ vq->inuse--; + virtqueue_unmap_sg(vq, elem, len); + } + +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-introduce-virtqueue_discard.patch b/SOURCES/kvm-virtio-introduce-virtqueue_discard.patch new file mode 100644 index 0000000..8f233c6 --- /dev/null +++ b/SOURCES/kvm-virtio-introduce-virtqueue_discard.patch @@ -0,0 +1,66 @@ +From b5c6f7a910c5c16ac34ef2436d0a56991e0166e3 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:24 +0200 +Subject: [PATCH 2/8] virtio: introduce virtqueue_discard() + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-3-git-send-email-lprosek@redhat.com> +Patchwork-id: 72481 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 2/6] virtio: introduce virtqueue_discard() +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +From: Jason Wang + +This patch introduces virtqueue_discard() to discard a descriptor and +unmap the sgs. This will be used by the patch that will discard +descriptor when packet is truncated. + +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio.c | 7 +++++++ + include/hw/virtio/virtio.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 5ee899a..91c9642 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -251,6 +251,13 @@ static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, + 0, elem->out_sg[i].iov_len); + } + ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) ++{ ++ vq->last_avail_idx--; ++ virtqueue_unmap_sg(vq, elem, len); ++} ++ + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx) + { +diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h +index 9e22865..de32425 100644 +--- a/include/hw/virtio/virtio.h ++++ b/include/hw/virtio/virtio.h +@@ -165,6 +165,8 @@ void virtio_del_queue(VirtIODevice *vdev, int n); + void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len); + void virtqueue_flush(VirtQueue *vq, unsigned int count); ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len); + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx); + +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-introduce-virtqueue_unmap_sg.patch b/SOURCES/kvm-virtio-introduce-virtqueue_unmap_sg.patch new file mode 100644 index 0000000..77d40c9 --- /dev/null +++ b/SOURCES/kvm-virtio-introduce-virtqueue_unmap_sg.patch @@ -0,0 +1,70 @@ +From fc6f666f00182fe587068bd45e4e9e6d135d03fb Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:23 +0200 +Subject: [PATCH 1/8] virtio: introduce virtqueue_unmap_sg() + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-2-git-send-email-lprosek@redhat.com> +Patchwork-id: 72480 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 1/6] virtio: introduce virtqueue_unmap_sg() +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +From: Jason Wang + +Factor out sg unmapping logic. This will be reused by the patch that +can discard descriptor. + +Cc: Michael S. Tsirkin +Cc: Andrew James +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit ce317461573bac12b10d67699b4ddf1f97cf066c) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 0df4ed3..5ee899a 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -228,14 +228,12 @@ int virtio_queue_empty(VirtQueue *vq) + return vring_avail_idx(vq) == vq->last_avail_idx; + } + +-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, +- unsigned int len, unsigned int idx) ++static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) + { + unsigned int offset; + int i; + +- trace_virtqueue_fill(vq, elem, len, idx); +- + offset = 0; + for (i = 0; i < elem->in_num; i++) { + size_t size = MIN(len - offset, elem->in_sg[i].iov_len); +@@ -251,6 +249,14 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + cpu_physical_memory_unmap(elem->out_sg[i].iov_base, + elem->out_sg[i].iov_len, + 0, elem->out_sg[i].iov_len); ++} ++ ++void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len, unsigned int idx) ++{ ++ trace_virtqueue_fill(vq, elem, len, idx); ++ ++ virtqueue_unmap_sg(vq, elem, len); + + idx = (idx + vring_used_idx(vq)) % vq->vring.num; + +-- +1.8.3.1 + diff --git a/SOURCES/kvm-virtio-zero-vq-inuse-in-virtio_reset.patch b/SOURCES/kvm-virtio-zero-vq-inuse-in-virtio_reset.patch new file mode 100644 index 0000000..e231a0a --- /dev/null +++ b/SOURCES/kvm-virtio-zero-vq-inuse-in-virtio_reset.patch @@ -0,0 +1,63 @@ +From e3e5226d8ed3907bb818eb8db74175c08c011459 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek +Date: Wed, 5 Oct 2016 17:22:28 +0200 +Subject: [PATCH 6/8] virtio: zero vq->inuse in virtio_reset() + +RH-Author: Ladi Prosek +Message-id: <1475666548-9186-7-git-send-email-lprosek@redhat.com> +Patchwork-id: 72485 +O-Subject: [RHEL-7.4 qemu-kvm v2 PATCH 6/6] virtio: zero vq->inuse in virtio_reset() +Bugzilla: 1393484 +RH-Acked-by: Paolo Bonzini +RH-Acked-by: Michael S. Tsirkin +RH-Acked-by: Stefan Hajnoczi + +From: Stefan Hajnoczi + +vq->inuse must be zeroed upon device reset like most other virtqueue +fields. + +In theory, virtio_reset() just needs assert(vq->inuse == 0) since +devices must clean up in-flight requests during reset (requests cannot +not be leaked!). + +In practice, it is difficult to achieve vq->inuse == 0 across reset +because balloon, blk, 9p, etc implement various different strategies for +cleaning up requests. Most devices call g_free(elem) directly without +telling virtio.c that the VirtQueueElement is cleaned up. Therefore +vq->inuse is not decremented during reset. + +This patch zeroes vq->inuse and trusts that devices are not leaking +VirtQueueElements across reset. + +I will send a follow-up series that refactors request life-cycle across +all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but +this more invasive approach is not appropriate for stable trees. + +Signed-off-by: Stefan Hajnoczi +Cc: qemu-stable +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Ladi Prosek +(cherry picked from commit 4b7f91ed0270a371e1933efa21ba600b6da23ab9) +Signed-off-by: Ladi Prosek +Signed-off-by: Miroslav Rezanina +--- + hw/virtio/virtio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 87a7639..cdb21b1 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -585,6 +585,7 @@ void virtio_reset(void *opaque) + vdev->vq[i].signalled_used = 0; + vdev->vq[i].signalled_used_valid = false; + vdev->vq[i].notification = true; ++ vdev->vq[i].inuse = 0; + } + } + +-- +1.8.3.1 + diff --git a/SPECS/qemu-kvm.spec b/SPECS/qemu-kvm.spec index 0d88afb..66a2a5f 100644 --- a/SPECS/qemu-kvm.spec +++ b/SPECS/qemu-kvm.spec @@ -76,7 +76,7 @@ Obsoletes: %1 < %{obsoletes_version} \ Summary: QEMU is a FAST! processor emulator Name: %{pkgname}%{?pkgsuffix} Version: 1.5.3 -Release: 126%{?dist}.1 +Release: 126%{?dist}.5 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped Epoch: 10 License: GPLv2+ and LGPLv2+ and BSD @@ -3392,6 +3392,46 @@ Patch1666: kvm-virtio-recalculate-vq-inuse-after-migration.patch Patch1667: kvm-ide-fix-halted-IO-segfault-at-reset.patch # For bz#1392027 - shutdown rhel 5.11 guest failed and stop at "system halted" Patch1668: kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1669: kvm-virtio-introduce-virtqueue_unmap_sg.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1670: kvm-virtio-introduce-virtqueue_discard.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1671: kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1672: kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1673: kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1674: kvm-virtio-zero-vq-inuse-in-virtio_reset.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1675: kvm-virtio-add-virtqueue_rewind.patch +# For bz#1393484 - [RHEL7.3] KVM guest shuts itself down after 128th reboot +Patch1676: kvm-virtio-balloon-fix-stats-vq-migration.patch +# For bz#1398217 - CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z] +Patch1677: kvm-net-check-packet-payload-length.patch +# For bz#1420049 - system_reset should clear pending request for error (virtio-blk) +Patch1678: kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1679: kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1680: kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1681: kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1682: kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1683: kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1684: kvm-cirrus-fix-blit-address-mask-handling.patch +# For bz#1418232 - CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z] +Patch1685: kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch +# For bz#1420490 - EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z] +Patch1686: kvm-cirrus-fix-patterncopy-checks.patch +# For bz#1420490 - EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z] +Patch1687: kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch +# For bz#1420490 - EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z] +Patch1688: kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch BuildRequires: zlib-devel @@ -5240,6 +5280,26 @@ cp %{SOURCE18} pc-bios # keep "make check" happy %patch1666 -p1 %patch1667 -p1 %patch1668 -p1 +%patch1669 -p1 +%patch1670 -p1 +%patch1671 -p1 +%patch1672 -p1 +%patch1673 -p1 +%patch1674 -p1 +%patch1675 -p1 +%patch1676 -p1 +%patch1677 -p1 +%patch1678 -p1 +%patch1679 -p1 +%patch1680 -p1 +%patch1681 -p1 +%patch1682 -p1 +%patch1683 -p1 +%patch1684 -p1 +%patch1685 -p1 +%patch1686 -p1 +%patch1687 -p1 +%patch1688 -p1 %build buildarch="%{kvm_target}-softmmu" @@ -5685,6 +5745,44 @@ sh %{_sysconfdir}/sysconfig/modules/kvm.modules &> /dev/null || : %{_mandir}/man8/qemu-nbd.8* %changelog +* Mon Feb 13 2017 Miroslav Rezanina - 1.5.3-126.el7_3.5 +- kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490] +- kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490] +- kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490] +- Resolves: bz#1420490 + (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z]) + +* Fri Feb 10 2017 Miroslav Rezanina - 1.5.3-126.el7_3.4 +- kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049] +- kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232] +- kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232] +- kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232] +- kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232] +- kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232] +- kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232] +- kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232] +- Resolves: bz#1418232 + (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z]) +- Resolves: bz#1420049 + (system_reset should clear pending request for error (virtio-blk)) + +* Wed Jan 04 2017 Miroslav Rezanina - 1.5.3-126.el7_3.3 +- kvm-net-check-packet-payload-length.patch [bz#1398217] +- Resolves: bz#1398217 + (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z]) + +* Thu Nov 24 2016 Miroslav Rezanina - 1.5.3-126.el7_3.2 +- kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484] +- kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484] +- kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484] +- kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484] +- kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484] +- kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484] +- kvm-virtio-add-virtqueue_rewind.patch [bz#1393484] +- kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484] +- Resolves: bz#1393484 + ([RHEL7.3] KVM guest shuts itself down after 128th reboot) + * Fri Nov 11 2016 Miroslav Rezanina - 1.5.3-126.el7_3.1 - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042] - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]