summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoss Burton <ross.burton@arm.com>2022-09-22 13:39:54 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-09-22 21:37:56 +0100
commit943d28a3395455fd475cb6c84247d106adf5fca3 (patch)
tree756353928850cc85a744ce5735061020809ecaa8
parent09bcf6d2a661a3c39fdd13a760f6c26dd79abb69 (diff)
downloadopenembedded-core-contrib-943d28a3395455fd475cb6c84247d106adf5fca3.tar.gz
qemu: fix CVE-2022-2962
Backport the fix for CVE-2022-2962. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc1
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch64
2 files changed, 65 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 14e2a79235..659e70c0f4 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -27,6 +27,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \
file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \
file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \
+ file://0001-net-tulip-Restrict-DMA-engine-to-memories.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch b/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch
new file mode 100644
index 0000000000..6c85a77ba7
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch
@@ -0,0 +1,64 @@
+CVE: CVE-2022-2962
+Upstream-Status: Backport
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+From 5c5c50b0a73d78ffe18336c9996fef5eae9bbbb0 Mon Sep 17 00:00:00 2001
+From: Zheyu Ma <zheyuma97@gmail.com>
+Date: Sun, 21 Aug 2022 20:43:43 +0800
+Subject: [PATCH] net: tulip: Restrict DMA engine to memories
+
+The DMA engine is started by I/O access and then itself accesses the
+I/O registers, triggering a reentrancy bug.
+
+The following log can reveal it:
+==5637==ERROR: AddressSanitizer: stack-overflow
+ #0 0x5595435f6078 in tulip_xmit_list_update qemu/hw/net/tulip.c:673
+ #1 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13
+ #2 0x559544637f86 in memory_region_write_accessor qemu/softmmu/memory.c:492:5
+ #3 0x5595446379fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18
+ #4 0x5595446372fa in memory_region_dispatch_write qemu/softmmu/memory.c
+ #5 0x55954468b74c in flatview_write_continue qemu/softmmu/physmem.c:2825:23
+ #6 0x559544683662 in flatview_write qemu/softmmu/physmem.c:2867:12
+ #7 0x5595446833f3 in address_space_write qemu/softmmu/physmem.c:2963:18
+ #8 0x5595435fb082 in dma_memory_rw_relaxed qemu/include/sysemu/dma.h:87:12
+ #9 0x5595435fb082 in dma_memory_rw qemu/include/sysemu/dma.h:130:12
+ #10 0x5595435fb082 in dma_memory_write qemu/include/sysemu/dma.h:171:12
+ #11 0x5595435fb082 in stl_le_dma qemu/include/sysemu/dma.h:272:1
+ #12 0x5595435fb082 in stl_le_pci_dma qemu/include/hw/pci/pci.h:910:1
+ #13 0x5595435fb082 in tulip_desc_write qemu/hw/net/tulip.c:101:9
+ #14 0x5595435f7e3d in tulip_xmit_list_update qemu/hw/net/tulip.c:706:9
+ #15 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13
+
+Fix this bug by restricting the DMA engine to memories regions.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index 097e905bec..b9e42c322a 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -70,7 +70,7 @@ static const VMStateDescription vmstate_pci_tulip = {
+ static void tulip_desc_read(TULIPState *s, hwaddr p,
+ struct tulip_descriptor *desc)
+ {
+- const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
++ const MemTxAttrs attrs = { .memory = true };
+
+ if (s->csr[0] & CSR0_DBO) {
+ ldl_be_pci_dma(&s->dev, p, &desc->status, attrs);
+@@ -88,7 +88,7 @@ static void tulip_desc_read(TULIPState *s, hwaddr p,
+ static void tulip_desc_write(TULIPState *s, hwaddr p,
+ struct tulip_descriptor *desc)
+ {
+- const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
++ const MemTxAttrs attrs = { .memory = true };
+
+ if (s->csr[0] & CSR0_DBO) {
+ stl_be_pci_dma(&s->dev, p, desc->status, attrs);
+--
+2.34.1
+