From 14f04e6b6c1fa40a1c39cd186627b4b8442f2d5e Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Tue, 29 Oct 2019 10:47:32 +0100 Subject: qemu: update to 3.1.1.1 bug fix only update. Drop patches included in update. For full set of changes, see: https://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/tags/v3.1.1.1 Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../qemu/qemu/0016-fix-CVE-2018-20125.patch | 54 ---------------------- 1 file changed, 54 deletions(-) delete mode 100644 meta/recipes-devtools/qemu/qemu/0016-fix-CVE-2018-20125.patch (limited to 'meta/recipes-devtools/qemu/qemu/0016-fix-CVE-2018-20125.patch') diff --git a/meta/recipes-devtools/qemu/qemu/0016-fix-CVE-2018-20125.patch b/meta/recipes-devtools/qemu/qemu/0016-fix-CVE-2018-20125.patch deleted file mode 100644 index 56559c8388..0000000000 --- a/meta/recipes-devtools/qemu/qemu/0016-fix-CVE-2018-20125.patch +++ /dev/null @@ -1,54 +0,0 @@ -CVE: CVE-2018-20125 -Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=2c858ce] - -Signed-off-by: Kai Kang - -From 2c858ce5da8ae6689c75182b73bc455a291cad41 Mon Sep 17 00:00:00 2001 -From: Prasad J Pandit -Date: Thu, 13 Dec 2018 01:00:36 +0530 -Subject: [PATCH] pvrdma: check number of pages when creating rings - -When creating CQ/QP rings, an object can have up to -PVRDMA_MAX_FAST_REG_PAGES 8 pages. Check 'npages' parameter -to avoid excessive memory allocation or a null dereference. - -Reported-by: Li Qiang -Signed-off-by: Prasad J Pandit -Reviewed-by: Yuval Shaia -Signed-off-by: Marcel Apfelbaum ---- - hw/rdma/vmw/pvrdma_cmd.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c -index 3b94545761..f236ac4795 100644 ---- a/hw/rdma/vmw/pvrdma_cmd.c -+++ b/hw/rdma/vmw/pvrdma_cmd.c -@@ -259,6 +259,11 @@ static int create_cq_ring(PCIDevice *pci_dev , PvrdmaRing **ring, - int rc = -EINVAL; - char ring_name[MAX_RING_NAME_SZ]; - -+ if (!nchunks || nchunks > PVRDMA_MAX_FAST_REG_PAGES) { -+ pr_dbg("invalid nchunks: %d\n", nchunks); -+ return rc; -+ } -+ - pr_dbg("pdir_dma=0x%llx\n", (long long unsigned int)pdir_dma); - dir = rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); - if (!dir) { -@@ -372,6 +377,12 @@ static int create_qp_rings(PCIDevice *pci_dev, uint64_t pdir_dma, - char ring_name[MAX_RING_NAME_SZ]; - uint32_t wqe_sz; - -+ if (!spages || spages > PVRDMA_MAX_FAST_REG_PAGES -+ || !rpages || rpages > PVRDMA_MAX_FAST_REG_PAGES) { -+ pr_dbg("invalid pages: %d, %d\n", spages, rpages); -+ return rc; -+ } -+ - pr_dbg("pdir_dma=0x%llx\n", (long long unsigned int)pdir_dma); - dir = rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); - if (!dir) { --- -2.20.1 - -- cgit 1.2.3-korg