From 74771f8c41aaede0ddfb86983c6841bd1f1c1f0f Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Fri, 29 Jan 2016 12:35:21 -0800 Subject: qemu: Security fix CVE-2015-7295 CVE-2015-7295 Qemu: net: virtio-net possible remote DoS Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../qemu/qemu/CVE-2015-7295_1.patch | 63 ++++++++++++++++++++++ .../qemu/qemu/CVE-2015-7295_2.patch | 58 ++++++++++++++++++++ .../qemu/qemu/CVE-2015-7295_3.patch | 52 ++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.4.0.bb | 3 ++ 4 files changed, 176 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch (limited to 'meta') diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch new file mode 100644 index 0000000000..d7ae8713ca --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch @@ -0,0 +1,63 @@ +From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:28 +0800 +Subject: [PATCH] virtio: introduce virtqueue_unmap_sg() + +Factor out sg unmapping logic. This will be reused by the patch that +can discard descriptor. + +Cc: Michael S. Tsirkin +Cc: Andrew James +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin + +Upstream-Status: Backport + +git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c + +CVE: CVE-2015-7295 patch #1 +[Yocto # 9013] + +Signed-off-by: Armin Kuster + +--- + hw/virtio/virtio.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +Index: qemu-2.4.0/hw/virtio/virtio.c +=================================================================== +--- qemu-2.4.0.orig/hw/virtio/virtio.c ++++ qemu-2.4.0/hw/virtio/virtio.c +@@ -243,14 +243,12 @@ int virtio_queue_empty(VirtQueue *vq) + return vring_avail_idx(vq) == vq->last_avail_idx; + } + +-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, +- unsigned int len, unsigned int idx) ++static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) + { + unsigned int offset; + int i; + +- trace_virtqueue_fill(vq, elem, len, idx); +- + offset = 0; + for (i = 0; i < elem->in_num; i++) { + size_t size = MIN(len - offset, elem->in_sg[i].iov_len); +@@ -266,6 +264,14 @@ void virtqueue_fill(VirtQueue *vq, const + cpu_physical_memory_unmap(elem->out_sg[i].iov_base, + elem->out_sg[i].iov_len, + 0, elem->out_sg[i].iov_len); ++} ++ ++void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len, unsigned int idx) ++{ ++ trace_virtqueue_fill(vq, elem, len, idx); ++ ++ virtqueue_unmap_sg(vq, elem, len); + + idx = (idx + vring_used_idx(vq)) % vq->vring.num; + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch new file mode 100644 index 0000000000..45dfab36ef --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch @@ -0,0 +1,58 @@ +From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:29 +0800 +Subject: [PATCH] virtio: introduce virtqueue_discard() + +This patch introduces virtqueue_discard() to discard a descriptor and +unmap the sgs. This will be used by the patch that will discard +descriptor when packet is truncated. + +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Upstream-Status: Backport + +git.qemu.org/?p=qemu.git;a=commit;h=29b9f5efd78ae0f9cc02dd169b6e80d2c404bade + +CVE: CVE-2015-7295 patch #2 +[Yocto # 9013] + +Signed-off-by: Armin Kuster + +--- + hw/virtio/virtio.c | 7 +++++++ + include/hw/virtio/virtio.h | 2 ++ + 2 files changed, 9 insertions(+) + +Index: qemu-2.4.0/hw/virtio/virtio.c +=================================================================== +--- qemu-2.4.0.orig/hw/virtio/virtio.c ++++ qemu-2.4.0/hw/virtio/virtio.c +@@ -266,6 +266,13 @@ static void virtqueue_unmap_sg(VirtQueue + 0, elem->out_sg[i].iov_len); + } + ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) ++{ ++ vq->last_avail_idx--; ++ virtqueue_unmap_sg(vq, elem, len); ++} ++ + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx) + { +Index: qemu-2.4.0/include/hw/virtio/virtio.h +=================================================================== +--- qemu-2.4.0.orig/include/hw/virtio/virtio.h ++++ qemu-2.4.0/include/hw/virtio/virtio.h +@@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev + void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len); + void virtqueue_flush(VirtQueue *vq, unsigned int count); ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len); + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx); + diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch new file mode 100644 index 0000000000..74442e32f5 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch @@ -0,0 +1,52 @@ +From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:30 +0800 +Subject: [PATCH] virtio-net: correctly drop truncated packets + +When packet is truncated during receiving, we drop the packets but +neither discard the descriptor nor add and signal used +descriptor. This will lead several issues: + +- sg mappings are leaked +- rx will be stalled if a lots of packets were truncated + +In order to be consistent with vhost, fix by discarding the descriptor +in this case. + +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin + +Upstream-Status: Backport + +git.qemu.org/?p=qemu.git;a=commit;h=0cf33fb6b49a19de32859e2cdc6021334f448fb3 + +CVE: CVE-2015-7295 patch #3 +[Yocto # 9013] + +Signed-off-by: Armin Kuster + +--- + hw/net/virtio-net.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +Index: qemu-2.4.0/hw/net/virtio-net.c +=================================================================== +--- qemu-2.4.0.orig/hw/net/virtio-net.c ++++ qemu-2.4.0/hw/net/virtio-net.c +@@ -1086,13 +1086,7 @@ static ssize_t virtio_net_receive(NetCli + * must have consumed the complete packet. + * Otherwise, drop it. */ + if (!n->mergeable_rx_bufs && offset < size) { +-#if 0 +- error_report("virtio-net truncated non-mergeable packet: " +- "i %zd mergeable %d offset %zd, size %zd, " +- "guest hdr len %zd, host hdr len %zd", +- i, n->mergeable_rx_bufs, +- offset, size, n->guest_hdr_len, n->host_hdr_len); +-#endif ++ virtqueue_discard(q->rx_vq, &elem, total); + return size; + } + diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb index 6e6bd2b4b9..994ddff8a5 100644 --- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb @@ -15,6 +15,9 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ file://CVE-2015-7512.patch \ file://CVE-2015-8345.patch \ file://CVE-2016-1568.patch \ + file://CVE-2015-7295_1.patch \ + file://CVE-2015-7295_2.patch \ + file://CVE-2015-7295_3.patch \ " SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4" -- cgit 1.2.3-korg