aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-07-03dmg: sanitize chunk length and sectorcount (CVE-2014-0145)Stefan Hajnoczi
Chunk length and sectorcount are used for decompression buffers as well as the bdrv_pread() count argument. Ensure that they have reasonable values so neither memory allocation nor conversion from uint64_t to int will cause problems. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit c165f7758009a4f793c1fc19ebb69cf55313450b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: use appropriate types when reading chunksStefan Hajnoczi
Use the right types instead of signed int: size_t new_size; This is a byte count for g_realloc() that is calculated from uint32_t and size_t values. uint32_t chunk_count; Use the same type as s->n_chunks, which is used together with chunk_count. This patch is a cleanup and does not fix bugs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit eb71803b041f55779ea10d860c0f66df285c68de) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: drop broken bdrv_pread() loopStefan Hajnoczi
It is not necessary to check errno for EINTR and the block layer does not produce short reads. Therefore we can drop the loop that attempts to read a compressed chunk. The loop is buggy because it incorrectly adds the transferred bytes twice: do { ret = bdrv_pread(...); i += ret; } while (ret >= 0 && ret + i < s->lengths[chunk]); Luckily we can drop the loop completely and perform a single bdrv_pread(). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit b404bf854217dbe8a5649449eb3ad33777f7d900) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: prevent out-of-bounds array access on terminatorStefan Hajnoczi
When a terminator is reached the base for offsets and sectors is stored. The following records that are processed will use this base value. If the first record we encounter is a terminator, then calculating the base values would result in out-of-bounds array accesses. Don't do that. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 73ed27ec28a1dbebdd2ae792284151f029950fbe) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: coding style and indentation cleanupStefan Hajnoczi
Clean up the mix of tabs and spaces, as well as the coding style violations in block/dmg.c. There are no semantic changes since this patch simply reformats the code. This patch is necessary before we can make meaningful changes to this file, due to the inconsistent formatting and confusing indentation. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 2c1885adcf0312da80c7317b09f9adad97fa0fc6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix new L1 table size check (CVE-2014-0143)Kevin Wolf
The size in bytes is assigned to an int later, so check that instead of the number of entries. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit cab60de930684c33f67d4e32c7509b567f8c445b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Protect against some integer overflows in bdrv_checkKevin Wolf
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 0abe740f1de899737242bcba1fb4a9857f7a3087) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix types in qcow2_alloc_clusters and alloc_clusters_norefKevin Wolf
In order to avoid integer overflows. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit bb572aefbdac290363bfa5ca0e810ccce0a14ed6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Check new refcount table size on growthKevin Wolf
If the size becomes larger than what qcow2_open() would accept, fail the growing operation. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 2b5d5953eec0cc541857c3df812bdf8421596ab2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Avoid integer overflow in get_refcount (CVE-2014-0143)Kevin Wolf
This ensures that the checks catch all invalid cluster indexes instead of returning the refcount of a wrong cluster. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit db8a31d11d6a60f48d6817530640d75aa72a9a2f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Don't rely on free_cluster_index in alloc_refcount_block() ↵Kevin Wolf
(CVE-2014-0147) free_cluster_index is only correct if update_refcount() was called from an allocation function, and even there it's brittle because it's used to protect unfinished allocations which still have a refcount of 0 - if it moves in the wrong place, the unfinished allocation can be corrupted. So not using it any more seems to be a good idea. Instead, use the first requested cluster to do the calculations. Return -EAGAIN if unfinished allocations could become invalid and let the caller restart its search for some free clusters. The context of creating a snapsnot is one situation where update_refcount() is called outside of a cluster allocation. For this case, the change fixes a buffer overflow if a cluster is referenced in an L2 table that cannot be represented by an existing refcount block. (new_table[refcount_table_index] was out of bounds) [Bump the qemu-iotests 026 refblock_alloc.write leak count from 10 to 11. --Stefan] Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit b106ad9185f35fc4ad669555ad0e79e276083bd7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Zero-initialise first cluster for new imagesKevin Wolf
Strictly speaking, this is only required for has_zero_init() == false, but it's easy enough to just do a cluster-aligned write that is padded with zeros after the header. This fixes that after 'qemu-img create' header extensions are attempted to be parsed that are really just random leftover data. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit f8413b3c23b08a547ce18609acc6fae5fd04ed5c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: fix offset overflow in qcow2_alloc_clusters_at()Hu Tao
When cluster size is big enough it can lead to an offset overflow in qcow2_alloc_clusters_at(). This patch fixes it. The allocation is stopped each time at L2 table boundary (see handle_alloc()), so the possible maximum bytes could be 2^(cluster_bits - 3 + cluster_bits) cluster_bits - 3 is used to compute the number of entry by L2 and the additional cluster_bits is to take into account each clusters referenced by the L2 entries. so int is safe for cluster_bits<=17, unsafe otherwise. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 33304ec9fa484e765c6249673e09e1b7d49c5b85) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix backing file name length checkKevin Wolf
len could become negative and would pass the check then. Nothing bad happened because bdrv_pread() happens to return an error for negative length values, but make variables for sizes unsigned anyway. This patch also changes the behaviour to error out on invalid lengths instead of silently truncating it to 1023. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 6d33e8e7dc9d40ea105feed4b39caa3e641569e8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Validate active L1 table offset and size (CVE-2014-0144)Kevin Wolf
This avoids an unbounded allocation. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 2d51c32c4b511db8bb9e58208f1e2c25e4c06c85) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Validate snapshot table offset/size (CVE-2014-0144)Kevin Wolf
This avoid unbounded memory allocation and fixes a potential buffer overflow on 32 bit hosts. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit ce48f2f441ca98885267af6fd636a7cb804ee646) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Validate refcount table offsetKevin Wolf
The end of the refcount table must not exceed INT64_MAX so that integer overflows are avoided. Also check for misaligned refcount table. Such images are invalid and probably the result of data corruption. Error out to avoid further corruption. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 8c7de28305a514d7f879fdfc677ca11fbf60d2e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Check refcount table size (CVE-2014-0144)Kevin Wolf
Limit the in-memory reference count table size to 8 MB, it's enough in practice. This fixes an unbounded allocation as well as a buffer overflow in qcow2_refcount_init(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 5dab2faddc8eaa1fb1abdbe2f502001fc13a1b21) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Check backing_file_offset (CVE-2014-0144)Kevin Wolf
Header, header extension and the backing file name must all be stored in the first cluster. Setting the backing file to a much higher value allowed header extensions to become much bigger than we want them to be (unbounded allocation). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit a1b3955c9415b1e767c130a2f59fee6aa28e575b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Check header_length (CVE-2014-0144)Kevin Wolf
This fixes an unbounded allocation for s->unknown_header_fields. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 24342f2cae47d03911e346fe1e520b00dc2818e0) Conflicts: tests/qemu-iotests/group *fixed context mismatches in group file Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03curl: check data size before memcpy to local buffer. (CVE-2014-0144)Fam Zheng
curl_read_cb is callback function for libcurl when data arrives. The data size passed in here is not guaranteed to be within the range of request we submitted, so we may overflow the guest IO buffer. Check the real size we have before memcpy to buffer to avoid overflow. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 6d4b9e55fc625514a38d27cff4b9933f617fa7dc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)Jeff Cody
Other variables (e.g. sectors_per_block) are calculated using these variables, and if not range-checked illegal values could be obtained causing infinite loops and other potential issues when calculating BAT entries. The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB. LogicalSectorSize is required to be either 512 or 4096 bytes. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 1d7678dec4761acdc43439da6ceda41a703ba1a6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03vdi: add bounds checks for blocks_in_image and disk_size header fields ↵Jeff Cody
(CVE-2014-0144) The maximum blocks_in_image is 0xffffffff / 4, which also limits the maximum disk_size for a VDI image to 1024TB. Note that this is the maximum size that QEMU will currently support with this driver, not necessarily the maximum size allowed by the image format. This also fixes an incorrect error message, a bug introduced by commit 5b7aa9b56d1bfc79916262f380c3fc7961becb50 (Reported by Stefan Weil) Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 63fa06dc978f3669dbfd9443b33cde9e2a7f4b41) Conflicts: block/vdi.c *modified to retain 1.7's usage of logout() over error_setg() Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03vpc: Validate block size (CVE-2014-0142)Kevin Wolf
This fixes some cases of division by zero crashes. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 5e71dfad763d67bb64be79e20e93411c0c30ad25) Conflicts: tests/qemu-iotests/group *fixed context mismatches in group file Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)Jeff Cody
This adds checks to make sure that max_table_entries and block_size are in sane ranges. Memory is allocated based on max_table_entries, and block_size is used to calculate indices into that allocated memory, so if these values are incorrect that can lead to potential unbounded memory allocation, or invalid memory accesses. Also, the allocation of the pagetable is changed from g_malloc0() to qemu_blockalign(). Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 97f1c45c6f456572e5b504b8614e4a69e23b8e3a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03bochs: Fix bitmap offset calculationKevin Wolf
32 bit truncation could let us access the wrong offset in the image. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit a9ba36a45dfac645a810c31ce15ab393b69d820a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03bochs: Check extent_size header field (CVE-2014-0142)Kevin Wolf
This fixes two possible division by zero crashes: In bochs_open() and in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 8e53abbc20d08ae3ec30c2054e1161314ad9501d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03bochs: Check catalog_size header field (CVE-2014-0143)Kevin Wolf
It should neither become negative nor allow unbounded memory allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap buffer overflow on big endian hosts. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit e3737b820b45e54b059656dc3f914f895ac7a88b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)Kevin Wolf
Gets us rid of integer overflows resulting in negative sizes which aren't correctly checked. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 246f65838d19db6db55bfb41117c35645a2c4789) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03bochs: Unify header structs and make them QEMU_PACKEDKevin Wolf
This is an on-disk structure, so offsets must be accurate. Before this patch, sizeof(bochs) != sizeof(header_v1), which makes the memcpy() between both invalid. We're lucky enough that the destination buffer happened to be the larger one, and the memcpy size to be taken from the smaller one, so we didn't get a buffer overflow in practice. This patch unifies the both structures, eliminating the need to do a memcpy in the first place. The common fields are extracted to the top level of the struct and the actually differing part gets a union of the two versions. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 3dd8a6763bcc50dfc3de8da9279b741c0dea9fb1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qemu-iotests: Support for bochs formatKevin Wolf
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 24f3078a049c52070adfc659fc3a1a71a11a7765) Conflicts: tests/qemu-iotests/group *fix context mismatches in group file Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/cloop: fix offsets[] size off-by-oneStefan Hajnoczi
cloop stores the number of compressed blocks in the n_blocks header field. The file actually contains n_blocks + 1 offsets, where the extra offset is the end-of-file offset. The following line in cloop_read_block() results in an out-of-bounds offsets[] access: uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num]; This patch allocates and loads the extra offset so that cloop_read_block() works correctly when the last block is accessed. Notice that we must free s->offsets[] unconditionally now since there is always an end-of-file offset. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 42d43d35d907579179a39c924d169da924786f65) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/cloop: refuse images with bogus offsets (CVE-2014-0144)Stefan Hajnoczi
The offsets[] array allows efficient seeking and tells us the maximum compressed data size. If the offsets are bogus the maximum compressed data size will be unrealistic. This could cause g_malloc() to abort and bogus offsets mean the image is broken anyway. Therefore we should refuse such images. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit f56b9bc3ae20fc93815b34aa022be919941406ce) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)Stefan Hajnoczi
Limit offsets_size to 512 MB so that: 1. g_malloc() does not abort due to an unreasonable size argument. 2. offsets_size does not overflow the bdrv_pread() int size argument. This limit imposes a maximum image size of 16 TB at 256 KB block size. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 7b103b36d6ef3b11827c203d3a793bf7da50ecd6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/cloop: prevent offsets_size integer overflow (CVE-2014-0143)Stefan Hajnoczi
The following integer overflow in offsets_size can lead to out-of-bounds memory stores when n_blocks has a huge value: uint32_t n_blocks, offsets_size; [...] ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4); [...] s->n_blocks = be32_to_cpu(s->n_blocks); /* read offsets */ offsets_size = s->n_blocks * sizeof(uint64_t); s->offsets = g_malloc(offsets_size); [...] for(i=0;i<s->n_blocks;i++) { s->offsets[i] = be64_to_cpu(s->offsets[i]); offsets_size can be smaller than n_blocks due to integer overflow. Therefore s->offsets[] is too small when the for loop byteswaps offsets. This patch refuses to open files if offsets_size would overflow. Note that changing the type of offsets_size is not a fix since 32-bit hosts still only have 32-bit size_t. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 509a41bab5306181044b5fff02eadf96d9c8676a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/cloop: validate block_size header field (CVE-2014-0144)Stefan Hajnoczi
Avoid unbounded s->uncompressed_block memory allocation by checking that the block_size header field has a reasonable value. Also enforce the assumption that the value is a non-zero multiple of 512. These constraints conform to cloop 2.639's code so we accept existing image files. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit d65f97a82c4ed48374a764c769d4ba1ea9724e97) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qemu-iotests: add cloop input validation testsStefan Hajnoczi
Add a cloop format-specific test case. Later patches add tests for input validation to the script. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 05560fcebb1528f4354f6f24d1eb8cdbcdf2c4b2) Conflicts: tests/qemu-iotests/group *fixed context mismatches in group file Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qemu-iotests: add ./check -cloop supportStefan Hajnoczi
Add the cloop block driver to qemu-iotests. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 47f73da0a7d36e399eaa353d93afce90de9b599d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-01migration: catch unknown flags in ram_loadPeter Lieven
if a saved vm has unknown flags in the memory data qemu currently simply ignores this flag and continues which yields in an unpredictable result. This patch catches all unknown flags and aborts the loading of the vm. Additionally error reports are thrown if the migration aborts abnormally. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit db80facefa62dff42bb50c73b0f03eda5f732b49) Conflicts: arch_init.c *removed unecessary context from 4798fe55 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-01migration: remove duplicate codeChenLiang
version_id is checked twice in the ram_load. Signed-off-by: ChenLiang <chenliang88@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 21a246a43b606ee833f907d589d8dcbb54a2761e) *prereq for db80fac backport Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-01virtio: allow mapping up to max queue sizeMichael S. Tsirkin
It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 937251408051e0489f78e4db3c92e045b147b38b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-01pci-assign: limit # of msix vectorsMichael S. Tsirkin
KVM only supports MSIX table size up to 256 vectors, but some assigned devices support more vectors, at the moment attempts to assign them fail with EINVAL. Tweak the MSIX capability exposed to guest to limit table size to a supported value. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 639973a4740f38789057744b550df3a175bc49ad) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-29spapr_pci: Fix number of returned vectors in ibm, change-msiAlexey Kardashevskiy
Current guest kernels try allocating as many vectors as the quota is. For example, in the case of virtio-net (which has just 3 vectors) the guest requests 4 vectors (that is the quota in the test) and the existing ibm,change-msi handler returns 4. But before it returns, it calls msix_set_message() in a loop and corrupts memory behind the end of msix_table. This limits the number of vectors returned by ibm,change-msi to the maximum supported by the actual device. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Cc: qemu-stable@nongnu.org [agraf: squash in bugfix from aik] Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit b26696b519f853c9844e5154858e583600ee3cdc) *s/error_report/fprintf/ to reflect v1.7.x error reporting style Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32Peter Maydell
The ARM target-specific code in elfload.c was incorrectly allowing the 64-bit ARM target to use most of the existing 32-bit definitions: most noticably this meant that our HWCAP bits passed to the guest were wrong, and register handling when dumping core was totally broken. Fix this by properly separating the 64 and 32 bit code, since they have more differences than similarities. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 24e76ff06bcd0936ee8b04b15dca42efb7d614d1) Conflicts: linux-user/elfload.c Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26linux-user/elfload.c: Update ARM HWCAP bitsPeter Maydell
The kernel has added support for a number of new ARM HWCAP bits; add them to QEMU, including support for setting them where we have a corresponding CPU feature bit. We were also incorrectly setting the VFPv3D16 HWCAP -- this means "only 16 D registers", not "supports 16-bit floating point format"; since QEMU always has 32 D registers for VFPv3, we can just remove the line that incorrectly set this bit. The kernel does not set the HWCAP_FPA even if it is providing FPA emulation via nwfpe, so don't set this bit in QEMU either. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 24682654654a2e7b50afc27880f4098e5fca3742) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26linux-user/elfload.c: Fix incorrect ARM HWCAP bitsPeter Maydell
The ELF HWCAP bits for ARM features THUMBEE, NEON, VFPv3 and VFPv3D16 are all off by one compared to the kernel definitions. Fix this discrepancy and add in the missing CRUNCH bit which was the cause of the off-by-one error. (We don't emulate any of the CPUs which have that weird hardware, so it's otherwise uninteresting to us.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 43ce393ee5f7b96d2ac22fedc40d6b6fb3f65a3e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26target-arm: Make vbar_write 64bit friendly on 32bit hostsEdgar E. Iglesias
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1398926097-28097-2-git-send-email-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit fed3ffb9f157f33bc9b2b1c3ef68e710ee6b7b4b) Conflicts: target-arm/helper.c Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26target-i386: fix set of registers zeroed on resetPaolo Bonzini
BND0-3, BNDCFGU, BNDCFGS, BNDSTATUS were not zeroed on reset, but they should be (Intel Instruction Set Extensions Programming Reference 319433-015, pages 9-4 and 9-6). Same for YMM. XCR0 should be reset to 1. TSC and TSC_RESET were zeroed already by the memset, remove the explicit assignments. Cc: Andreas Faerber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 05e7e819d7d159a75a46354aead95e1199b8f168) Conflicts: target-i386/cpu.c target-i386/cpu.h *removed dependency on 79e9ebeb Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26stellaris_enet: block migrationMichael S. Tsirkin
Incoming migration with stellaris_enet is unsafe. It's being reworked, but for now, simply block it since noone is using it anyway. Block outgoing migration for good measure. CVE-2013-4532 Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-26virtio: validate config_len on loadMichael S. Tsirkin
Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a890a2f9137ac3cf5b607649e66a6f3a5512d8dc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-14 20:58:25 +0000