aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-08-05SMBIOS: Rename symbols to better reflect future useGabriel L. Somlo
Rename the following symbols: - smbios_set_type1_defaults() to the more general smbios_set_defaults(); - bool smbios_type1_defaults to the more general smbios_defaults; - smbios_get_table() to smbios_get_table_legacy(); This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit e6667f719caa7b5edcb491f61a7744f6a6affd27) Conflicts: hw/i386/pc_piix.c hw/i386/pc_q35.c *removed dependency on 3458b2b0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-serial: don't migrate the config spaceAlexander Graf
The device configuration is set at realize time and never changes. It should not be migrated as it is done today. For the sake of compatibility, let's just skip them at load time. Signed-off-by: Alexander Graf <agraf@suse.de> [ added missing casts to uint16_t *, added From, SoB and commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit e38e943a1fa20d04deb1899be19b12aadec7a585) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-net: byteswap virtio-net headerCédric Le Goater
TCP connectivity fails when the guest has a different endianness. The packets are silently dropped on the host by the tap backend when they are read from user space because the endianness of the virtio-net header is in the wrong order. These lines may appear in the guest console: [ 454.709327] skbuff: bad partial csum: csum=8704/4096 len=74 [ 455.702554] skbuff: bad partial csum: csum=8704/4096 len=74 The issue that got first spotted with a ppc64le PowerKVM guest, but it also exists for the less common case of a x86_64 guest run by a big-endian ppc64 TCG hypervisor. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> [ Ported from PowerKVM, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05hw/xtensa/xtfpga: fix FLASH mapping to boot region for KC705Max Filippov
On KC705 bootloader area is located at FLASH offset 0x06000000, not 0 as on older xtfpga boards. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 37ed7c4b24f265c2a8c7248666544c9755514ec2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05q35: Use PC_Q35_COMPAT_1_4 on pc-q35-1.4 compat_propsEduardo Habkost
pc-q35-1.4 was incorrectly using PC_COMPAT_1_4 instead of PC_Q35_COMPAT_1_4. The only side-effect was that the hpet compat property (inherited from PC_Q35_COMPAT_1_7) was missing. Without this patch, pc-q35-1.4 inicorrectly initializes hpet-intcap to 0xff0104 (behavior introduced in QEMU 2.0, by commit 7a10ef51c2397ac4323bc786af02c58b413b5cd2). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 48cb7f3c1526b4632bd63d945cac80d26616d6f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05usb: Fix usb-bt-dongle initialization.Hani Benhabiles
Due to an incomplete initialization, adding a usb-bt-dongle device through HMP or QMP will cause a segmentation fault. Signed-off-by: Hani Benhabiles <hani@linux.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c340a284f382a5f40774521f41b4bade76ddfa58) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-scsi: define dummy handle_output for vhost-scsi vqsMing Lei
vhost userspace needn't to handle vq's notification from guest, so define dummy handle_output callback for all vqs of vhost-scsi. In some corner cases(such as when handling vq's reset from VM), virtio-pci still trys to handle pending virtio-scsi events, then object check failure inside virtio_scsi_handle_event() for vhost-scsi can be triggered. The issue can be reproduced by 'rmmod virtio-scsi', 'system sleep' or reboot inside VM. Cc: qemu-stable@nongnu.org Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91d670fbf9945ca4ecbd123affb36889e7fe8a5d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05vhost: fix resource leak in error handlingMichael S. Tsirkin
vhost_verify_ring_mappings leaks mappings on error. Fix this up. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 8617343faae6ba7e916137c6c9e3ef22c00565d8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05scsi-disk: fix bug in scsi_block_new_request() introduced by commit 137745cUlrich Obergfell
This patch fixes a bug in scsi_block_new_request() that was introduced by commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8. If the host cache is used - i.e. if BDRV_O_NOCACHE is _not_ set - the 'break' statement needs to be executed to 'fall back' to SG_IO. Cc: qemu-stable@nongnu.org Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2fe5a9f73b3446690db2cae8a58473b0b4beaa32) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05qdev: recursively unrealize devices when unrealizing busPaolo Bonzini
When the patch was posted that became 5c21ce7 (qdev: Realize buses on device realization, 2014-03-12), it included recursive realization and unrealization of devices when the bus's "realized" property was toggled. However, due to the same old worries about recursive realization and prerequisites not being realized yet, those hunks were dropped when committing the patch. Unfortunately, this causes a use-after-free bug (easily reproduced by a PCI hot-unplug action). Before the patch, device_unparent behaved as follows: for each child bus unparent bus ----------------------------. | for each child device | | unparent device ---------------. | | | unrealize device | | | | call dc->unparent | | | '------------------------------- | '----------------------------------------' unrealize device After the patch, it behaves as follows instead: unrealize device --------------------. | for each child bus | | unrealize bus (A) | '------------------------------------' for each child bus unparent bus ----------------------. | for each child device | | unrealize device (B) | | call dc->unparent | '----------------------------------' At the step marked (B) the device might use data from the bus that is not available anymore due to step (A). To fix this, we need to unrealize devices before step (A). To sidestep concerns about recursive realization, only do recursive unrealization and leave the "value && !bus->realized" case as it is. The resulting flow is: for each child bus unrealize bus ---------------------. | for each child device | | unrealize device (B) | | call bc->unrealize (A) | '----------------------------------' unrealize device for each child bus unparent bus ----------------------. | for each child device | | unparent device | '----------------------------------' where everything is "powered down" before it is unassembled. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 5942a19040fed313b316ab7b6e3d2d8e7b1625bb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05qdev: reorganize error reporting in bus_set_realizedPaolo Bonzini
No semantic change. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit b7b34d055d82abaa511b35c9fc24efbb63dca0b1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05hw: Consistently name Error ** objects errp, and not errMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit a7737e4496aa3c1c8c3a4b4b9d5e44875fe21e12) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05s390x/css: handle emw correctly for tschCornelia Huck
We should not try to store the emw portion of the irb if extended measurements are not applicable. In particular, we should not surprise the guest by storing a larger irb if it did not enable extended measurements. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit f068d320def7fd83bf0fcdca37b305f1c2ac5413) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio-scsi: Plug memory leak on virtio_scsi_push_event() error pathMarkus Armbruster
Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91e7fcca4743cf694eb0c8e7a8d938cf359b5bd8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio: allow mapping up to max queue sizeMichael S. Tsirkin
It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 937251408051e0489f78e4db3c92e045b147b38b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20pci-assign: limit # of msix vectorsMichael S. Tsirkin
KVM only supports MSIX table size up to 256 vectors, but some assigned devices support more vectors, at the moment attempts to assign them fail with EINVAL. Tweak the MSIX capability exposed to guest to limit table size to a supported value. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 639973a4740f38789057744b550df3a175bc49ad) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20spapr_pci: Fix number of returned vectors in ibm, change-msiAlexey Kardashevskiy
Current guest kernels try allocating as many vectors as the quota is. For example, in the case of virtio-net (which has just 3 vectors) the guest requests 4 vectors (that is the quota in the test) and the existing ibm,change-msi handler returns 4. But before it returns, it calls msix_set_message() in a loop and corrupts memory behind the end of msix_table. This limits the number of vectors returned by ibm,change-msi to the maximum supported by the actual device. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Cc: qemu-stable@nongnu.org [agraf: squash in bugfix from aik] Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit b26696b519f853c9844e5154858e583600ee3cdc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20stellaris_enet: block migrationMichael S. Tsirkin
Incoming migration with stellaris_enet is unsafe. It's being reworked, but for now, simply block it since noone is using it anyway. Block outgoing migration for good measure. CVE-2013-4532 Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20acpi: fix tables for no-hpet configurationMichael S. Tsirkin
acpi build tried to add offset of hpet table to rsdt even when hpet was disabled. If no tables follow hpet, this could lead to a malformed rsdt. Fix it up. To avoid such errors in the future, rearrange code slightly to make it clear that acpi_add_table stores the offset of the following table - not of the previous one. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 9ac1c4c07e7e6ab16a3e2149e9b32c0d092cb3f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20megasas: Implement LD_LIST_QUERYHannes Reinecke
Newer firmware implement a LD_LIST_QUERY command, and due to a driver issue no drives might be detected if this command isn't supported. So add emulation for this command, too. Cc: qemu-stable@nongnu.org Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 34bb4d02e00e508fa9d111a6a31b45bbfecbdba5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio-scsi: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 3c3ce981423e0d6c18af82ee62f1850c2cda5976) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20usb: sanity check setup_index+setup_len in post_loadMichael S. Tsirkin
CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 9f8e9895c504149d7048e9fc5eb5cbb34b16e49a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20zaurus: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4540 Within scoop_gpio_handler_update, if prev_level has a high bit set, then we get bit > 16 and that causes a buffer overrun. Since prev_level comes from wire indirectly, this can happen on invalid state load. Similarly for gpio_level and gpio_dir. To fix, limit to 16 bit. Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 52f91c3723932f8340fe36c8ec8b18a757c37b2b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20tsc210x: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4539 s->precision, nextprecision, function and nextfunction come from wire and are used as idx into resolution[] in TSC_CUT_RESOLUTION. Validate after load to avoid buffer overrun. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20ssd0323: fix buffer overun on invalid state loadMichael S. Tsirkin
CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit ead7a57df37d2187813a121308213f41591bd811) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20ssi-sd: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4537 s->arglen is taken from wire and used as idx in ssi_sd_transfer(). Validate it before access. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a9c380db3b8c6af19546a68145c8d1438a09c92b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20pxa2xx: avoid buffer overrun on incoming migrationMichael S. Tsirkin
CVE-2013-4533 s->rx_level is read from the wire and used to determine how many bytes to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the length of s->rx_fifo[] the buffer can be overrun with arbitrary data from the wire. Fix this by validating rx_level against the size of s->rx_fifo. Cc: Don Koch <dkoch@verizon.com> Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Don Koch <dkoch@verizon.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit caa881abe0e01f9931125a0977ec33c5343e4aa7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20openpic: avoid buffer overrun on incoming migrationMichael Roth
CVE-2013-4534 opp->nb_cpus is read from the wire and used to determine how many IRQDest elements to read into opp->dst[]. If the value exceeds the length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary data from the wire. Fix this by failing migration if the value read from the wire exceeds MAX_CPU. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio: validate num_sg when mappingMichael S. Tsirkin
CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 36cf2a37132c7f01fa9adb5f95f5312b27742fd4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio: avoid buffer overrun on incoming migrationMichael Roth
CVE-2013-6399 vdev->queue_sel is read from the wire, and later used in the emulation code as an index into vdev->vq[]. If the value of vdev->queue_sel exceeds the length of vdev->vq[], currently allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun the buffer with arbitrary data originating from the source. Fix this by failing migration if the value from the wire exceeds VIRTIO_PCI_QUEUE_MAX. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 4b53c2c72cb5541cf394033b528a6fe2a86c0ac1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20pl022: fix buffer overun on invalid state loadMichael S. Tsirkin
CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst@redhat.com Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit d8d0a0bc7e194300e53a346d25fe5724fd588387) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20hw/pci/pcie_aer.c: fix buffer overruns on invalid state loadMichael S. Tsirkin
4) CVE-2013-4529 hw/pci/pcie_aer.c pcie aer log can overrun the buffer if log_num is too large There are two issues in this file: 1. log_max from remote can be larger than on local then buffer will overrun with data coming from state file. 2. log_num can be larger then we get data corruption again with an overflow but not adversary controlled. Fix both issues. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 5f691ff91d323b6f97c6600405a7f9dc115a0ad1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20hpet: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4527 hw/timer/hpet.c buffer overrun hpet is a VARRAY with a uint8 size but static array of 32 To fix, make sure num_timers is valid using VMSTATE_VALID hook. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 3f1c49e2136fa08ab1ef3183fd55def308829584) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20ahci: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit ae2158ad6ce0845b2fae2a22aa7f19c0d7a71ce5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio-net: out-of-bounds buffer write on loadMichael S. Tsirkin
CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c > } else if (n->mac_table.in_use) { > uint8_t *buf = g_malloc0(n->mac_table.in_use); We are allocating buffer of size n->mac_table.in_use > qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN); and read to the n->mac_table.in_use size buffer n->mac_table.in_use * ETH_ALEN bytes, corrupting memory. If adversary controls state then memory written there is controlled by adversary. Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 98f93ddd84800f207889491e0b5d851386b459cf) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20virtio-net: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin
CVE-2013-4150 QEMU 1.5.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c This code is in hw/net/virtio-net.c: if (n->max_queues > 1) { if (n->max_queues != qemu_get_be16(f)) { error_report("virtio-net: different max_queues "); return -1; } n->curr_queues = qemu_get_be16(f); for (i = 1; i < n->curr_queues; i++) { n->vqs[i].tx_waiting = qemu_get_be32(f); } } Number of vqs is max_queues, so if we get invalid input here, for example if max_queues = 2, curr_queues = 3, we get write beyond end of the buffer, with data that comes from wire. This might be used to corrupt qemu memory in hard to predict ways. Since we have lots of function pointers around, RCE might be possible. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit eea750a5623ddac7a61982eec8f1c93481857578) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20hw/net/stellaris_enet: Correct handling of packet paddingPeter Maydell
The PADEN bit in the transmit control register enables padding of short data packets out to the required minimum length. However a typo here meant we were adjusting tx_fifo_len rather than tx_frame_len, so the padding didn't actually happen. Fix this bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 7fd5f064d1c1a827a95ffe678418b3d5b8d2f108) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-20hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer overrunPeter Maydell
The current tx_fifo code has a corner case where the guest can overrun the fifo buffer: if automatic CRCs are disabled we allow the guest to write the CRC word even if there isn't actually space for it in the FIFO. The datasheet is unclear about exactly how the hardware deals with this situation; the most plausible answer seems to be that the CRC word is just lost. Implement this fix by separating the "can we stuff another word in the FIFO" logic from the "should we transmit the packet now" check. This also moves us closer to the real hardware, which has a number of ways it can be configured to trigger sending the packet, some of which we don't implement. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 5c10495ab1546d5d12b51a97817051e9ec98d0f6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-04-14Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi: SSDT update This has a fix by Igor for a regression introduced by bridge hotplug code. Expected test files were updated accordingly. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 14 Apr 2014 13:13:35 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi-test: update expected files acpi: fix incorrect encoding for 0x{F-1}FFFF Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14ide: Correct improper smart self test counter reset in ide core.Benoît Canet
The SMART self test counter was incorrectly being reset to zero, not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE: * We would write off the beginning of a dynamically allocated buffer * We forgot the SMART history Fix this. Signed-off-by: Benoit Canet <benoit@irqsave.net> Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net Reviewed-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Kevin Wolf <kwolf@redhat.com> [PMM: tweaked commit message as per suggestions from Markus] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14acpi: fix incorrect encoding for 0x{F-1}FFFFIgor Mammedov
Fix typo in build_append_int() which causes integer truncation when it's in range 0x{F-1}FFFF by packing it as WordConst instead of required DWordConst. In partucular this fixes a regression: hotplug in slots 16,17,18 and 19 didn't work, since SSDT had code like this: If (And (Arg0, 0x0000)) { Notify (S80, Arg1) } Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de>
2014-04-14vmxnet3: validate queues configuration read on migrationDmitry Fleytman
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-5-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate interrupt indices read on migrationDmitry Fleytman
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-4-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate queues configuration coming from guestDmitry Fleytman
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-3-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate interrupt indices coming from guestDmitry Fleytman
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-2-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11virtio-net: fix guest-triggerable buffer overrunMichael S. Tsirkin
When VM guest programs multicast addresses for a virtio net card, it supplies a 32 bit entries counter for the number of addresses. These addresses are read into tail portion of a fixed macs array which has size MAC_TABLE_ENTRIES, at offset equal to in_use. To avoid overflow of this array by guest, qemu attempts to test the size as follows: - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { however, as mac_data.entries is uint32_t, this sum can overflow, e.g. if in_use is 1 and mac_data.entries is 0xffffffff then in_use + mac_data.entries will be 0. Qemu will then read guest supplied buffer into this memory, overflowing buffer on heap. CVE-2014-0150 Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-10acpi: update generated hex filesMichael S. Tsirkin
commit f2ccc311df55ec026a8f8ea9df998f26314f22b2 dsdt: tweak ACPI ID for hotplug resource device changes the DSDT, update hex files to match Otherwise the fix is only effective if QEMU is built with iasl. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-04-08hw/pci-host/prep: Don't reverse IO accesses on bigendian hostsPeter Maydell
The raven_io_read() and raven_io_write() functions pass and return values in little-endian format (since the IO op struct is marked DEVICE_LITTLE_ENDIAN); however they were storing the values in the buffer to pass to address_space_read/write() in host-endian order, which meant that on big-endian hosts the values were inadvertently reversed. Use the *_le_p() accessors instead so that we are consistent regardless of host endianness. Strictly speaking the byte order of the buffer for address_space_rw() is target byte order (which for PPC will be BE) but it doesn't actually matter as long as we are consistent about the marking on the IO op struct and which stl_*_p(). This bug was probably introduced due to confusion caused by the two different versions of ldl_p() and friends: bswap.h defines versions meaning "host endianness access" cpu-all.h defines versions meaning "target endianness access" As a target-independent source file prep.c gets the bswap.h versions; the very similar looking code in ioport.c is compiled per-target and gets the cpu-all.h versions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1396972271-22660-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Richard Henderson <rth@twiddle.net>
2014-04-08Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi bug fix Here is a single last minute fix for 2.0 This changes the HID of the container used to claim resources for CPU hotplug. As a result, windows XP SP3 no longer brings up an annoying "found new hardware" wizard on boot. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 08 Apr 2014 13:23:30 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: dsdt: tweak ACPI ID for hotplug resource device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08dsdt: tweak ACPI ID for hotplug resource deviceMichael S. Tsirkin
ACPI0004 seems too new: Windows XP complains about an unrecognized device. This is a regression since 1.7. Use PNP0A06 instead - Generic Container Device. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-By: Igor Mammedov <imammedo@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-11 04:47:24 +0000