aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-05-07Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-07' ↵Peter Maydell
into staging trivial patches for 2014-05-07 # gpg: Signature made Wed 07 May 2014 18:01:15 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB * remotes/mjt/tags/trivial-patches-2014-05-07: (21 commits) libcacard: remove unnecessary EOL from debug prints docs/memory.txt: Fix document on MMIO operations readline: Sort completions before printing them. readline: use g_strndup instead of open-coding it qmp: report path ambiguity error libcacard: replace pstrcpy() with memcpy() glib: move g_poll() replacement into glib-compat.h do not call g_thread_init() for glib >= 2.31 hw/9pfs: Add include file for exported symbol xen: remove unused global, xen_xcg hw: Add missing 'static' attributes qemu-timer: Add missing 'static' attribute ui: Add missing 'static' attribute monitor: Add missing 'static' attribute hw/s390x: Add missing 'static' attribute hw/mips: Add missing 'static' and 'const' attributes hw/9pfs: Add missing 'static' attributes arch_init: Be sure of only one exit entry with DPRINTF() for ram_load() tests/tcg: Fix compilation of test_path qga: Fix typo (plural) in comment ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07Merge remote-tracking branch 'remotes/sstabellini/xen-140507-2' into stagingPeter Maydell
* remotes/sstabellini/xen-140507-2: xen_disk: add discard support pass an inclusive address range to xc_domain_pin_memory_cacheattr xen: factor out common functions xen: move Xen HVM files under hw/i386/xen xen: move Xen PV machine files to hw/xenpv qemu-xen: free all the pirqs for msi/msix when driver unload exec: Limit translation limiting in address_space_translate to xen Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07hw/9pfs: Add include file for exported symbolStefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07xen: remove unused global, xen_xcgJim Meyering
Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jim Meyering <meyering@redhat.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07hw: Add missing 'static' attributesStefan Weil
This fixes warnings from the static code analysis (smatch). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07hw/s390x: Add missing 'static' attributeStefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07hw/mips: Add missing 'static' and 'const' attributesStefan Weil
This fixes a warning from the static code analysis (smatch). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: Aurelien Jarno <aurelien@aurel32.net>
2014-05-07hw/9pfs: Add missing 'static' attributesStefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07xen_disk: add discard supportOlaf Hering
Implement discard support for xen_disk. It makes use of the existing discard code in qemu. The discard support is enabled unconditionally. The tool stack may provide a property "discard-enable" in the backend node to optionally disable discard support. This is helpful in case the backing file was intentionally created non-sparse to avoid fragmentation. Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-05-07Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,net,MAINTAINERS,build updates MAINTAINERS updated with link to the security process documentation apic version modified to make more guests happy On top of that, bugfixes all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 07 May 2014 17:15:29 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: configure: make source tree build more robust MAINTAINERS: addresses for responsible disclosure pm_smbus: correctly report unclaimed cycles smbus: return -1 if nothing found at the given address smbus: allow returning an error from reads apic: use emulated lapic version 0x14 on pc machines >= 2.1 pc: add compat_props placeholder for 2.0 machine type i8259: don't abort when trying to use level sensitive irqs acpi: fix tables for no-hpet configuration acpi-build: properly decrement objects' reference counters acpi/pcihp.c: Rewrite acpi_pcihp_get_bsel using object_property_get_int Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07xen: move Xen HVM files under hw/i386/xenWei Liu
Signed-off-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-05-07pm_smbus: correctly report unclaimed cyclesPaolo Bonzini
Without this patch, i2cdetect will report all addresses as present. With it, only 0x50..0x57 are present. Before: 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30: 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40: 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50: 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60: 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70: 70 71 72 73 74 75 76 77 After: 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: -- -- -- -- -- -- -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 50: 50 51 52 53 54 55 56 57 -- -- -- -- -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07xen: move Xen PV machine files to hw/xenpvWei Liu
Signed-off-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-05-07smbus: return -1 if nothing found at the given addressPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07qemu-xen: free all the pirqs for msi/msix when driver unloadZhenzhong Duan
Pirqs are not freed when driver unload, then new pirqs are allocated when driver reload. This could exhaust pirqs if do it in a loop. This patch fixes the bug by freeing pirqs when ENABLE bit is cleared in msi/msix control reg. There is also other way of fixing it such as reuse pirqs between driver reload, but this way is better. Xen-devel: http://marc.info/?l=xen-devel&m=136800120304275&w=2 Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-05-07smbus: allow returning an error from readsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07apic: use emulated lapic version 0x14 on pc machines >= 2.1Gabriel L. Somlo
Add "version" property to local apic, and have it default to 0x14 for pc machines starting at 2.1. For compatibility with previous releases, pc machines up to 2.0 will have their local apic version set to 0x11. Signed-off-by: Gabriel L. Somlo <somlo@cmu.edu> Acked-by: Alexander Graf <agraf@suse.de> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07pc: add compat_props placeholder for 2.0 machine typeGabriel L. Somlo
Add the "boilerplate" necessary for subsequent patches to simply drop in compat_props for pc machines 2.0 and older. This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Acked-by: Alexander Graf <agraf@suse.de> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07i8259: don't abort when trying to use level sensitive irqsHervé Poussineau
This is a guest-triggerable error, as seen when using Xenix 2.3.4. Replace hw_error by LOG_UNIMPL, so that guests can continue. With this patch, I can install and use Xenix 2.3.4a without any problem. I can also start installation of Xenix 2.3.4q, but it fails due to not finding an hard disk. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20140507' into stagingPeter Maydell
Some improvements for s390. Two patches deal with address translation, one fixes a problem in the channel subsystem code. # gpg: Signature made Wed 07 May 2014 09:29:30 BST using RSA key ID C6F02FAF # gpg: Can't check signature: public key not found * remotes/cohuck/tags/s390x-20140507: s390x/css: Don't save orb in subchannel. s390x/helper: Added format control bit to MMU translation s390x/helper: Fixed real-to-absolute address translation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140505' ↵Peter Maydell
into staging migration/next for 20140505 # gpg: Signature made Mon 05 May 2014 21:27:24 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140505: (36 commits) migration: expose xbzrle cache miss rate migration: expose the bitmap_sync_count to the end migration: Add counts of updating the dirty bitmap XBZRLE: Fix one XBZRLE corruption issues migration: remove duplicate code Coverity: Fix failure path for qemu_accept in migration Init the XBZRLE.lock in ram_mig_init Provide init function for ram migration Count used RAMBlock pages for migration_dirty_pages Make qemu_peek_buffer loop until it gets it's data Disallow outward migration while awaiting incoming migration virtio: validate config_len on load virtio-net: out-of-bounds buffer write on load openpic: avoid buffer overrun on incoming migration ssi-sd: fix buffer overrun on invalid state load savevm: Ignore minimum_version_id_old if there is no load_state_old usb: sanity check setup_index+setup_len in post_load vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ virtio-scsi: fix buffer overrun on invalid state load zaurus: fix buffer overrun on invalid state load ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell
into staging QOM/QTest infrastructure fixes and device conversions * -device / device_add assertion fix * QEMUMachine conversion to MachineClass * Device error handling improvements * QTest cleanups and test cases for some more PCI devices * PortIO memory leak fixes # gpg: Signature made Mon 05 May 2014 19:59:16 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: PortioList: Store PortioList in device state tests: Add EHCI qtest tests: Add ioh3420 qtest tests: Add intel-hda qtests tests: Add es1370 qtest tests: Add ac97 qtest qtest: Be paranoid about accept() addrlen argument qtest: Add error reporting to socket_accept() qtest: Assure that init_socket()'s listen() does not fail MAINTAINERS: Document QOM arm: Clean up fragile use of error_is_set() in realize() methods qom: Clean up fragile use of error_is_set() in set() methods hw: Consistently name Error ** objects errp, and not err hw: Consistently name Error * objects err, and not errp machine: Remove QEMUMachine indirection from MachineClass machine: Replace QEMUMachine by MachineClass in accelerator configuration vl.c: Replace QEMUMachine with MachineClass in QEMUMachineInitArgs machine: Copy QEMUMachine's fields to MachineClass machine: Remove obsoleted field from QEMUMachine qdev: Fix crash by validating the object type Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07acpi: fix tables for no-hpet configurationMichael S. Tsirkin
acpi build tried to add offset of hpet table to rsdt even when hpet was disabled. If no tables follow hpet, this could lead to a malformed rsdt. Fix it up. To avoid such errors in the future, rearrange code slightly to make it clear that acpi_add_table stores the offset of the following table - not of the previous one. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org
2014-05-07acpi-build: properly decrement objects' reference countersKirill Batuzov
Object returned by object_property_get_qobject needs its reference counter to be decremented when it is not needed by caller anymore. Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07acpi/pcihp.c: Rewrite acpi_pcihp_get_bsel using object_property_get_intKirill Batuzov
acpi_pcihp_get_bsel implements functionality of object_property_get_int for specific property named ACPI_PCIHP_PROP_BSEL, but fails to decrement object's reference counter properly. Rewriting it using generic object_property_get_int serves two purposes: reducing code duplication and fixing memory leak. Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07s390x/css: Don't save orb in subchannel.Cornelia Huck
Current css code saves the operation request block (orb) in the subchannel structure for later consumption by the start function handler. This might make sense for asynchronous execution of the start function (which qemu doesn't support), but not in our case; it would even be wrong since orb contains a reference to a local variable in the base ssch handler. Let's just pass the orb through the start function call chain for ssch; for rsch, we can pass NULL as the backend function does not use any information passed via the orb there. Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-06Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-6' into stagingPeter Maydell
ohci live migration. mtp bugfixes. # gpg: Signature made Mon 05 May 2014 12:08:48 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-6: usb: mtp: reply INCOMPLETE_TRANSFER on read errors usb: mtp: fix possible buffer overflow usb: mtp: drop data-out hexdump usb: mtp: avoid empty description string usb: mtp: fix error path memory leak usb: mtp: fix serial (must be exact 32 chars) usb: mtp: fix version (is decimal not bcd) usb: mtp: fix usb_mtp_add_u64 usb: mtp: replace debug printfs with trace points usb-ohci: Add vmstate descriptor Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-05virtio: validate config_len on loadMichael S. Tsirkin
Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio-net: out-of-bounds buffer write on loadMichael S. Tsirkin
CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c > } else if (n->mac_table.in_use) { > uint8_t *buf = g_malloc0(n->mac_table.in_use); We are allocating buffer of size n->mac_table.in_use > qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN); and read to the n->mac_table.in_use size buffer n->mac_table.in_use * ETH_ALEN bytes, corrupting memory. If adversary controls state then memory written there is controlled by adversary. Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05openpic: avoid buffer overrun on incoming migrationMichael Roth
CVE-2013-4534 opp->nb_cpus is read from the wire and used to determine how many IRQDest elements to read into opp->dst[]. If the value exceeds the length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary data from the wire. Fix this by failing migration if the value read from the wire exceeds MAX_CPU. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05ssi-sd: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4537 s->arglen is taken from wire and used as idx in ssi_sd_transfer(). Validate it before access. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05usb: sanity check setup_index+setup_len in post_loadMichael S. Tsirkin
CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/Michael S. Tsirkin
As the macro verifies the value is positive, rename it to make the function clearer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio-scsi: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05zaurus: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4540 Within scoop_gpio_handler_update, if prev_level has a high bit set, then we get bit > 16 and that causes a buffer overrun. Since prev_level comes from wire indirectly, this can happen on invalid state load. Similarly for gpio_level and gpio_dir. To fix, limit to 16 bit. Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05tsc210x: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4539 s->precision, nextprecision, function and nextfunction come from wire and are used as idx into resolution[] in TSC_CUT_RESOLUTION. Validate after load to avoid buffer overrun. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05ssd0323: fix buffer overun on invalid state loadMichael S. Tsirkin
CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05pxa2xx: avoid buffer overrun on incoming migrationMichael S. Tsirkin
CVE-2013-4533 s->rx_level is read from the wire and used to determine how many bytes to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the length of s->rx_fifo[] the buffer can be overrun with arbitrary data from the wire. Fix this by validating rx_level against the size of s->rx_fifo. Cc: Don Koch <dkoch@verizon.com> Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Don Koch <dkoch@verizon.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio: validate num_sg when mappingMichael S. Tsirkin
CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio: avoid buffer overrun on incoming migrationMichael Roth
CVE-2013-6399 vdev->queue_sel is read from the wire, and later used in the emulation code as an index into vdev->vq[]. If the value of vdev->queue_sel exceeds the length of vdev->vq[], currently allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun the buffer with arbitrary data originating from the source. Fix this by failing migration if the value from the wire exceeds VIRTIO_PCI_QUEUE_MAX. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05pl022: fix buffer overun on invalid state loadMichael S. Tsirkin
CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst@redhat.com Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05hw/pci/pcie_aer.c: fix buffer overruns on invalid state loadMichael S. Tsirkin
4) CVE-2013-4529 hw/pci/pcie_aer.c pcie aer log can overrun the buffer if log_num is too large There are two issues in this file: 1. log_max from remote can be larger than on local then buffer will overrun with data coming from state file. 2. log_num can be larger then we get data corruption again with an overflow but not adversary controlled. Fix both issues. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05hpet: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4527 hw/timer/hpet.c buffer overrun hpet is a VARRAY with a uint8 size but static array of 32 To fix, make sure num_timers is valid using VMSTATE_VALID hook. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05ahci: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05PortioList: Store PortioList in device stateKirill Batuzov
PortioList is an abstraction used for construction of MemoryRegionPortioList from MemoryRegionPortio. It can be used later to unmap created memory regions. It also requires proper cleanup because some of the memory inside is allocated dynamically. By moving PortioList ot device state we make it possible to cleanup later and avoid leaking memory. This change spans several target platforms. The following testcases cover all changed lines: qemu-system-ppc -M prep qemu-system-i386 -vga qxl qemu-system-i386 -M isapc -soundhw adlib -device ib700,id=watchdog0,bus=isa.0 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05arm: Clean up fragile use of error_is_set() in realize() methodsMarkus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). I guess the error_is_set(errp) in the DeviceClass realize() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05qom: Clean up fragile use of error_is_set() in set() methodsMarkus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). I guess the error_is_set(errp) in the ObjectProperty set() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05hw: Consistently name Error ** objects errp, and not errMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05hw: Consistently name Error * objects err, and not errpMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-16 15:12:04 +0000