Star1
34
代码
代码
Issues17
Pull Requests
项目讨论
Wiki
分析
Star1
34
已合并
Automatically generate code patches with openeuler #137
zhendongchen创建于 2020年10月22日
Automatically generate code patches with openeuler #137
已合并
zhendongchen创建于 2020年10月22日
从refs/pull/137/head合入到openEuler-20.03-LTS-Next
共 3 个文件变更+121-1
Ahw-ide-check-null-block-before-_cancel_dma_sync.patch+64-0
@@ -0,0 +1,64 @@
1+From 8785230bc823d4f32e39055ce24e292586a9be03 Mon Sep 17 00:00:00 2001
2+From: Prasad J Pandit <pjp@fedoraproject.org>
3+Date: Wed, 14 Oct 2020 15:57:18 +0800
4+Subject: [PATCH] hw/ide: check null block before _cancel_dma_sync
5+ 
6+fix CVE-2020-25743
7+ 
8+patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05967.html
9+ 
10+When canceling an i/o operation via ide_cancel_dam_sync(),
11+a block pointer may be null. Add check to avoid null pointer
12+dereference.
13+ 
14+ -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1
15+ ==1803100==Hint: address points to the zero page.
16+ #0 blk_bs ../block/block-backend.c:714
17+ #1 blk_drain ../block/block-backend.c:1715
18+ #2 ide_cancel_dma_sync ../hw/ide/core.c:723
19+ #3 bmdma_cmd_writeb ../hw/ide/core.c:723
20+ #4 bmdma_write ../hw/ide/pci.c:298
21+ #5 memory_region_write_accessor ../softmmu/memory.c:483
22+ #6 access_with_adjusted_size ../softmmu/memory.c:544
23+ #7 memory_region_dispatch_write ../softmmu/memory.c:1465
24+ #8 flatview_write_continue ../exe.c:3176
25+ ...
26+ 
27+Reported-by: Ruhr-University <bugs-syssec@rub.de>
28+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
29+---
30+ hw/ide/core.c | 1 +
31+ hw/ide/pci.c | 5 ++++-
32+ 2 files changed, 5 insertions(+), 1 deletion(-)
33+ 
34+diff --git a/hw/ide/core.c b/hw/ide/core.c
35+index 6d96c3a8c3..1bedad29de 100644
36+--- a/hw/ide/core.c
37++++ b/hw/ide/core.c
38+@@ -705,6 +705,7 @@ void ide_cancel_dma_sync(IDEState *s)
39+ * whole DMA operation will be submitted to disk with a single
40+ * aio operation with preadv/pwritev.
41+ */
42++ assert(s->blk);
43+ if (s->bus->dma->aiocb) {
44+ trace_ide_cancel_dma_sync_remaining();
45+ blk_drain(s->blk);
46+diff --git a/hw/ide/pci.c b/hw/ide/pci.c
47+index 4c6fb9a68e..ac291858d7 100644
48+--- a/hw/ide/pci.c
49++++ b/hw/ide/pci.c
50+@@ -295,7 +295,10 @@ void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val)
51+ /* Ignore writes to SSBM if it keeps the old value */
52+ if ((val & BM_CMD_START) != (bm->cmd & BM_CMD_START)) {
53+ if (!(val & BM_CMD_START)) {
54+- ide_cancel_dma_sync(idebus_active_if(bm->bus));
55++ IDEState *s = idebus_active_if(bm->bus);
56++ if (s->blk) {
57++ ide_cancel_dma_sync(s);
58++ }
59+ bm->status &= ~BM_STATUS_DMAING;
60+ } else {
61+ bm->cur_addr = bm->addr;
62+--
63+2.23.0
64+ 
Apci-check-bus-pointer-before-dereference.patch+50-0
@@ -0,0 +1,50 @@
1+From 0d0abe293c0516f7d530af3d6a5305d2cc36935a Mon Sep 17 00:00:00 2001
2+From: Prasad J Pandit <pjp@fedoraproject.org>
3+Date: Wed, 14 Oct 2020 15:00:20 +0800
4+Subject: [PATCH] pci: check bus pointer before dereference
5+ 
6+fix CVE-2020-25742
7+ 
8+patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
9+ 
10+While mapping IRQ level in pci_change_irq_level() routine,
11+it does not check if pci_get_bus() returned a valid pointer.
12+It may lead to a NULL pointer dereference issue. Add check to
13+avoid it.
14+ 
15+ -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
16+ ==1183858==Hint: address points to the zero page.
17+ #0 pci_change_irq_level hw/pci/pci.c:259
18+ #1 pci_irq_handler hw/pci/pci.c:1445
19+ #2 pci_set_irq hw/pci/pci.c:1463
20+ #3 lsi_set_irq hw/scsi/lsi53c895a.c:488
21+ #4 lsi_update_irq hw/scsi/lsi53c895a.c:523
22+ #5 lsi_script_scsi_interrupt hw/scsi/lsi53c895a.c:554
23+ #6 lsi_execute_script hw/scsi/lsi53c895a.c:1149
24+ #7 lsi_reg_writeb hw/scsi/lsi53c895a.c:1984
25+ #8 lsi_io_write hw/scsi/lsi53c895a.c:2146
26+ ...
27+ 
28+Reported-by: Ruhr-University <bugs-syssec@rub.de>
29+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
30+---
31+ hw/pci/pci.c | 3 +++
32+ 1 file changed, 3 insertions(+)
33+ 
34+diff --git a/hw/pci/pci.c b/hw/pci/pci.c
35+index 8076a80ab3..602fc566cc 100644
36+--- a/hw/pci/pci.c
37++++ b/hw/pci/pci.c
38+@@ -249,6 +249,9 @@ static void pci_change_irq_level(PCIDevice *pci_dev, int irq_num, int change)
39+ PCIBus *bus;
40+ for (;;) {
41+ bus = pci_get_bus(pci_dev);
42++ if (!bus) {
43++ return;
44++ }
45+ irq_num = bus->map_irq(pci_dev, irq_num);
46+ if (bus->set_irq)
47+ break;
48+--
49+2.23.0
50+ 
Mqemu.spec+7-1
@@ -1,6 +1,6 @@
1Name: qemu1Name: qemu
2Version: 4.1.02Version: 4.1.0
3-Release: 223+Release: 23
4Epoch: 24Epoch: 2
5Summary: QEMU is a generic and open source machine emulator and virtualizer5Summary: QEMU is a generic and open source machine emulator and virtualizer
6License: GPLv2 and BSD and MIT and CC-BY6License: GPLv2 and BSD and MIT and CC-BY
@@ -194,6 +194,8 @@ Patch0181: sm501-Shorten-long-variable-names-in-sm501_2d_operat.patch
194Patch0182: sm501-Use-BIT-x-macro-to-shorten-constant.patch194Patch0182: sm501-Use-BIT-x-macro-to-shorten-constant.patch
195Patch0183: sm501-Clean-up-local-variables-in-sm501_2d_operation.patch195Patch0183: sm501-Clean-up-local-variables-in-sm501_2d_operation.patch
196Patch0184: sm501-Replace-hand-written-implementation-with-pixma.patch196Patch0184: sm501-Replace-hand-written-implementation-with-pixma.patch
197+Patch0185: pci-check-bus-pointer-before-dereference.patch
198+Patch0186: hw-ide-check-null-block-before-_cancel_dma_sync.patch
197 199 
198BuildRequires: flex200BuildRequires: flex
199BuildRequires: bison201BuildRequires: bison
@@ -539,6 +541,10 @@ getent passwd qemu >/dev/null || \
539%endif541%endif
540 542 
541%changelog543%changelog
544+* Wed Oct 14 2020 Prasad J Pandit <pjp@fedoraproject.org>
545+- pci: check bus pointer before dereference
546+- hw/ide: check null block before _cancel_dma_sync
547+ 
542* Thu May 21 2020 BALATON Zoltan <balaton@eik.bme.hu>548* Thu May 21 2020 BALATON Zoltan <balaton@eik.bme.hu>
543- hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()549- hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()
544- hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment()550- hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment()