已合并
Automatically generate code patches with openeuler !132 #298
AtomGit-Bot创建于 2021年6月2日
Automatically generate code patches with openeuler !132 #298
已合并
AtomGit-Bot创建于 2021年6月2日
refs/pull/298/head合入到openEuler-20.03-LTS-Next
2 个文件变更+77-1
@@ -0,0 +1,72 @@
1+From 58fe713b575a7b24b4e4694154a16808ff4a9009 Mon Sep 17 00:00:00 2001
2+From: imxcc <xingchaochao@huawei.com>
3+Date: Tue, 1 Jun 2021 20:38:59 +0800
4+Subject: [PATCH] bugfix: fix Uninitialized Free Vulnerability
5+ 
6+Signed-off-by: nocjj <1250062498@qq.com>
7+Signed-off-by: imxcc <xingchaochao@huawei.com>
8+---
9+ hw/block/nvme.c | 27 +++++++++++++++++++++------
10+ 1 file changed, 21 insertions(+), 6 deletions(-)
11+ 
12+diff --git a/hw/block/nvme.c b/hw/block/nvme.c
13+index 36d6a8bb3a..387e8b5c8f 100644
14+--- a/hw/block/nvme.c
15++++ b/hw/block/nvme.c
16+@@ -216,15 +216,26 @@ static uint16_t nvme_map_prp(QEMUSGList *qsg, QEMUIOVector *iov, uint64_t prp1,
17+ return NVME_SUCCESS;
18+
19+ unmap:
20+- qemu_sglist_destroy(qsg);
21++ if (iov && iov->iov) {
22++ qemu_iovec_destroy(iov);
23++ }
24++
25++ if (qsg && qsg->sg) {
26++ qemu_sglist_destroy(qsg);
27++ }
28++
29+ return NVME_INVALID_FIELD | NVME_DNR;
30+ }
31+
32+ static uint16_t nvme_dma_write_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
33+ uint64_t prp1, uint64_t prp2)
34+ {
35+- QEMUSGList qsg;
36+- QEMUIOVector iov;
37++ QEMUSGList qsg = {
38++ .sg = NULL,
39++ };
40++ QEMUIOVector iov = {
41++ .iov = NULL,
42++ };
43+ uint16_t status = NVME_SUCCESS;
44+
45+ if (nvme_map_prp(&qsg, &iov, prp1, prp2, len, n)) {
46+@@ -247,8 +258,12 @@ static uint16_t nvme_dma_write_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
47+ static uint16_t nvme_dma_read_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
48+ uint64_t prp1, uint64_t prp2)
49+ {
50+- QEMUSGList qsg;
51+- QEMUIOVector iov;
52++ QEMUSGList qsg = {
53++ .sg = NULL,
54++ };
55++ QEMUIOVector iov = {
56++ .iov = NULL,
57++ };
58+ uint16_t status = NVME_SUCCESS;
59+
60+ trace_nvme_dma_read(prp1, prp2);
61+@@ -500,7 +515,7 @@ static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr,
62+ sq->size = size;
63+ sq->cqid = cqid;
64+ sq->head = sq->tail = 0;
65+- sq->io_req = g_new(NvmeRequest, sq->size);
66++ sq->io_req = g_new0(NvmeRequest, sq->size);
67+
68+ QTAILQ_INIT(&sq->req_list);
69+ QTAILQ_INIT(&sq->out_req_list);
70+--
71+2.27.0
72+ 
@@ -1,6 +1,6 @@
1Name: qemu1Name: qemu
2Version: 4.1.02Version: 4.1.0
3-Release: 463+Release: 47
4Epoch: 24Epoch: 2
5Summary: QEMU is a generic and open source machine emulator and virtualizer5Summary: QEMU is a generic and open source machine emulator and virtualizer
6License: GPLv2 and BSD and MIT and CC-BY-SA-4.06License: GPLv2 and BSD and MIT and CC-BY-SA-4.0
@@ -309,6 +309,7 @@ Patch0296: nvram-add-nrf51_soc-flash-read-method.patch
309Patch0297: spapr_pci-add-spapr-msi-read-method.patch309Patch0297: spapr_pci-add-spapr-msi-read-method.patch
310Patch0298: tz-ppc-add-dummy-read-write-methods.patch310Patch0298: tz-ppc-add-dummy-read-write-methods.patch
311Patch0299: imx7-ccm-add-digprog-mmio-write-method.patch311Patch0299: imx7-ccm-add-digprog-mmio-write-method.patch
312+Patch0300: bugfix-fix-Uninitialized-Free-Vulnerability.patch
312 313 
313BuildRequires: flex314BuildRequires: flex
314BuildRequires: bison315BuildRequires: bison
@@ -693,6 +694,9 @@ getent passwd qemu >/dev/null || \
693%endif694%endif
694 695 
695%changelog696%changelog
697+* Wed Jun 02 2021 Chen Qun <kuhn.chenqun@huawei.com>
698+- bugfix: fix Uninitialized Free Vulnerability
699+ 
696* Tue Jun 01 2021 Chen Qun <kuhn.chenqun@huawei.com>700* Tue Jun 01 2021 Chen Qun <kuhn.chenqun@huawei.com>
697- hw/pci-host: add pci-intack write method701- hw/pci-host: add pci-intack write method
698- pci-host: add pcie-msi read method702- pci-host: add pcie-msi read method