已合并
Automatically generate code patches with openeuler !132 #298
AtomGit-Bot创建于 2021年6月2日
Automatically generate code patches with openeuler !132 #298
已合并
从refs/pull/298/head合入到openEuler-20.03-LTS-Next
共 2 个文件变更+77-1
| @@ -0,0 +1,72 @@ | |||
| 1 | +From 58fe713b575a7b24b4e4694154a16808ff4a9009 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: imxcc <xingchaochao@huawei.com> | ||
| 3 | +Date: Tue, 1 Jun 2021 20:38:59 +0800 | ||
| 4 | +Subject: [PATCH] bugfix: fix Uninitialized Free Vulnerability | ||
| 5 | + | ||
| 6 | +Signed-off-by: nocjj <1250062498@qq.com> | ||
| 7 | +Signed-off-by: imxcc <xingchaochao@huawei.com> | ||
| 8 | +--- | ||
| 9 | + hw/block/nvme.c | 27 +++++++++++++++++++++------ | ||
| 10 | + 1 file changed, 21 insertions(+), 6 deletions(-) | ||
| 11 | + | ||
| 12 | +diff --git a/hw/block/nvme.c b/hw/block/nvme.c | ||
| 13 | +index 36d6a8bb3a..387e8b5c8f 100644 | ||
| 14 | +--- a/hw/block/nvme.c | ||
| 15 | ++++ b/hw/block/nvme.c | ||
| 16 | + static uint16_t nvme_map_prp(QEMUSGList *qsg, QEMUIOVector *iov, uint64_t prp1, | ||
| 17 | + return NVME_SUCCESS; | ||
| 18 | + | ||
| 19 | + unmap: | ||
| 20 | +- qemu_sglist_destroy(qsg); | ||
| 21 | ++ if (iov && iov->iov) { | ||
| 22 | ++ qemu_iovec_destroy(iov); | ||
| 23 | ++ } | ||
| 24 | ++ | ||
| 25 | ++ if (qsg && qsg->sg) { | ||
| 26 | ++ qemu_sglist_destroy(qsg); | ||
| 27 | ++ } | ||
| 28 | ++ | ||
| 29 | + return NVME_INVALID_FIELD | NVME_DNR; | ||
| 30 | + } | ||
| 31 | + | ||
| 32 | + static uint16_t nvme_dma_write_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len, | ||
| 33 | + uint64_t prp1, uint64_t prp2) | ||
| 34 | + { | ||
| 35 | +- QEMUSGList qsg; | ||
| 36 | +- QEMUIOVector iov; | ||
| 37 | ++ QEMUSGList qsg = { | ||
| 38 | ++ .sg = NULL, | ||
| 39 | ++ }; | ||
| 40 | ++ QEMUIOVector iov = { | ||
| 41 | ++ .iov = NULL, | ||
| 42 | ++ }; | ||
| 43 | + uint16_t status = NVME_SUCCESS; | ||
| 44 | + | ||
| 45 | + if (nvme_map_prp(&qsg, &iov, prp1, prp2, len, n)) { | ||
| 46 | + static uint16_t nvme_dma_write_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len, | ||
| 47 | + static uint16_t nvme_dma_read_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len, | ||
| 48 | + uint64_t prp1, uint64_t prp2) | ||
| 49 | + { | ||
| 50 | +- QEMUSGList qsg; | ||
| 51 | +- QEMUIOVector iov; | ||
| 52 | ++ QEMUSGList qsg = { | ||
| 53 | ++ .sg = NULL, | ||
| 54 | ++ }; | ||
| 55 | ++ QEMUIOVector iov = { | ||
| 56 | ++ .iov = NULL, | ||
| 57 | ++ }; | ||
| 58 | + uint16_t status = NVME_SUCCESS; | ||
| 59 | + | ||
| 60 | + trace_nvme_dma_read(prp1, prp2); | ||
| 61 | + static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr, | ||
| 62 | + sq->size = size; | ||
| 63 | + sq->cqid = cqid; | ||
| 64 | + sq->head = sq->tail = 0; | ||
| 65 | +- sq->io_req = g_new(NvmeRequest, sq->size); | ||
| 66 | ++ sq->io_req = g_new0(NvmeRequest, sq->size); | ||
| 67 | + | ||
| 68 | + QTAILQ_INIT(&sq->req_list); | ||
| 69 | + QTAILQ_INIT(&sq->out_req_list); | ||
| 70 | +-- | ||
| 71 | +2.27.0 | ||
| 72 | + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: qemu | 1 | Name: qemu |
| 2 | Version: 4.1.0 | 2 | Version: 4.1.0 |
| 3 | -Release: 46 | 3 | +Release: 47 |
| 4 | Epoch: 2 | 4 | Epoch: 2 |
| 5 | Summary: QEMU is a generic and open source machine emulator and virtualizer | 5 | Summary: QEMU is a generic and open source machine emulator and virtualizer |
| 6 | License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 | 6 | License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 |
| @@ -309,6 +309,7 @@ Patch0296: nvram-add-nrf51_soc-flash-read-method.patch | |||
| 309 | Patch0297: spapr_pci-add-spapr-msi-read-method.patch | 309 | Patch0297: spapr_pci-add-spapr-msi-read-method.patch |
| 310 | Patch0298: tz-ppc-add-dummy-read-write-methods.patch | 310 | Patch0298: tz-ppc-add-dummy-read-write-methods.patch |
| 311 | Patch0299: imx7-ccm-add-digprog-mmio-write-method.patch | 311 | Patch0299: imx7-ccm-add-digprog-mmio-write-method.patch |
| 312 | +Patch0300: bugfix-fix-Uninitialized-Free-Vulnerability.patch | ||
| 312 | 313 | ||
| 313 | BuildRequires: flex | 314 | BuildRequires: flex |
| 314 | BuildRequires: bison | 315 | BuildRequires: bison |
| @@ -693,6 +694,9 @@ getent passwd qemu >/dev/null || \ | |||
| 693 | %endif | 694 | %endif |
| 694 | 695 | ||
| 695 | %changelog | 696 | %changelog |
| 697 | +* Wed Jun 02 2021 Chen Qun <kuhn.chenqun@huawei.com> | ||
| 698 | +- bugfix: fix Uninitialized Free Vulnerability | ||
| 699 | + | ||
| 696 | * Tue Jun 01 2021 Chen Qun <kuhn.chenqun@huawei.com> | 700 | * Tue Jun 01 2021 Chen Qun <kuhn.chenqun@huawei.com> |
| 697 | - hw/pci-host: add pci-intack write method | 701 | - hw/pci-host: add pci-intack write method |
| 698 | - pci-host: add pcie-msi read method | 702 | - pci-host: add pcie-msi read method |