已合并
Automatically generate code patches with openeuler !137 #302
AtomGit-Bot创建于 2021年6月8日
Automatically generate code patches with openeuler !137 #302
已合并
从refs/pull/302/head合入到openEuler-20.03-LTS
共 2 个文件变更+85-1
| @@ -0,0 +1,80 @@ | |||
| 1 | +From 42d828980670d3351c8ddc43a2c02ca9738429ed Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Greg Kurz <groug@kaod.org> | ||
| 3 | +Date: Tue, 8 Jun 2021 09:07:17 +0800 | ||
| 4 | +Subject: [PATCH] 9pfs: Fully restart unreclaim loop (CVE-2021-20181) | ||
| 5 | + | ||
| 6 | +Fix CVE-2021-20181 | ||
| 7 | + | ||
| 8 | +Depending on the client activity, the server can be asked to open a huge | ||
| 9 | +number of file descriptors and eventually hit RLIMIT_NOFILE. This is | ||
| 10 | +currently mitigated using a reclaim logic : the server closes the file | ||
| 11 | +descriptors of idle fids, based on the assumption that it will be able | ||
| 12 | +to re-open them later. This assumption doesn't hold of course if the | ||
| 13 | +client requests the file to be unlinked. In this case, we loop on the | ||
| 14 | +entire fid list and mark all related fids as unreclaimable (the reclaim | ||
| 15 | +logic will just ignore them) and, of course, we open or re-open their | ||
| 16 | +file descriptors if needed since we're about to unlink the file. | ||
| 17 | + | ||
| 18 | +This is the purpose of v9fs_mark_fids_unreclaim(). Since the actual | ||
| 19 | +opening of a file can cause the coroutine to yield, another client | ||
| 20 | +request could possibly add a new fid that we may want to mark as | ||
| 21 | +non-reclaimable as well. The loop is thus restarted if the re-open | ||
| 22 | +request was actually transmitted to the backend. This is achieved | ||
| 23 | +by keeping a reference on the first fid (head) before traversing | ||
| 24 | +the list. | ||
| 25 | + | ||
| 26 | +This is wrong in several ways: | ||
| 27 | +- a potential clunk request from the client could tear the first | ||
| 28 | + fid down and cause the reference to be stale. This leads to a | ||
| 29 | + use-after-free error that can be detected with ASAN, using a | ||
| 30 | + custom 9p client | ||
| 31 | +- fids are added at the head of the list : restarting from the | ||
| 32 | + previous head will always miss fids added by a some other | ||
| 33 | + potential request | ||
| 34 | + | ||
| 35 | +All these problems could be avoided if fids were being added at the | ||
| 36 | +end of the list. This can be achieved with a QSIMPLEQ, but this is | ||
| 37 | +probably too much change for a bug fix. For now let's keep it | ||
| 38 | +simple and just restart the loop from the current head. | ||
| 39 | + | ||
| 40 | +Fixes: CVE-2021-20181 | ||
| 41 | +Buglink: https://bugs.launchpad.net/qemu/+bug/1911666 | ||
| 42 | +Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com> | ||
| 43 | +Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> | ||
| 44 | +Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> | ||
| 45 | +Message-Id: <161064025265.1838153.15185571283519390907.stgit@bahia.lan> | ||
| 46 | +Signed-off-by: Greg Kurz <groug@kaod.org> | ||
| 47 | + | ||
| 48 | +Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | ||
| 49 | +--- | ||
| 50 | + hw/9pfs/9p.c | 6 +++--- | ||
| 51 | + 1 file changed, 3 insertions(+), 3 deletions(-) | ||
| 52 | + | ||
| 53 | +diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c | ||
| 54 | +index 55821343e5..289d00b01a 100644 | ||
| 55 | +--- a/hw/9pfs/9p.c | ||
| 56 | ++++ b/hw/9pfs/9p.c | ||
| 57 | + static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPDU *pdu, V9fsPath *path) | ||
| 58 | + { | ||
| 59 | + int err; | ||
| 60 | + V9fsState *s = pdu->s; | ||
| 61 | +- V9fsFidState *fidp, head_fid; | ||
| 62 | ++ V9fsFidState *fidp; | ||
| 63 | + | ||
| 64 | +- head_fid.next = s->fid_list; | ||
| 65 | ++again: | ||
| 66 | + for (fidp = s->fid_list; fidp; fidp = fidp->next) { | ||
| 67 | + if (fidp->path.size != path->size) { | ||
| 68 | + continue; | ||
| 69 | + static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPDU *pdu, V9fsPath *path) | ||
| 70 | + * switched to the worker thread | ||
| 71 | + */ | ||
| 72 | + if (err == 0) { | ||
| 73 | +- fidp = &head_fid; | ||
| 74 | ++ goto again; | ||
| 75 | + } | ||
| 76 | + } | ||
| 77 | + } | ||
| 78 | +-- | ||
| 79 | +2.27.0 | ||
| 80 | + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: qemu | 1 | Name: qemu |
| 2 | Version: 4.1.0 | 2 | Version: 4.1.0 |
| 3 | -Release: 40 | 3 | +Release: 41 |
| 4 | Epoch: 2 | 4 | Epoch: 2 |
| 5 | Summary: QEMU is a generic and open source machine emulator and virtualizer | 5 | Summary: QEMU is a generic and open source machine emulator and virtualizer |
| 6 | License: GPLv2 and BSD and MIT and CC-BY | 6 | License: GPLv2 and BSD and MIT and CC-BY |
| @@ -236,6 +236,7 @@ Patch0223: spapr_pci-add-spapr-msi-read-method.patch | |||
| 236 | Patch0224: tz-ppc-add-dummy-read-write-methods.patch | 236 | Patch0224: tz-ppc-add-dummy-read-write-methods.patch |
| 237 | Patch0225: imx7-ccm-add-digprog-mmio-write-method.patch | 237 | Patch0225: imx7-ccm-add-digprog-mmio-write-method.patch |
| 238 | Patch0226: bugfix-fix-Uninitialized-Free-Vulnerability.patch | 238 | Patch0226: bugfix-fix-Uninitialized-Free-Vulnerability.patch |
| 239 | +Patch0227: 9pfs-Fully-restart-unreclaim-loop-CVE-2021-20181.patch | ||
| 239 | 240 | ||
| 240 | BuildRequires: flex | 241 | BuildRequires: flex |
| 241 | BuildRequires: bison | 242 | BuildRequires: bison |
| @@ -581,6 +582,9 @@ getent passwd qemu >/dev/null || \ | |||
| 581 | %endif | 582 | %endif |
| 582 | 583 | ||
| 583 | %changelog | 584 | %changelog |
| 585 | +* Tue Jun 08 2021 Chen Qun <kuhn.chenqun@huawei.com> | ||
| 586 | +- 9pfs: Fully restart unreclaim loop (CVE-2021-20181) | ||
| 587 | + | ||
| 584 | * Wed Jun 02 2021 Chen Qun <kuhn.chenqun@huawei.com> | 588 | * Wed Jun 02 2021 Chen Qun <kuhn.chenqun@huawei.com> |
| 585 | - bugfix: fix Uninitialized Free Vulnerability | 589 | - bugfix: fix Uninitialized Free Vulnerability |
| 586 | 590 | ||