mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-27 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Security fix CVE-2016-2197

Browse Source 
CVE-2016-2197 Qemu: ide: ahci null pointer dereference when using FIS CLB engines

(From OE-Core rev: bbc41337d28cc54d115378d4cad32f7b1c6f6cd5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2016-02-10 12:28:21 -08:00
committed by Richard Purdie
parent 1f3e1d1e3f
commit 093835335e
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
meta/recipes-devtools/qemu/qemu/CVE-2016-2197.patch Normal file
View File

@@ -0,0 +1,59 @@
From: Prasad J Pandit <address@hidden>
When IDE AHCI emulation uses Frame Information Structures(FIS)
engine for data transfer, the mapped FIS buffer address is stored
in a static 'bounce.buffer'. When a request is made to map another
memory region, address_space_map() returns NULL because
'bounce.buffer' is in_use. It leads to a null pointer dereference
error while doing 'dma_memory_unmap'. Add a check to avoid it.
Reported-by: Zuozhi fzz <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Upstream-Status: Backport
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05740.html
CVE: CVE-2016-2197
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
hw/ide/ahci.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
Update as per review
-> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05715.html
Index: qemu-2.5.0/hw/ide/ahci.c
===================================================================
--- qemu-2.5.0.orig/hw/ide/ahci.c
+++ qemu-2.5.0/hw/ide/ahci.c
@@ -661,9 +661,11 @@ static bool ahci_map_fis_address(AHCIDev
static void ahci_unmap_fis_address(AHCIDevice *ad)
{
- dma_memory_unmap(ad->hba->as, ad->res_fis, 256,
- DMA_DIRECTION_FROM_DEVICE, 256);
- ad->res_fis = NULL;
+ if (ad->res_fis) {
+ dma_memory_unmap(ad->hba->as, ad->res_fis, 256,
+ DMA_DIRECTION_FROM_DEVICE, 256);
+ ad->res_fis = NULL;
+ }
}
static bool ahci_map_clb_address(AHCIDevice *ad)
@@ -677,9 +679,11 @@ static bool ahci_map_clb_address(AHCIDev
static void ahci_unmap_clb_address(AHCIDevice *ad)
{
- dma_memory_unmap(ad->hba->as, ad->lst, 1024,
- DMA_DIRECTION_FROM_DEVICE, 1024);
- ad->lst = NULL;
+ if (ad->lst) {
+ dma_memory_unmap(ad->hba->as, ad->lst, 1024,
+ DMA_DIRECTION_FROM_DEVICE, 1024);
+ ad->lst = NULL;
+ }
}
static void ahci_write_fis_sdb(AHCIState *s, NCQTransferState *ncq_tfs)

1
meta/recipes-devtools/qemu/qemu_2.5.0.bb
View File

@@ -8,6 +8,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
file://no-valgrind.patch \
file://CVE-2016-1568.patch \
file://CVE-2016-2197.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "f469f2330bbe76e3e39db10e9ac4f8db"