I haven't checked yet in dunfell, but in kirkstone this commit merged last
week breaks nativesdk-qemu builds.
This chunk:
+@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
pqxl, int group_id)
+ offset = le64_to_cpu(pqxl) & 0xffffffffffff;
+ return (void *)(intptr_t)offset;
+ case MEMSLOT_GROUP_GUEST:
+- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) {
+ return NULL;
+ }
+ ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
Uses size parameter which was added in previous commit (which wasn't
backported):
https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f
So either both commits need to be backported or this one reworked not to
use undeclared size as it leads to:
| ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt':
| ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first
use in this function); did you mean 'gsize'?
| 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset,
size)) {
| |
^~~~
| |
gsize
I'm surprised this wasn't caught on autobuilder already, maybe it's
triggered only with extra PACKAGECONFIG options we have enabled:
PACKAGECONFIG:append:class-nativesdk = " virglrenderer epoxy spice libusb
usb-redir"
Regards,
On Wed, Jan 25, 2023 at 3:42 PM Steve Sakoman <[email protected]> wrote:
> From: Hitendra Prajapati <[email protected]>
>
> Upstream-Status: Backport from
> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
>
> Signed-off-by: Hitendra Prajapati <[email protected]>
> Signed-off-by: Steve Sakoman <[email protected]>
> ---
> meta/recipes-devtools/qemu/qemu.inc | 1 +
> .../qemu/qemu/CVE-2022-4144.patch | 103 ++++++++++++++++++
> 2 files changed, 104 insertions(+)
> create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
>
> diff --git a/meta/recipes-devtools/qemu/qemu.inc
> b/meta/recipes-devtools/qemu/qemu.inc
> index fff2c87780..898fa1a8d8 100644
> --- a/meta/recipes-devtools/qemu/qemu.inc
> +++ b/meta/recipes-devtools/qemu/qemu.inc
> @@ -115,6 +115,7 @@ SRC_URI = "
> https://download.qemu.org/${BPN}-${PV}.tar.xz \
> file://CVE-2021-3638.patch \
> file://CVE-2021-20196.patch \
> file://CVE-2021-3507.patch \
> + file://CVE-2022-4144.patch \
> "
> UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>
> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> new file mode 100644
> index 0000000000..3f0d5fbd5c
> --- /dev/null
> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-4144.patch
> @@ -0,0 +1,103 @@
> +From 6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622 Mon Sep 17 00:00:00 2001
> +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <[email protected]>
> +Date: Mon, 28 Nov 2022 21:27:40 +0100
> +Subject: [PATCH] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt
> + (CVE-2022-4144)
> +MIME-Version: 1.0
> +Content-Type: text/plain; charset=UTF-8
> +Content-Transfer-Encoding: 8bit
> +
> +Have qxl_get_check_slot_offset() return false if the requested
> +buffer size does not fit within the slot memory region.
> +
> +Similarly qxl_phys2virt() now returns NULL in such case, and
> +qxl_dirty_one_surface() aborts.
> +
> +This avoids buffer overrun in the host pointer returned by
> +memory_region_get_ram_ptr().
> +
> +Fixes: CVE-2022-4144 (out-of-bounds read)
> +Reported-by: Wenxu Yin (@awxylitol)
> +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
> +
> +Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
> +Signed-off-by: Stefan Hajnoczi <[email protected]>
> +Message-Id: <[email protected]>
> +
> +Upstream-Status: Backport [
> https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622
> ]
> +CVE: CVE-2022-4144
> +Comments: Deleted patch hunk in qxl.h,as it contains change
> +in comments which is not present in current version of qemu.
> +
> +Signed-off-by: Hitendra Prajapati <[email protected]>
> +---
> + hw/display/qxl.c | 27 +++++++++++++++++++++++----
> + 1 file changed, 23 insertions(+), 4 deletions(-)
> +
> +diff --git a/hw/display/qxl.c b/hw/display/qxl.c
> +index cd7eb39d..6bc8385b 100644
> +--- a/hw/display/qxl.c
> ++++ b/hw/display/qxl.c
> +@@ -1440,11 +1440,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
> +
> + /* can be also called from spice server thread context */
> + static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl,
> +- uint32_t *s, uint64_t *o)
> ++ uint32_t *s, uint64_t *o,
> ++ size_t size_requested)
> + {
> + uint64_t phys = le64_to_cpu(pqxl);
> + uint32_t slot = (phys >> (64 - 8)) & 0xff;
> + uint64_t offset = phys & 0xffffffffffff;
> ++ uint64_t size_available;
> +
> + if (slot >= NUM_MEMSLOTS) {
> + qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot,
> +@@ -1468,6 +1470,23 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice
> *qxl, QXLPHYSICAL pqxl,
> + slot, offset, qxl->guest_slots[slot].size);
> + return false;
> + }
> ++ size_available = memory_region_size(qxl->guest_slots[slot].mr);
> ++ if (qxl->guest_slots[slot].offset + offset >= size_available) {
> ++ qxl_set_guest_bug(qxl,
> ++ "slot %d offset %"PRIu64" > region size
> %"PRIu64"\n",
> ++ slot, qxl->guest_slots[slot].offset + offset,
> ++ size_available);
> ++ return false;
> ++ }
> ++ size_available -= qxl->guest_slots[slot].offset + offset;
> ++ if (size_requested > size_available) {
> ++ qxl_set_guest_bug(qxl,
> ++ "slot %d offset %"PRIu64" size %zu: "
> ++ "overrun by %"PRIu64" bytes\n",
> ++ slot, offset, size_requested,
> ++ size_requested - size_available);
> ++ return false;
> ++ }
> +
> + *s = slot;
> + *o = offset;
> +@@ -1486,7 +1505,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> pqxl, int group_id)
> + offset = le64_to_cpu(pqxl) & 0xffffffffffff;
> + return (void *)(intptr_t)offset;
> + case MEMSLOT_GROUP_GUEST:
> +- if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) {
> ++ if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size))
> {
> + return NULL;
> + }
> + ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr);
> +@@ -1944,9 +1963,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice
> *qxl, QXLPHYSICAL pqxl,
> + uint32_t slot;
> + bool rc;
> +
> +- rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset);
> +- assert(rc == true);
> + size = (uint64_t)height * abs(stride);
> ++ rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size);
> ++ assert(rc == true);
> + trace_qxl_surfaces_dirty(qxl->id, offset, size);
> + qxl_set_dirty(qxl->guest_slots[slot].mr,
> + qxl->guest_slots[slot].offset + offset,
> +--
> +2.25.1
> +
> --
> 2.25.1
>
>
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#176506):
https://lists.openembedded.org/g/openembedded-core/message/176506
Mute This Topic: https://lists.openembedded.org/mt/96521255/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
