Re: [Qemu-devel] [PATCH for-3.1? v2] hostmem: Validate host-nodes before setting bitmap
On Fri, Nov 30, 2018 at 06:55:39PM +0100, Markus Armbruster wrote: > Eric Blake writes: > > > On 11/30/18 6:28 AM, Eduardo Habkost wrote: > >> host_memory_backend_set_host_nodes() was not validating > >> host-nodes before writing to backend->host_nodes, making QEMU > >> write beyond the end of the bitmap. > >> > >> Fix the crash and add a simple regression test for the fix. > >> > >> While at it, fix memory leak of the list returned by > >> visit_type_uint16List(). > >> > >> Reported-by: Markus Armbruster > >> Signed-off-by: Eduardo Habkost > >> --- > > > > Looks like we may have 3.1-rc4 due to some CVE fixes; is this worth > > including in 3.1 as well? > > You could conceivably crash a running VM with object-add. On the other > hand, the bug has been around for a while, and was only found by code > inspection. I think the fix would be appropriate for -rc2 or -rc3, but I don't think it's critical enough for -rc4. -- Eduardo
Re: [Qemu-devel] [PATCH for-3.1? v2] hostmem: Validate host-nodes before setting bitmap
Eric Blake writes: > On 11/30/18 6:28 AM, Eduardo Habkost wrote: >> host_memory_backend_set_host_nodes() was not validating >> host-nodes before writing to backend->host_nodes, making QEMU >> write beyond the end of the bitmap. >> >> Fix the crash and add a simple regression test for the fix. >> >> While at it, fix memory leak of the list returned by >> visit_type_uint16List(). >> >> Reported-by: Markus Armbruster >> Signed-off-by: Eduardo Habkost >> --- > > Looks like we may have 3.1-rc4 due to some CVE fixes; is this worth > including in 3.1 as well? You could conceivably crash a running VM with object-add. On the other hand, the bug has been around for a while, and was only found by code inspection.
Re: [Qemu-devel] [PATCH for-3.1? v2] hostmem: Validate host-nodes before setting bitmap
On 11/30/18 6:28 AM, Eduardo Habkost wrote: host_memory_backend_set_host_nodes() was not validating host-nodes before writing to backend->host_nodes, making QEMU write beyond the end of the bitmap. Fix the crash and add a simple regression test for the fix. While at it, fix memory leak of the list returned by visit_type_uint16List(). Reported-by: Markus Armbruster Signed-off-by: Eduardo Habkost --- Looks like we may have 3.1-rc4 due to some CVE fixes; is this worth including in 3.1 as well? -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org
