packages/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!306 Automatically generate code patches with openeuler !141

Browse Source 
From: @kuhnchen18
Reviewed-by: @imxcc
Signed-off-by: @imxcc
This commit is contained in:
openeuler-ci-bot 2021-06-15 11:51:49 +00:00 committed by Gitee
commit 15f03c48a1
8 changed files with 360 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
qemu.spec
View File

@ -1,6 +1,6 @@
Name: qemu
Version: 4.1.0
Release: 58
Release: 59
Epoch: 2
Summary: QEMU is a generic and open source machine emulator and virtualizer
License: GPLv2 and BSD and MIT and CC-BY-SA-4.0
@ -327,6 +327,13 @@ Patch0314: imx7-ccm-add-digprog-mmio-write-method.patch
Patch0315: util-cacheinfo-fix-crash-when-compiling-with-uClibc.patch
Patch0316: arm-cpu-Fixed-function-undefined-error-at-compile-ti.patch
Patch0317: blockjob-Fix-crash-with-IOthread-when-block-commit-a.patch
Patch0318: vhost-user-gpu-fix-resource-leak-in-vg_resource_crea.patch
Patch0319: vhost-user-gpu-fix-memory-leak-in-vg_resource_attach.patch
Patch0320: vhost-user-gpu-fix-memory-leak-while-calling-vg_reso.patch
Patch0321: vhost-user-gpu-fix-memory-leak-in-virgl_cmd_resource.patch
Patch0322: vhost-user-gpu-fix-memory-leak-in-virgl_resource_att.patch
Patch0323: vhost-user-gpu-fix-memory-disclosure-in-virgl_cmd_ge.patch
Patch0324: vhost-user-gpu-fix-OOB-write-in-virgl_cmd_get_capset.patch
BuildRequires: flex
BuildRequires: bison
@ -720,6 +727,15 @@ getent passwd qemu >/dev/null || \
%endif
%changelog
* Tue Jun 15 2021 Chen Qun <kuhn.chenqun@huawei.com>
- vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544)
- vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544)
- vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544)
- vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
- vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544)
- vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545)
- vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)
* Fri May 28 2021 Chen Qun <kuhn.chenqun@huawei.com>
- blockjob: Fix crash with IOthread when block commit after snapshot

51
vhost-user-gpu-fix-OOB-write-in-virgl_cmd_get_capset.patch Normal file
View File

@ -0,0 +1,51 @@
From acb9f3aadde7222eacf95b2d70204dd6f8351ed7 Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 10:14:06 +0800
Subject: [PATCH] vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset'
(CVE-2021-3546)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
If 'virgl_cmd_get_capset' set 'max_size' to 0,
the 'virgl_renderer_fill_caps' will write the data after the 'resp'.
This patch avoid this by checking the returned 'max_size'.
virtio-gpu fix: abd7f08b
("display: virtio-gpu-3d: check
virgl capabilities max_size")
Fixes: CVE-2021-3546
Reported-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-8-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/virgl.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 44e79ab82a..ad2834902b 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -173,6 +173,10 @@ virgl_cmd_get_capset(VuGpu *g,
virgl_renderer_get_cap_set(gc.capset_id, &max_ver,
&max_size);
+ if (!max_size) {
+ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
+ return;
+ }
resp = g_malloc0(sizeof(*resp) + max_size);
resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET;
--
2.27.0

44
vhost-user-gpu-fix-memory-disclosure-in-virgl_cmd_ge.patch Normal file
View File

@ -0,0 +1,44 @@
From 511cac8cbc60fafdae2589d674b7aeab15388eef Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 10:11:17 +0800
Subject: [PATCH] vhost-user-gpu: fix memory disclosure in
virgl_cmd_get_capset_info (CVE-2021-3545)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
Otherwise some of the 'resp' will be leaked to guest.
Fixes: CVE-2021-3545
Reported-by: default avatarLi Qiang <liq3ea@163.com>
virtio-gpu fix: 42a8dadc
("virtio-gpu: fix information leak
in getting capset info dispatch")
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-2-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/virgl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 79556df094..44e79ab82a 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -131,6 +131,7 @@ virgl_cmd_get_capset_info(VuGpu *g,
VUGPU_FILL_CMD(info);
+ memset(&resp, 0, sizeof(resp));
if (info.capset_index == 0) {
resp.capset_id = VIRTIO_GPU_CAPSET_VIRGL;
virgl_renderer_get_cap_set(resp.capset_id,
--
2.27.0

49
vhost-user-gpu-fix-memory-leak-in-vg_resource_attach.patch Normal file
View File

@ -0,0 +1,49 @@
From b9f6004899adb8e501e1b9ce1cb0976a2268ad60 Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 09:56:42 +0800
Subject: [PATCH] vhost-user-gpu: fix memory leak in vg_resource_attach_backing
(CVE-2021-3544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
Check whether the 'res' has already been attach_backing to avoid
memory leak.
Fixes: CVE-2021-3544
Reported-by: default avatarLi Qiang <liq3ea@163.com>
virtio-gpu fix: 204f01b3
("virtio-gpu: fix memory leak
in resource attach backing")
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-4-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/contrib/vhost-user-gpu/main.c b/contrib/vhost-user-gpu/main.c
index f69af7d17f..4f087d6000 100644
--- a/contrib/vhost-user-gpu/main.c
+++ b/contrib/vhost-user-gpu/main.c
@@ -468,6 +468,11 @@ vg_resource_attach_backing(VuGpu *g,
return;
}
+ if (res->iov) {
+ cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
+ return;
+ }
+
ret = vg_create_mapping_iov(g, &ab, cmd, &res->iov);
if (ret != 0) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
--
2.27.0

57
vhost-user-gpu-fix-memory-leak-in-virgl_cmd_resource.patch Normal file
View File

@ -0,0 +1,57 @@
From 5bdbe19681e151318b749cb6b2443626bf54b82e Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 10:05:40 +0800
Subject: [PATCH] vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref'
(CVE-2021-3544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
The 'res->iov' will be leaked if the guest trigger following sequences:
virgl_cmd_create_resource_2d
virgl_resource_attach_backing
virgl_cmd_resource_unref
This patch fixes this.
Fixes: CVE-2021-3544
Reported-by: default avatarLi Qiang <liq3ea@163.com>
virtio-gpu fix: 5e8e3c4c
("virtio-gpu: fix resource leak
in virgl_cmd_resource_unref"
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-6-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/virgl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 43413e29df..4b8b536edf 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -105,8 +105,14 @@ virgl_cmd_resource_unref(VuGpu *g,
struct virtio_gpu_ctrl_command *cmd)
{
struct virtio_gpu_resource_unref unref;
+ struct iovec *res_iovs = NULL;
+ int num_iovs = 0;
VUGPU_FILL_CMD(unref);
+ virgl_renderer_resource_detach_iov(unref.resource_id,
+ &res_iovs,
+ &num_iovs);
+ g_free(res_iovs);
virgl_renderer_resource_unref(unref.resource_id);
}
--
2.27.0

50
vhost-user-gpu-fix-memory-leak-in-virgl_resource_att.patch Normal file
View File

@ -0,0 +1,50 @@
From 6348348ee6a76c28159c64d6392fb6ba5a0b4374 Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 10:09:13 +0800
Subject: [PATCH] vhost-user-gpu: fix memory leak in
'virgl_resource_attach_backing' (CVE-2021-3544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will
be leaked.
Fixes: CVE-2021-3544
Reported-by: default avatarLi Qiang <liq3ea@163.com>
virtio-gpu fix: 33243031
("virtio-gpu-3d: fix memory leak
in resource attach backing")
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-7-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/virgl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 4b8b536edf..79556df094 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -282,8 +282,11 @@ virgl_resource_attach_backing(VuGpu *g,
return;
}
- virgl_renderer_resource_attach_iov(att_rb.resource_id,
+ ret = virgl_renderer_resource_attach_iov(att_rb.resource_id,
res_iovs, att_rb.nr_entries);
+ if (ret != 0) {
+ g_free(res_iovs);
+ }
}
static void
--
2.27.0

51
vhost-user-gpu-fix-memory-leak-while-calling-vg_reso.patch Normal file
View File

@ -0,0 +1,51 @@
From c276538416e9238e352d0f720db57ea1020e555f Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 10:02:08 +0800
Subject: [PATCH] vhost-user-gpu: fix memory leak while calling
'vg_resource_unref' (CVE-2021-3544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
If the guest trigger following sequences, the attach_backing will be leaked:
vg_resource_create_2d
vg_resource_attach_backing
vg_resource_unref
This patch fix this by freeing 'res->iov' in vg_resource_destroy.
Fixes: CVE-2021-3544
Reported-by: default avatarLi Qiang <liq3ea@163.com>
virtio-gpu fix: 5e8e3c4c
("virtio-gpu: fix resource leak
in virgl_cmd_resource_unref")
Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-5-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/contrib/vhost-user-gpu/main.c b/contrib/vhost-user-gpu/main.c
index 4f087d6000..43d9851800 100644
--- a/contrib/vhost-user-gpu/main.c
+++ b/contrib/vhost-user-gpu/main.c
@@ -379,6 +379,7 @@ vg_resource_destroy(VuGpu *g,
}
vugbm_buffer_destroy(&res->buffer);
+ g_free(res->iov);
pixman_image_unref(res->image);
QTAILQ_REMOVE(&g->reslist, res, next);
g_free(res);
--
2.27.0

41
vhost-user-gpu-fix-resource-leak-in-vg_resource_crea.patch Normal file
View File

@ -0,0 +1,41 @@
From 58e7327879e89700630ca766974a18f9ac55897c Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@163.com>
Date: Tue, 15 Jun 2021 09:53:22 +0800
Subject: [PATCH] vhost-user-gpu: fix resource leak in 'vg_resource_create_2d'
(CVE-2021-3544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix CVE-2021-3544
Call 'vugbm_buffer_destroy' in error path to avoid resource leak.
Fixes: CVE-2021-3544
Reported-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: default avatarLi Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-3-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
---
contrib/vhost-user-gpu/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/contrib/vhost-user-gpu/main.c b/contrib/vhost-user-gpu/main.c
index b45d2019b4..f69af7d17f 100644
--- a/contrib/vhost-user-gpu/main.c
+++ b/contrib/vhost-user-gpu/main.c
@@ -328,6 +328,7 @@ vg_resource_create_2d(VuGpu *g,
g_critical("%s: resource creation failed %d %d %d",
__func__, c2d.resource_id, c2d.width, c2d.height);
g_free(res);
+ vugbm_buffer_destroy(&res->buffer);
cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
return;
}
--
2.27.0