From b69699a9802eae7feb5715d3ac12a4749a32cbd8 Mon Sep 17 00:00:00 2001 From: "Huawei Technologies Co., Ltd" Date: Wed, 21 Oct 2020 11:35:50 +0530 Subject: [PATCH 1/3] net: remove an assert call in eth_get_gso_type fix CVE-2020-27617 eth_get_gso_type() routine returns segmentation offload type based on L3 protocol type. It calls g_assert_not_reached if L3 protocol is unknown, making the following return statement unreachable. Remove the g_assert call, it maybe triggered by a guest user. Reported-by: Gaoning Pan Signed-off-by: Prasad J Pandit Signed-off-by: Jason Wang cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1 Signed-off-by: Jiajie Li --- ...e-an-assert-call-in-eth_get_gso_type.patch | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 net-remove-an-assert-call-in-eth_get_gso_type.patch diff --git a/net-remove-an-assert-call-in-eth_get_gso_type.patch b/net-remove-an-assert-call-in-eth_get_gso_type.patch new file mode 100644 index 0000000..79d7409 --- /dev/null +++ b/net-remove-an-assert-call-in-eth_get_gso_type.patch @@ -0,0 +1,49 @@ +From 9b210ed120ac82e647ed99be3679bab2bc55932b Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Wed, 21 Oct 2020 11:35:50 +0530 +Subject: [PATCH] net: remove an assert call in eth_get_gso_type + +fix CVE-2020-27617 + +eth_get_gso_type() routine returns segmentation offload type based on +L3 protocol type. It calls g_assert_not_reached if L3 protocol is +unknown, making the following return statement unreachable. Remove the +g_assert call, it maybe triggered by a guest user. + +Reported-by: Gaoning Pan +Signed-off-by: Prasad J Pandit +Signed-off-by: Jason Wang + +cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1 +Signed-off-by: Jiajie Li +--- + net/eth.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/eth.c b/net/eth.c +index 0c1d413ee2..1e0821c5f8 100644 +--- a/net/eth.c ++++ b/net/eth.c +@@ -16,6 +16,7 @@ + */ + + #include "qemu/osdep.h" ++#include "qemu/log.h" + #include "net/eth.h" + #include "net/checksum.h" + #include "net/tap.h" +@@ -71,9 +72,8 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto) + return VIRTIO_NET_HDR_GSO_TCPV6 | ecn_state; + } + } +- +- /* Unsupported offload */ +- g_assert_not_reached(); ++ qemu_log_mask(LOG_UNIMP, "%s: probably not GSO frame, " ++ "unknown L3 protocol: 0x%04"PRIx16"\n", __func__, l3_proto); + + return VIRTIO_NET_HDR_GSO_NONE | ecn_state; + } +-- +2.27.0 + From ac58d429a9584bf2c3a1fcd80ff1f64f7ad17e95 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Mon, 7 Dec 2020 11:26:54 +0800 Subject: [PATCH 2/3] spec: Update patch and changelog with !39 net: remove an assert call in eth_get_gso_type Signed-off-by: Alex Chen --- qemu.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qemu.spec b/qemu.spec index fc83f2a..33e7eb9 100644 --- a/qemu.spec +++ b/qemu.spec @@ -277,6 +277,7 @@ Patch0264: migration-Create-migration_is_running.patch Patch0265: migration-fix-COLO-broken-caused-by-a-previous-commi.patch Patch0266: migration-multifd-fix-hangup-with-TLS-Multifd-due-to.patch Patch0267: multifd-tls-fix-memoryleak-of-the-QIOChannelSocket-o.patch +Patch0268: net-remove-an-assert-call-in-eth_get_gso_type.patch BuildRequires: flex BuildRequires: bison @@ -623,6 +624,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Wed Oct 21 2020 Huawei Technologies Co., Ltd +- net: remove an assert call in eth_get_gso_type + * Wed Dec 2 2020 Huawei Technologies Co., Ltd - migration/tls: save hostname into MigrationState - migration/tls: extract migration_tls_client_create for common-use From ef52e3f6f9ad5a1f1f0c44bd3da448a44461d2b6 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Mon, 7 Dec 2020 11:27:02 +0800 Subject: [PATCH 3/3] spec: Update release version with !39 increase release verison by one Signed-off-by: Euler Robot --- qemu.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index 33e7eb9..61e3350 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 31 +Release: 32 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY