!150 Automatically generate code patches with openeuler

From: @zhendongchen
Reviewed-by: @yorifang
Signed-off-by: @yorifang

net-remove-an-assert-call-in-eth_get_gso_type.patch

@@ -0,0 +1,49 @@
+From 9b210ed120ac82e647ed99be3679bab2bc55932b Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Wed, 21 Oct 2020 11:35:50 +0530
+Subject: [PATCH] net: remove an assert call in eth_get_gso_type
+
+fix CVE-2020-27617
+
+eth_get_gso_type() routine returns segmentation offload type based on
+L3 protocol type. It calls g_assert_not_reached if L3 protocol is
+unknown, making the following return statement unreachable. Remove the
+g_assert call, it maybe triggered by a guest user.
+
+Reported-by: Gaoning Pan <pgn@zju.edu.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+
+cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1
+Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
+---
+ net/eth.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/eth.c b/net/eth.c
+index 0c1d413ee2..1e0821c5f8 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -16,6 +16,7 @@
+  */
+ 
+ #include "qemu/osdep.h"
++#include "qemu/log.h"
+ #include "net/eth.h"
+ #include "net/checksum.h"
+ #include "net/tap.h"
+@@ -71,9 +72,8 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto)
+             return VIRTIO_NET_HDR_GSO_TCPV6 | ecn_state;
+         }
+     }
+-
+-    /* Unsupported offload */
+-    g_assert_not_reached();
++    qemu_log_mask(LOG_UNIMP, "%s: probably not GSO frame, "
++        "unknown L3 protocol: 0x%04"PRIx16"\n", __func__, l3_proto);
+ 
+     return VIRTIO_NET_HDR_GSO_NONE | ecn_state;
+ }
+-- 
+2.27.0
+

qemu.spec

@@ -1,6 +1,6 @@
 Name: qemu
 Version: 4.1.0
-Release: 31
+Release: 32
 Epoch: 2
 Summary: QEMU is a generic and open source machine emulator and virtualizer
 License: GPLv2 and BSD and MIT and CC-BY
@@ -277,6 +277,7 @@ Patch0264: migration-Create-migration_is_running.patch
 Patch0265: migration-fix-COLO-broken-caused-by-a-previous-commi.patch
 Patch0266: migration-multifd-fix-hangup-with-TLS-Multifd-due-to.patch
 Patch0267: multifd-tls-fix-memoryleak-of-the-QIOChannelSocket-o.patch
+Patch0268: net-remove-an-assert-call-in-eth_get_gso_type.patch
 
 BuildRequires: flex
 BuildRequires: bison
@@ -623,6 +624,9 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Wed Oct 21 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
+- net: remove an assert call in eth_get_gso_type
+
 * Wed Dec 2 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
 - migration/tls: save hostname into MigrationState
 - migration/tls: extract migration_tls_client_create for common-use