841956ecbc
- tests: bump QOS_PATH_MAX_ELEMENT_SIZE again - softmmu/physmem: fix memory leak in dirty_memory_extend() - crypto: run qcrypto_pbkdf2_count_iters in a new thread - hw/audio/virtio-sound: fix heap buffer overflow - hw/intc/arm_gic: fix spurious level triggered interrupts - ui/sdl2: set swap interval explicitly when OpenGL is enabled - target/riscv/kvm: tolerate KVM disable ext errors - virtio: remove virtio_tswap16s() call in vring_packed_event_read() - block: fix -Werror=maybe-uninitialized false-positive - hw/remote/vfio-user: Fix config space access byte order - hw/loongarch/virt: Fix memory leak - hw/intc/riscv_aplic: APLICs should add child earlier than realize - stdvga: fix screen blanking - ui/gtk: Draw guest frame at refresh cycle - target/i386: fix size of EBP writeback in gen_enter() - virtio-net: drop too short packets early - target/ppc: Fix lxv/stxv MSR facility check - target/ppc: Fix lxvx/stxvx facility check - virtio-snd: add max size bounds check in input cb(CVE-2024-7730) Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit e2eb79f1867bb8d8d870e758f06d2a32b3a4fc8a)
87 lines
3.4 KiB
Diff
87 lines
3.4 KiB
Diff
From 0981edabf57b5728211deeca459fb15927e7cc36 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
|
|
Date: Sun, 1 Sep 2024 15:01:12 +0200
|
|
Subject: [PATCH] hw/audio/virtio-sound: fix heap buffer overflow
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Currently, the guest may write to the device configuration space,
|
|
whereas the virtio sound device specification in chapter 5.14.4
|
|
clearly states that the fields in the device configuration space
|
|
are driver-read-only.
|
|
|
|
Remove the set_config function from the virtio_snd class.
|
|
|
|
This also prevents a heap buffer overflow. See QEMU issue #2296.
|
|
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2296
|
|
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
|
|
Message-Id: <20240901130112.8242-1-vr_qemu@t-online.de>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
(cherry picked from commit 7fc6611cad3e9627b23ce83e550b668abba6c886)
|
|
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/audio/trace-events | 1 -
|
|
hw/audio/virtio-snd.c | 24 ------------------------
|
|
2 files changed, 25 deletions(-)
|
|
|
|
diff --git a/hw/audio/trace-events b/hw/audio/trace-events
|
|
index b1870ff224..b8ef572767 100644
|
|
--- a/hw/audio/trace-events
|
|
+++ b/hw/audio/trace-events
|
|
@@ -41,7 +41,6 @@ asc_update_irq(int irq, int a, int b) "set IRQ to %d (A: 0x%x B: 0x%x)"
|
|
|
|
#virtio-snd.c
|
|
virtio_snd_get_config(void *vdev, uint32_t jacks, uint32_t streams, uint32_t chmaps) "snd %p: get_config jacks=%"PRIu32" streams=%"PRIu32" chmaps=%"PRIu32""
|
|
-virtio_snd_set_config(void *vdev, uint32_t jacks, uint32_t new_jacks, uint32_t streams, uint32_t new_streams, uint32_t chmaps, uint32_t new_chmaps) "snd %p: set_config jacks from %"PRIu32"->%"PRIu32", streams from %"PRIu32"->%"PRIu32", chmaps from %"PRIu32"->%"PRIu32
|
|
virtio_snd_get_features(void *vdev, uint64_t features) "snd %p: get_features 0x%"PRIx64
|
|
virtio_snd_vm_state_running(void) "vm state running"
|
|
virtio_snd_vm_state_stopped(void) "vm state stopped"
|
|
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
|
|
index 137fa77a01..cb7049abb3 100644
|
|
--- a/hw/audio/virtio-snd.c
|
|
+++ b/hw/audio/virtio-snd.c
|
|
@@ -107,29 +107,6 @@ virtio_snd_get_config(VirtIODevice *vdev, uint8_t *config)
|
|
|
|
}
|
|
|
|
-static void
|
|
-virtio_snd_set_config(VirtIODevice *vdev, const uint8_t *config)
|
|
-{
|
|
- VirtIOSound *s = VIRTIO_SND(vdev);
|
|
- const virtio_snd_config *sndconfig =
|
|
- (const virtio_snd_config *)config;
|
|
-
|
|
-
|
|
- trace_virtio_snd_set_config(vdev,
|
|
- s->snd_conf.jacks,
|
|
- sndconfig->jacks,
|
|
- s->snd_conf.streams,
|
|
- sndconfig->streams,
|
|
- s->snd_conf.chmaps,
|
|
- sndconfig->chmaps);
|
|
-
|
|
- memcpy(&s->snd_conf, sndconfig, sizeof(virtio_snd_config));
|
|
- le32_to_cpus(&s->snd_conf.jacks);
|
|
- le32_to_cpus(&s->snd_conf.streams);
|
|
- le32_to_cpus(&s->snd_conf.chmaps);
|
|
-
|
|
-}
|
|
-
|
|
static void
|
|
virtio_snd_pcm_buffer_free(VirtIOSoundPCMBuffer *buffer)
|
|
{
|
|
@@ -1399,7 +1376,6 @@ static void virtio_snd_class_init(ObjectClass *klass, void *data)
|
|
vdc->realize = virtio_snd_realize;
|
|
vdc->unrealize = virtio_snd_unrealize;
|
|
vdc->get_config = virtio_snd_get_config;
|
|
- vdc->set_config = virtio_snd_set_config;
|
|
vdc->get_features = get_features;
|
|
vdc->reset = virtio_snd_reset;
|
|
vdc->legacy_features = 0;
|
|
--
|
|
2.41.0.windows.1
|
|
|