c300b8e80b
- vfio/migration: Add support for manual clear vfio dirty log - vfio: Maintain DMA mapping range for the container - linux-headers: update against 5.10 and manual clear vfio dirty log series - arm/acpi: Fix when make qemu-system-aarch64 at x86_64 host bios_tables_test fail reason: __aarch64__ macro let build_pptt at x86_64 and aarch64 host build different function that let bios_tables_test fail. - pl031: support rtc-timer property for pl031 - feature: Add logs for vm start and destroy - feature: Add log for each modules - log: Add log at boot & cpu init for aarch64 - bugfix: irq: Avoid covering object refcount of qemu_irq - i386: cache passthrough: Update AMD 8000_001D.EAX[25:14] based on vCPU topo - freeclock: set rtc_date_diff for X86 - freeclock: set rtc_date_diff for arm - freeclock: add qmp command to get time offset of vm in seconds - tests: Disable filemonitor testcase - shadow_dev: introduce shadow dev for virtio-net device - pl011: reset read FIFO when UARTTIMSC=0 & UARTICR=0xffff - tests: virt: Update expected ACPI tables for virt test(update BinDir) - arm64: Add the cpufreq device to show cpufreq info to guest - hw/arm64: add vcpu cache info support - tests: virt: Allow changes to PPTT test table - cpu: add Cortex-A72 processor kvm target support - cpu: add Kunpeng-920 cpu support - net: eepro100: validate various address valuesi(CVE-2021-20255) - ide: ahci: add check to avoid null dereference (CVE-2019-12067) - vdpa: set vring enable only if the vring address has already been set - docs: Add generic vhost-vdpa device documentation - vdpa: don't suspend/resume device when vdpa device not started - vdpa: correct param passed in when unregister save - vdpa: suspend function return 0 when the vdpa device is stopped - vdpa: support vdpa device suspend/resume - vdpa: move memory listener to the realize stage - vdpa: implement vdpa device migration - vhost: implement migration state notifier for vdpa device - vhost: implement post resume bh - vhost: implement savevm_handler for vdpa device - vhost: implement vhost_vdpa_device_suspend/resume - vhost: implement vhost-vdpa suspend/resume - vhost: add vhost_dev_suspend/resume_op - vhost: introduce bytemap for vhost backend logging - vhost-vdpa: add migration log ops for VhostOps - vhost-vdpa: add VHOST_BACKEND_F_BYTEMAPLOG - hw/usb: reduce the vpcu cost of UHCI when VNC disconnect - virtio-net: update the default and max of rx/tx_queue_size - virtio-net: set the max of queue size to 4096 - virtio-net: fix max vring buf size when set ring num - virtio-net: bugfix: do not delete netdev before virtio net - monitor: Discard BLOCK_IO_ERROR event when VM rebooted - vhost-user: add unregister_savevm when vhost-user cleanup - vhost-user: add vhost_set_mem_table when vm load_setup at destination - vhost-user: quit infinite loop while used memslots is more than the backend limit - fix qemu-core when vhost-user-net config with server mode - vhost-user: Add support reconnect vhost-user socket - vhost-user: Set the acked_features to vm's featrue - i6300esb watchdog: bugfix: Add a runstate transition - hw/net/rocker_of_dpa: fix double free bug of rocker device - net/dump.c: Suppress spurious compiler warning - pcie: Add pcie-root-port fast plug/unplug feature - pcie: Compat with devices which do not support Link Width, such as ioh3420 - qdev/monitors: Fix reundant error_setg of qdev_add_device - qemu-nbd: set timeout to qemu-nbd socket - qemu-nbd: make native as the default aio mode - nbd/server.c: fix invalid read after client was already free - virtio-scsi: bugfix: fix qemu crash for hotplug scsi disk with dataplane - virtio: bugfix: check the value of caches before accessing it - virtio: print the guest virtio_net features that host does not support - virtio: bugfix: add rcu_read_lock when vring_avail_idx is called - virtio: check descriptor numbers - migration: report multiFd related thread pid to libvirt - migration: report migration related thread pid to libvirt - cpu/features: fix bug for memory leakage - doc: Update multi-thread compression doc - migration: Add compress_level sanity check - migration: Add zstd support in multi-thread compression - migration: Add multi-thread compress ops - migration: Refactoring multi-thread compress migration - migration: Add multi-thread compress method - migration: skip cache_drop for bios bootloader and nvram template - oslib-posix: optimise vm startup time for 1G hugepage - monitor/qmp: drop inflight rsp if qmp client broken - ps2: fix oob in ps2 kbd - Currently, while kvm and qemu can not handle some kvm exit, qemu will do vm_stop, which will make vm in pause state. This action make vm unrecoverable, so send guest panic to libvirt instead. - vhost: cancel migration when vhost-user restarted during migraiton Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
59 lines
1.6 KiB
Diff
59 lines
1.6 KiB
Diff
From 6e6215b3ad0c8eac918bca9e2b5bb661e27f2fed Mon Sep 17 00:00:00 2001
|
|
From: zhouli57 <zhouli57@huawei.com>
|
|
Date: Sat, 18 Dec 2021 09:39:57 +0800
|
|
Subject: [PATCH] net: eepro100: validate various address
|
|
valuesi(CVE-2021-20255)
|
|
|
|
fix CVE-2021-20255
|
|
|
|
patch link: https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg06098.html
|
|
|
|
fix CVE-2021-20255, sync patch from ostms platform.
|
|
|
|
Signed-off-by: zhouli57 <zhouli57@huawei.com>
|
|
Signed-off-by: Yan Wang <wangyan122@huawei.com>
|
|
---
|
|
hw/net/eepro100.c | 12 ++++++++++++
|
|
1 file changed, 12 insertions(+)
|
|
|
|
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
|
|
index 69e1c4bb89..f6204ec059 100644
|
|
--- a/hw/net/eepro100.c
|
|
+++ b/hw/net/eepro100.c
|
|
@@ -279,6 +279,9 @@ typedef struct {
|
|
/* Quasi static device properties (no need to save them). */
|
|
uint16_t stats_size;
|
|
bool has_extended_tcb_support;
|
|
+
|
|
+ /* Flag to avoid recursions. */
|
|
+ bool busy;
|
|
} EEPRO100State;
|
|
|
|
/* Word indices in EEPROM. */
|
|
@@ -844,6 +847,14 @@ static void action_command(EEPRO100State *s)
|
|
Therefore we limit the number of iterations. */
|
|
unsigned max_loop_count = 16;
|
|
|
|
+ if (s->busy) {
|
|
+ /* Prevent recursions. */
|
|
+ logout("recursion in %s:%u\n", __FILE__, __LINE__);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ s->busy = true;
|
|
+
|
|
for (;;) {
|
|
bool bit_el;
|
|
bool bit_s;
|
|
@@ -940,6 +951,7 @@ static void action_command(EEPRO100State *s)
|
|
}
|
|
TRACE(OTHER, logout("CU list empty\n"));
|
|
/* List is empty. Now CU is idle or suspended. */
|
|
+ s->busy = false;
|
|
}
|
|
|
|
static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
|
|
--
|
|
2.27.0
|
|
|