Update version for 3.1.1.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
slrip: ip_reass: Fix use after free
2019-10-01 17:27:10 -05:00 · 2019-10-01 17:00:56 -05:00 · 2019-10-01 17:00:56 -05:00 · 2019-09-19 11:20:17 -05:00
3 changed files with 13 additions and 10 deletions
--- a/2
+++ b/2
@@ -1 +1 @@
-3.1.1
+3.1.1.1
--- a/hw/rdma/vmw/pvrdma_cmd.c
+++ b/hw/rdma/vmw/pvrdma_cmd.c
@@ -514,7 +514,7 @@ static int create_qp(PVRDMADev *dev, union pvrdma_cmd_req *req,
                                     cmd->recv_cq_handle, rings, &resp->qpn);
    if (resp->hdr.err) {
        destroy_qp_rings(rings);
-        return rc;
+        goto out;
    }

    resp->max_send_wr = cmd->max_send_wr;
--- a/slirp/ip_input.c
+++ b/slirp/ip_input.c
@@ -300,6 +300,7 @@ ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
 	 */
 	while (q != (struct ipasfrag*)&fp->frag_link &&
            ip->ip_off + ip->ip_len > q->ipf_off) {
+		struct ipasfrag *prev;
 		i = (ip->ip_off + ip->ip_len) - q->ipf_off;
 		if (i < q->ipf_len) {
 			q->ipf_len -= i;
@@ -307,9 +308,10 @@ ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
 			m_adj(dtom(slirp, q), i);
 			break;
 		}
+		prev = q;
 		q = q->ipf_next;
-		m_free(dtom(slirp, q->ipf_prev));
-		ip_deq(q->ipf_prev);
+		ip_deq(prev);
+		m_free(dtom(slirp, prev));
 	}

 insert:
@@ -334,6 +336,8 @@ insert:
    q = fp->frag_link.next;
 	m = dtom(slirp, q);

+	int was_ext = m->m_flags & M_EXT;
+
 	q = (struct ipasfrag *) q->ipf_next;
 	while (q != (struct ipasfrag*)&fp->frag_link) {
 	  struct mbuf *t = dtom(slirp, q);
@@ -350,13 +354,12 @@ insert:
 	q = fp->frag_link.next;

 	/*
-	 * If the fragments concatenated to an mbuf that's
-	 * bigger than the total size of the fragment, then and
-	 * m_ext buffer was alloced. But fp->ipq_next points to
-	 * the old buffer (in the mbuf), so we must point ip
-	 * into the new buffer.
+	 * If the fragments concatenated to an mbuf that's bigger than the total
+	 * size of the fragment and the mbuf was not already using an m_ext buffer,
+	 * then an m_ext buffer was alloced. But fp->ipq_next points to the old
+	 * buffer (in the mbuf), so we must point ip into the new buffer.
 	 */
-	if (m->m_flags & M_EXT) {
+	if (!was_ext && m->m_flags & M_EXT) {
 	  int delta = (char *)q - m->m_dat;
 	  q = (struct ipasfrag *)(m->m_ext + delta);
 	}
Author	SHA1	Message	Date
Michael Roth	920019e0e0	Update version for 3.1.1.1 release Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2019-10-01 17:27:10 -05:00
Michael Roth	9efdbc0224	slrip: ip_reass: Fix use after free Using ip_deq after m_free might read pointers from an allocation reuse. This would be difficult to exploit, but that is still related with CVE-2019-14378 which generates fragmented IP packets that would trigger this issue and at least produce a DoS. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> (from libslirp.git commit c59279437eda91841b9d26079c70b8a540d41204) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2019-10-01 17:00:56 -05:00
Michael Roth	28c1dde9aa	slirp: Fix heap overflow in ip_reass on big packet input When the first fragment does not fit in the preallocated buffer, q will already be pointing to the ext buffer, so we mustn't try to update it. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> (from libslirp.git commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210) (from libslirp.git commit e0be80430c390bce181ea04dfcdd6ea3dfa97de1) *squash in e0be80 (clarifying comments) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2019-10-01 17:00:56 -05:00
Cole Robinson	ab630a065a	pvrdma: Fix compilation error In function ‘create_qp’: hw/rdma/vmw/pvrdma_cmd.c:517:16: error: ‘rc’ undeclared The backport of `509f57c98` in `41dd30ff6` mishandled the conflict Signed-off-by: Cole Robinson <crobinso@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2019-09-19 11:20:17 -05:00
@@ -1 +1 @@
 .1.1
 .1.1.1