From 1f8423418820e16d35fdf7408614e7af7aaf6a2477429906a1d2300bc2bfa04f Mon Sep 17 00:00:00 2001 From: Li Zhang Date: Wed, 16 Feb 2022 16:43:06 +0000 Subject: [PATCH] Accepting request 955421 from home:lizhang:branches:Virtualization -Backport patch from upstream, bsc#1194063 CVE-2021-4158 * Patches added: acpi-validate-hotplug-selector-on-access.patch - Binary firmwares are built from sources by default (and not only on x86) and then "cross-imported" among builds for different arches. Of course this requires, additionally to these changes, a proper project setup (see prjconf). This fixes bsc#1193545. * Build x86 firmwares only on x86 builds (i.e., stop cross building them on ARM) * Build x86 firmwares only once (during x86_64 builds only), instead of twice (i.e., during both %ix86 and x86_64, as we're doing now)) * Always build PPC firmwares (only on PPC builds) * Build PPC firmwares only once (during ppc64le builds only), instead of twice (i.e., during both ppc64 and ppc64le, as we're doing now)) OBS-URL: https://build.opensuse.org/request/show/955421 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=689 --- ...-validate-hotplug-selector-on-access.patch | 41 +++++++++++++++++++ bundles.tar.xz | 4 +- qemu.changes | 7 ++++ qemu.spec | 2 + 4 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 acpi-validate-hotplug-selector-on-access.patch diff --git a/acpi-validate-hotplug-selector-on-access.patch b/acpi-validate-hotplug-selector-on-access.patch new file mode 100644 index 00000000..53b40f32 --- /dev/null +++ b/acpi-validate-hotplug-selector-on-access.patch @@ -0,0 +1,41 @@ +From: "Michael S. Tsirkin" +Date: Tue, 21 Dec 2021 09:45:44 -0500 +Subject: acpi: validate hotplug selector on access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Git-commit: 9bd6565ccee68f72d5012e24646e12a1c662827e +References: bsc#1194063 + +When bus is looked up on a pci write, we didn't +validate that the lookup succeeded. +Fuzzers thus can trigger QEMU crash by dereferencing the NULL +bus pointer. + +Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device") +Fixes: CVE-2021-4158 +Cc: "Igor Mammedov" +Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770 +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Philippe Mathieu-Daudé +Reviewed-by: Ani Sinha +Signed-off-by: Li Zhang +--- + hw/acpi/pcihp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c +index 30405b5113d7fb5a259a9d9cbd76..a5e182dd3a372fee2805923a314c 100644 +--- a/hw/acpi/pcihp.c ++++ b/hw/acpi/pcihp.c +@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data, + } + + bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select); ++ if (!bus) { ++ break; ++ } + QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) { + Object *o = OBJECT(kid->child); + PCIDevice *dev = PCI_DEVICE(o); diff --git a/bundles.tar.xz b/bundles.tar.xz index bf819ccd..3d76d743 100644 --- a/bundles.tar.xz +++ b/bundles.tar.xz @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:72f47f160a142dd8550c49fa2bf712da0ced6ca2dd1895ea6e960588fc733be1 -size 46412 +oid sha256:9a992b15dafd241028da10fd0b802efc72f2b5997c41d3ba07fce2eec7791baa +size 47228 diff --git a/qemu.changes b/qemu.changes index 08aabf0b..9d24f0f3 100644 --- a/qemu.changes +++ b/qemu.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Feb 16 10:58:52 UTC 2022 - Li Zhang + +-Backport patch from upstream, bsc#1194063 CVE-2021-4158 +* Patches added: + acpi-validate-hotplug-selector-on-access.patch + ------------------------------------------------------------------- Sun Jan 23 15:13:19 UTC 2022 - Li Zhang diff --git a/qemu.spec b/qemu.spec index 954c1734..e689bb08 100644 --- a/qemu.spec +++ b/qemu.spec @@ -180,6 +180,7 @@ Patch00044: modules-quick-fix-a-fundamental-error-in.patch Patch00045: qemu-binfmt-conf.sh-allow-overriding-SUS.patch Patch00046: scsi-generic-replace-logical-block-count.patch Patch00047: meson-build-all-modules-by-default.patch +Patch00048: acpi-validate-hotplug-selector-on-access.patch # Patches applied in roms/seabios/: Patch01000: seabios-use-python2-explicitly-as-needed.patch Patch01001: seabios-switch-to-python3-as-needed.patch @@ -1127,6 +1128,7 @@ This package records qemu testsuite results and represents successful testing. %patch00045 -p1 %patch00046 -p1 %patch00047 -p1 +%patch00048 -p1 %patch01000 -p1 %patch01001 -p1 %patch01002 -p1