a8263c0693
- Include upstream patches designated as stable material and reviewed for applicability to include here block-Separate-blk_is_writable-and-blk_s.patch hw-intc-arm_gic-Fix-interrupt-ID-in-GICD.patch hw-net-lan9118-Fix-RX-Status-FIFO-PEEK-v.patch hw-timer-slavio_timer-Allow-64-bit-acces.patch net-Fix-handling-of-id-in-netdev_add-and.patch target-arm-Don-t-decode-insns-in-the-XSc.patch target-arm-Fix-MTE0_ACTIVE.patch target-arm-Introduce-PREDDESC-field-defi.patch target-arm-Update-PFIRST-PNEXT-for-pred_.patch target-arm-Update-REV-PUNPK-for-pred_des.patch target-arm-Update-ZIP-UZP-TRN-for-pred_d.patch tcg-Use-memset-for-large-vector-byte-rep.patch ui-vnc-Add-missing-lock-for-send_color_m.patch virtio-move-use-disabled-flag-property-t.patch - binutils v2.36 has changed the handling of the assembler's -mx86-used-note, resulting in a build failure. To compensate, we now explicitly specify -mx86-used-note=no in the seabios Makefile (boo#1181775) build-be-explicit-about-mx86-used-note-n.patch OBS-URL: https://build.opensuse.org/request/show/869843 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=614
65 lines
2.5 KiB
Diff
65 lines
2.5 KiB
Diff
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <f4bug@amsat.org>
|
|
Date: Sun, 31 Jan 2021 11:34:01 +0100
|
|
Subject: hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Git-commit: edfe2eb4360cde4ed5d95bda7777edcb3510f76a
|
|
|
|
Per the ARM Generic Interrupt Controller Architecture specification
|
|
(document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit,
|
|
not 10:
|
|
|
|
- 4.3 Distributor register descriptions
|
|
- 4.3.15 Software Generated Interrupt Register, GICD_SG
|
|
|
|
- Table 4-21 GICD_SGIR bit assignments
|
|
|
|
The Interrupt ID of the SGI to forward to the specified CPU
|
|
interfaces. The value of this field is the Interrupt ID, in
|
|
the range 0-15, for example a value of 0b0011 specifies
|
|
Interrupt ID 3.
|
|
|
|
Correct the irq mask to fix an undefined behavior (which eventually
|
|
lead to a heap-buffer-overflow, see [Buglink]):
|
|
|
|
$ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio
|
|
[I 1612088147.116987] OPENED
|
|
[R +0.278293] writel 0x8000f00 0xff4affb0
|
|
../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]'
|
|
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13
|
|
|
|
This fixes a security issue when running with KVM on Arm with
|
|
kernel-irqchip=off. (The default is kernel-irqchip=on, which is
|
|
unaffected, and which is also the correct choice for performance.)
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Fixes: CVE-2021-20221
|
|
Fixes: 9ee6e8bb853 ("ARMv7 support.")
|
|
Buglink: https://bugs.launchpad.net/qemu/+bug/1913916
|
|
Buglink: https://bugs.launchpad.net/qemu/+bug/1913917
|
|
Reported-by: Alexander Bulekov <alxndr@bu.edu>
|
|
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
|
|
Message-id: 20210131103401.217160-1-f4bug@amsat.org
|
|
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/intc/arm_gic.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
|
|
index c60dc6b5e6e519e61b20dda66c7b..fbde60de05a20a607a64a5a91bad 100644
|
|
--- a/hw/intc/arm_gic.c
|
|
+++ b/hw/intc/arm_gic.c
|
|
@@ -1474,7 +1474,7 @@ static void gic_dist_writel(void *opaque, hwaddr offset,
|
|
int target_cpu;
|
|
|
|
cpu = gic_get_current_cpu(s);
|
|
- irq = value & 0x3ff;
|
|
+ irq = value & 0xf;
|
|
switch ((value >> 24) & 3) {
|
|
case 0:
|
|
mask = (value >> 16) & ALL_CPU_MASK;
|