31905d81fa
xen-4.6.1-testing-src.tar.bz2 - Dropped patches now contained in tarball or unnecessary xen-4.6.0-testing-src.tar.bz2 5604f239-x86-PV-properly-populate-descriptor-tables.patch 561bbc8b-VT-d-don-t-suppress-invalidation-address-write-when-it-is-zero.patch 561d2046-VT-d-use-proper-error-codes-in-iommu_enable_x2apic_IR.patch 561d20a0-x86-hide-MWAITX-from-PV-domains.patch 561e3283-x86-NUMA-fix-SRAT-table-processor-entry-parsing-and-consumption.patch 5632118e-arm-Support-hypercall_create_continuation-for-multicall.patch 56321222-arm-rate-limit-logging-from-unimplemented-PHYSDEVOP-and-HVMOP.patch 56321249-arm-handle-races-between-relinquish_memory-and-free_domheap_pages.patch 5632127b-x86-guard-against-undue-super-page-PTE-creation.patch 5632129c-free-domain-s-vcpu-array.patch 563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch 563212e4-xenoprof-free-domain-s-vcpu-array.patch 563212ff-x86-rate-limit-logging-in-do_xen-oprof-pmu-_op.patch 56323737-libxl-adjust-PoD-target-by-memory-fudge-too.patch 56377442-x86-PoD-Make-p2m_pod_empty_cache-restartable.patch 5641ceec-x86-HVM-always-intercept-AC-and-DB.patch 56549f24-x86-vPMU-document-as-unsupported.patch 5677f350-x86-make-debug-output-consistent-in-hvm_set_callback_via.patch xen-4.6.0-testing-src.tar.bz2 xsa155-qemut-qdisk-double-access.patch xsa155-qemut-xenfb.patch xsa155-qemuu-qdisk-double-access.patch xsa155-qemuu-xenfb.patch xsa159.patch xsa160.patch xsa162-qemut.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=399
141 lines
6.9 KiB
Diff
141 lines
6.9 KiB
Diff
References: bsc#965156 CVE-2015-6855
|
|
|
|
Subject: ide: fix ATAPI command permissions
|
|
From: John Snow jsnow@redhat.com Thu Sep 17 14:17:05 2015 -0400
|
|
Date: Fri Sep 18 10:58:56 2015 -0400:
|
|
Git: d9033e1d3aa666c5071580617a57bd853c5d794a
|
|
|
|
We're a little too lenient with what we'll let an ATAPI drive handle.
|
|
Clamp down on the IDE command execution table to remove CD_OK permissions
|
|
from commands that are not and have never been ATAPI commands.
|
|
|
|
For ATAPI command validity, please see:
|
|
- ATA4 Section 6.5 ("PACKET Command feature set")
|
|
- ATA8/ACS Section 4.3 ("The PACKET feature set")
|
|
- ACS3 Section 4.3 ("The PACKET feature set")
|
|
|
|
ACS3 has a historical command validity table in Table B.4
|
|
("Historical Command Assignments") that can be referenced to find when
|
|
a command was introduced, deprecated, obsoleted, etc.
|
|
|
|
The only reference for ATAPI command validity is by checking that
|
|
version's PACKET feature set section.
|
|
|
|
ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
|
|
therefore are assumed to have never been ATAPI commands.
|
|
|
|
Mandatory commands, as listed in ATA8-ACS3, are:
|
|
|
|
- DEVICE RESET
|
|
- EXECUTE DEVICE DIAGNOSTIC
|
|
- IDENTIFY DEVICE
|
|
- IDENTIFY PACKET DEVICE
|
|
- NOP
|
|
- PACKET
|
|
- READ SECTOR(S)
|
|
- SET FEATURES
|
|
|
|
Optional commands as listed in ATA8-ACS3, are:
|
|
|
|
- FLUSH CACHE
|
|
- READ LOG DMA EXT
|
|
- READ LOG EXT
|
|
- WRITE LOG DMA EXT
|
|
- WRITE LOG EXT
|
|
|
|
All other commands are illegal to send to an ATAPI device and should
|
|
be rejected by the device.
|
|
|
|
CD_OK removal justifications:
|
|
|
|
0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI.
|
|
0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4.
|
|
0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI.
|
|
0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3.
|
|
0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.
|
|
|
|
This patch fixes a divide by zero fault that can be caused by sending
|
|
the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
|
|
attempt to use zeroed CHS values to perform sector arithmetic.
|
|
|
|
Reported-by: Qinghao Tang <luodalongde@gmail.com>
|
|
Signed-off-by: John Snow <jsnow@redhat.com>
|
|
Reviewed-by: Markus Armbruster <armbru@redhat.com>
|
|
Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
|
|
CC: qemu-stable@nongnu.org
|
|
|
|
Index: xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/ide/core.c
|
|
===================================================================
|
|
--- xen-4.6.0-testing.orig/tools/qemu-xen-dir-remote/hw/ide/core.c
|
|
+++ xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/ide/core.c
|
|
@@ -1739,11 +1739,11 @@ static const struct {
|
|
} ide_cmd_table[0x100] = {
|
|
/* NOP not implemented, mandatory for CD */
|
|
[CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK },
|
|
- [WIN_DSM] = { cmd_data_set_management, ALL_OK },
|
|
+ [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK },
|
|
[WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK },
|
|
[WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC},
|
|
[WIN_READ] = { cmd_read_pio, ALL_OK },
|
|
- [WIN_READ_ONCE] = { cmd_read_pio, ALL_OK },
|
|
+ [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK },
|
|
[WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK },
|
|
[WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK },
|
|
[WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
|
|
@@ -1762,12 +1762,12 @@ static const struct {
|
|
[CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK },
|
|
[WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK },
|
|
[WIN_SPECIFY] = { cmd_nop, HD_CFA_OK | SET_DSC },
|
|
- [WIN_STANDBYNOW2] = { cmd_nop, ALL_OK },
|
|
- [WIN_IDLEIMMEDIATE2] = { cmd_nop, ALL_OK },
|
|
- [WIN_STANDBY2] = { cmd_nop, ALL_OK },
|
|
- [WIN_SETIDLE2] = { cmd_nop, ALL_OK },
|
|
- [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, ALL_OK | SET_DSC },
|
|
- [WIN_SLEEPNOW2] = { cmd_nop, ALL_OK },
|
|
+ [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
|
|
+ [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK },
|
|
[WIN_PACKETCMD] = { cmd_packet, CD_OK },
|
|
[WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK },
|
|
[WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC },
|
|
@@ -1781,19 +1781,19 @@ static const struct {
|
|
[WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK },
|
|
[WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK },
|
|
[CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK },
|
|
- [WIN_STANDBYNOW1] = { cmd_nop, ALL_OK },
|
|
- [WIN_IDLEIMMEDIATE] = { cmd_nop, ALL_OK },
|
|
- [WIN_STANDBY] = { cmd_nop, ALL_OK },
|
|
- [WIN_SETIDLE1] = { cmd_nop, ALL_OK },
|
|
- [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, ALL_OK | SET_DSC },
|
|
- [WIN_SLEEPNOW1] = { cmd_nop, ALL_OK },
|
|
+ [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_STANDBY] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK },
|
|
+ [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
|
|
+ [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK },
|
|
[WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK },
|
|
[WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK },
|
|
[WIN_IDENTIFY] = { cmd_identify, ALL_OK },
|
|
[WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC },
|
|
[IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
|
|
[CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
|
|
- [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, ALL_OK | SET_DSC },
|
|
+ [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
|
|
};
|
|
|
|
static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
|