Accepting request 955421 from home:lizhang:branches:Virtualization

-Backport patch from upstream, bsc#1194063 CVE-2021-4158
* Patches added:
  acpi-validate-hotplug-selector-on-access.patch
- Binary firmwares are built from sources by default (and not only on
  x86) and then "cross-imported" among builds for different arches. Of
  course this requires, additionally to these changes, a proper project
  setup (see prjconf). This fixes bsc#1193545.
  * Build x86 firmwares only on x86 builds (i.e., stop cross building
    them on ARM)
  * Build x86 firmwares only once (during x86_64 builds only), instead
    of twice (i.e., during both %ix86 and x86_64, as we're doing now))
  * Always build PPC firmwares (only on PPC builds)
  * Build PPC firmwares only once (during ppc64le builds only), instead
    of twice (i.e., during both ppc64 and ppc64le, as we're doing now))

OBS-URL: https://build.opensuse.org/request/show/955421
OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=689

acpi-validate-hotplug-selector-on-access.patch

@@ -0,0 +1,41 @@
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Tue, 21 Dec 2021 09:45:44 -0500
+Subject: acpi: validate hotplug selector on access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Git-commit: 9bd6565ccee68f72d5012e24646e12a1c662827e
+References: bsc#1194063
+
+When bus is looked up on a pci write, we didn't
+validate that the lookup succeeded.
+Fuzzers thus can trigger QEMU crash by dereferencing the NULL
+bus pointer.
+
+Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
+Fixes: CVE-2021-4158
+Cc: "Igor Mammedov" <imammedo@redhat.com>
+Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+Signed-off-by: Li Zhang <lizhang@suse.de>
+---
+ hw/acpi/pcihp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index 30405b5113d7fb5a259a9d9cbd76..a5e182dd3a372fee2805923a314c 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
+         }
+ 
+         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
++        if (!bus) {
++            break;
++        }
+         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
+             Object *o = OBJECT(kid->child);
+             PCIDevice *dev = PCI_DEVICE(o);

bundles.tar.xz

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:72f47f160a142dd8550c49fa2bf712da0ced6ca2dd1895ea6e960588fc733be1
-size 46412
+oid sha256:9a992b15dafd241028da10fd0b802efc72f2b5997c41d3ba07fce2eec7791baa
+size 47228

qemu.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Feb 16 10:58:52 UTC 2022 - Li Zhang <li.zhang@suse.com>
+
+-Backport patch from upstream, bsc#1194063 CVE-2021-4158
+* Patches added:
+  acpi-validate-hotplug-selector-on-access.patch
+
 -------------------------------------------------------------------
 Sun Jan 23 15:13:19 UTC 2022 - Li Zhang <li.zhang@suse.com>
 

qemu.spec

@@ -180,6 +180,7 @@ Patch00044:     modules-quick-fix-a-fundamental-error-in.patch
 Patch00045:     qemu-binfmt-conf.sh-allow-overriding-SUS.patch
 Patch00046:     scsi-generic-replace-logical-block-count.patch
 Patch00047:     meson-build-all-modules-by-default.patch
+Patch00048:     acpi-validate-hotplug-selector-on-access.patch
 # Patches applied in roms/seabios/:
 Patch01000:     seabios-use-python2-explicitly-as-needed.patch
 Patch01001:     seabios-switch-to-python3-as-needed.patch
@@ -1127,6 +1128,7 @@ This package records qemu testsuite results and represents successful testing.
 %patch00045 -p1
 %patch00046 -p1
 %patch00047 -p1
+%patch00048 -p1
 %patch01000 -p1
 %patch01001 -p1
 %patch01002 -p1