From 5df4748ecff67fa8b1f402b09ea6cc13dbd2dbbe Mon Sep 17 00:00:00 2001 From: Mark McLoughlin Date: Mon, 19 Oct 2009 10:33:27 +0000 Subject: [PATCH] - Fix potential segfault from too small MSR_COUNT (#528901) --- qemu-fix-msr-count-potential-segfault.patch | 67 +++++++++++++++++++++ qemu.spec | 9 ++- 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 qemu-fix-msr-count-potential-segfault.patch diff --git a/qemu-fix-msr-count-potential-segfault.patch b/qemu-fix-msr-count-potential-segfault.patch new file mode 100644 index 0000000..c9f92bc --- /dev/null +++ b/qemu-fix-msr-count-potential-segfault.patch @@ -0,0 +1,67 @@ +From 7834349cfcc68b946c0d241ffd99c598857e489b Mon Sep 17 00:00:00 2001 +From: Eduardo Habkost +Date: Wed, 14 Oct 2009 15:02:27 -0300 +Subject: [PATCH] fix MSR_COUNT for kvm_arch_save_regs() + +A new register was added to the load/save list on commit +d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading +to potential stack corruption on kvm_arch_save_regs(). + +The following registers are saved by kvm_arch_save_regs(): + + 1) MSR_IA32_SYSENTER_CS + 2) MSR_IA32_SYSENTER_ESP + 3) MSR_IA32_SYSENTER_EIP + 4) MSR_STAR + 5) MSR_IA32_TSC + 6) MSR_VM_HSAVE_PA + 7) MSR_CSTAR (x86_64 only) + 8) MSR_KERNELGSBASE (x86_64 only) + 9) MSR_FMASK (x86_64 only) +10) MSR_LSTAR (x86_64 only) + +(cherry picked from commit e7e5448ba387adc20be1cf08411a5b526d684299) + +Signed-off-by: Eduardo Habkost +Signed-off-by: Marcelo Tosatti +Signed-off-by: Mark McLoughlin +Fedora-patch: qemu-fix-msr-count-potential-segfault.patch +--- + qemu-kvm-x86.c | 6 ++++-- + 1 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c +index 492dbc5..d5436b6 100644 +--- a/qemu-kvm-x86.c ++++ b/qemu-kvm-x86.c +@@ -847,9 +847,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env) + } + + #ifdef TARGET_X86_64 +-#define MSR_COUNT 9 ++#define MSR_COUNT 10 + #else +-#define MSR_COUNT 5 ++#define MSR_COUNT 6 + #endif + + static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs) +@@ -991,6 +991,7 @@ void kvm_arch_load_regs(CPUState *env) + + /* msrs */ + n = 0; ++ /* Remember to increase MSR_COUNT if you add new registers below */ + set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS, env->sysenter_cs); + set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp); + set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip); +@@ -1166,6 +1167,7 @@ void kvm_arch_save_regs(CPUState *env) + + /* msrs */ + n = 0; ++ /* Remember to increase MSR_COUNT if you add new registers below */ + msrs[n++].index = MSR_IA32_SYSENTER_CS; + msrs[n++].index = MSR_IA32_SYSENTER_ESP; + msrs[n++].index = MSR_IA32_SYSENTER_EIP; +-- +1.6.2.5 + diff --git a/qemu.spec b/qemu.spec index af31534..e2000fe 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,7 +1,7 @@ Summary: QEMU is a FAST! processor emulator Name: qemu Version: 0.11.0 -Release: 6%{?dist} +Release: 7%{?dist} # Epoch because we pushed a qemu-1.0 package Epoch: 2 License: GPLv2+ and LGPLv2+ and BSD @@ -49,6 +49,9 @@ Patch08: qemu-improve-error-reporting-on-file-access.patch # Fix fs errors with virtio and qcow2 backing file (#524734) Patch09: qemu-fix-qcow2-backing-file-with-virtio.patch +# Fix potential segfault from too small MSR_COUNT (#528901) +Patch10: qemu-fix-msr-count-potential-segfault.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel BuildRequires: rsync dev86 iasl @@ -245,6 +248,7 @@ such as kvmtrace and kvm_stat. %patch07 -p1 %patch08 -p1 %patch09 -p1 +%patch10 -p1 %build # --build-id option is used fedora 8 onwards for giving info to the debug packages. @@ -526,6 +530,9 @@ fi %{_mandir}/man1/qemu-img.1* %changelog +* Mon Oct 19 2009 Mark McLoughlin - 2:0.11.0-7 +- Fix potential segfault from too small MSR_COUNT (#528901) + * Fri Oct 9 2009 Mark McLoughlin - 2:0.11.0-6 - Fix fs errors with virtio and qcow2 backing file (#524734) - Fix ksm initscript errors on kernel missing ksm (#527653)