2983660f65
CVE-2013-4377: Fix crash when unplugging virtio devices (bz #1012633, bz #1012641) Fix 'new snapshot' slowness after the first snap (bz #988436) Fix 9pfs xattrs on kernel 3.11 (bz #1013676) CVE-2013-4344: buffer overflow in scsi_target_emulate_report_luns (bz #1015274, bz #1007330)
60 lines
2.0 KiB
Diff
60 lines
2.0 KiB
Diff
From 50b31e80525d03ef406a8c9f55ff2ae1655a3b66 Mon Sep 17 00:00:00 2001
|
|
From: Jan Kiszka <jan.kiszka@siemens.com>
|
|
Date: Tue, 3 Sep 2013 18:08:50 +0200
|
|
Subject: [PATCH] kvmvapic: Catch invalid ROM size
|
|
|
|
If not caught early, a zero-length ROM will cause a NULL-pointer access
|
|
later on in patch_hypercalls when allocating a zero-length ROM copy and
|
|
trying to read from it.
|
|
|
|
CC: qemu-stable@nongnu.org
|
|
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 18e5eec4db96a00907eb588a2b803401637c7f67)
|
|
|
|
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
---
|
|
hw/i386/kvmvapic.c | 11 +++++++++--
|
|
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
|
|
index 15beb80..7ac0fe1 100644
|
|
--- a/hw/i386/kvmvapic.c
|
|
+++ b/hw/i386/kvmvapic.c
|
|
@@ -578,7 +578,7 @@ static int patch_hypercalls(VAPICROMState *s)
|
|
* enable write access to the option ROM so that variables can be updated by
|
|
* the guest.
|
|
*/
|
|
-static void vapic_map_rom_writable(VAPICROMState *s)
|
|
+static int vapic_map_rom_writable(VAPICROMState *s)
|
|
{
|
|
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;
|
|
MemoryRegionSection section;
|
|
@@ -599,6 +599,9 @@ static void vapic_map_rom_writable(VAPICROMState *s)
|
|
/* read ROM size from RAM region */
|
|
ram = memory_region_get_ram_ptr(section.mr);
|
|
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
|
|
+ if (rom_size == 0) {
|
|
+ return -1;
|
|
+ }
|
|
s->rom_size = rom_size;
|
|
|
|
/* We need to round to avoid creating subpages
|
|
@@ -612,11 +615,15 @@ static void vapic_map_rom_writable(VAPICROMState *s)
|
|
memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
|
|
s->rom_mapped_writable = true;
|
|
memory_region_unref(section.mr);
|
|
+
|
|
+ return 0;
|
|
}
|
|
|
|
static int vapic_prepare(VAPICROMState *s)
|
|
{
|
|
- vapic_map_rom_writable(s);
|
|
+ if (vapic_map_rom_writable(s) < 0) {
|
|
+ return -1;
|
|
+ }
|
|
|
|
if (patch_hypercalls(s) < 0) {
|
|
return -1;
|