<div dir="ltr">FWIW: in <a href="http://git.openembedded.org/openembedded-core-contrib/log/?h=jansa/qemu">http://git.openembedded.org/openembedded-core-contrib/log/?h=jansa/qemu</a> I have WIP qemu upgrade to 2.12.0 which includes this fix as well.</div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 24, 2018 at 9:37 AM, Hongxu Jia <span dir="ltr"><<a href="mailto:hongxu.jia@windriver.com" target="_blank">hongxu.jia@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">During Qemu guest migration, a destination process invokes ps2<br>
post_load function. In that, if 'rptr' and 'count' values were<br>
invalid, it could lead to OOB access or infinite loop issue.<br>
Add check to avoid it.<br>
<br>
Signed-off-by: Hongxu Jia <<a href="mailto:hongxu.jia@windriver.com">hongxu.jia@windriver.com</a>><br>
---<br>
...ck-PS2Queue-pointers-in-<wbr>post_load-routine.patch | 63 ++++++++++++++++++++++<br>
meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb" rel="noreferrer" target="_blank">qem<wbr>u_2.11.1.bb</a> | 1 +<br>
2 files changed, 64 insertions(+)<br>
create mode 100644 meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
<br>
diff --git a/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch b/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
new file mode 100644<br>
index 0000000..f8d7f66<br>
--- /dev/null<br>
+++ b/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
@@ -0,0 +1,63 @@<br>
+From ee9a17d0e12143971a9676227cce95<wbr>3c0dbe52fb Mon Sep 17 00:00:00 2001<br>
+From: Prasad J Pandit <<a href="mailto:pjp@fedoraproject.org">pjp@fedoraproject.org</a>><br>
+Date: Thu, 16 Nov 2017 13:21:55 +0530<br>
+Subject: [PATCH] ps2: check PS2Queue pointers in post_load routine<br>
+<br>
+During Qemu guest migration, a destination process invokes ps2<br>
+post_load function. In that, if 'rptr' and 'count' values were<br>
+invalid, it could lead to OOB access or infinite loop issue.<br>
+Add check to avoid it.<br>
+<br>
+Reported-by: Cyrille Chatras <<a href="mailto:cyrille.chatras@orange.com">cyrille.chatras@orange.com</a>><br>
+Signed-off-by: Prasad J Pandit <<a href="mailto:pjp@fedoraproject.org">pjp@fedoraproject.org</a>><br>
+Message-id: <a href="mailto:20171116075155.22378-1-ppandit@redhat.com">20171116075155.22378-1-<wbr>ppandit@redhat.com</a><br>
+Signed-off-by: Gerd Hoffmann <<a href="mailto:kraxel@redhat.com">kraxel@redhat.com</a>><br>
+<br>
+CVE: CVE-2017-16845<br>
+Upstream-Status: Backport<br>
+Signed-off-by: Hongxu Jia <<a href="mailto:hongxu.jia@windriver.com">hongxu.jia@windriver.com</a>><br>
+---<br>
+ hw/input/ps2.c | 21 +++++++++------------<br>
+ 1 file changed, 9 insertions(+), 12 deletions(-)<br>
+<br>
+diff --git a/hw/input/ps2.c b/hw/input/ps2.c<br>
+index f388a23..de171a2 100644<br>
+--- a/hw/input/ps2.c<br>
++++ b/hw/input/ps2.c<br>
+@@ -1225,24 +1225,21 @@ static void ps2_common_reset(PS2State *s)<br>
+ static void ps2_common_post_load(PS2State *s)<br>
+ {<br>
+ PS2Queue *q = &s->queue;<br>
+- int size;<br>
+- int i;<br>
+- int tmp_data[PS2_QUEUE_SIZE];<br>
++ uint8_t i, size;<br>
++ uint8_t tmp_data[PS2_QUEUE_SIZE];<br>
+ <br>
+ /* set the useful data buffer queue size, < PS2_QUEUE_SIZE */<br>
+- size = q->count > PS2_QUEUE_SIZE ? 0 : q->count;<br>
++ size = (q->count < 0 || q->count > PS2_QUEUE_SIZE) ? 0 : q->count;<br>
+ <br>
+ /* move the queue elements to the start of data array */<br>
+- if (size > 0) {<br>
+- for (i = 0; i < size; i++) {<br>
+- /* move the queue elements to the temporary buffer */<br>
+- tmp_data[i] = q->data[q->rptr];<br>
+- if (++q->rptr == 256) {<br>
+- q->rptr = 0;<br>
+- }<br>
++ for (i = 0; i < size; i++) {<br>
++ if (q->rptr < 0 || q->rptr >= sizeof(q->data)) {<br>
++ q->rptr = 0;<br>
+ }<br>
+- memcpy(q->data, tmp_data, size);<br>
++ tmp_data[i] = q->data[q->rptr++];<br>
+ }<br>
++ memcpy(q->data, tmp_data, size);<br>
++<br>
+ /* reset rptr/wptr/count */<br>
+ q->rptr = 0;<br>
+ q->wptr = size;<br>
+-- <br>
+2.7.4<br>
+<br>
diff --git a/meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb" rel="noreferrer" target="_blank">q<wbr>emu_2.11.1.bb</a> b/meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb" rel="noreferrer" target="_blank">q<wbr>emu_2.11.1.bb</a><br>
index f4b7d69..ab82c5f 100644<br>
--- a/meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb" rel="noreferrer" target="_blank">q<wbr>emu_2.11.1.bb</a><br>
+++ b/meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb" rel="noreferrer" target="_blank">q<wbr>emu_2.11.1.bb</a><br>
@@ -22,6 +22,7 @@ SRC_URI = "<a href="http://wiki.qemu-project.org/download/${BP}.tar.bz2" rel="noreferrer" target="_blank">http://wiki.qemu-project.org/<wbr>download/${BP}.tar.bz2</a> \<br>
file://linux-user-Fix-<wbr>webkitgtk-hangs-on-32-bit-x86-<wbr>target.patch \<br>
file://memfd.patch \<br>
file://0001-arm-translate-a64-<wbr>treat-DISAS_UPDATE-as-variant-<wbr>of-D.patch \<br>
+ file://check-PS2Queue-<wbr>pointers-in-post_load-routine.<wbr>patch \<br>
"<br>
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+\..*)\.tar"<br>
<span class="HOEnZb"><font color="#888888"> <br>
-- <br>
2.7.4<br>
<br>
-- <br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br></div>