<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2018年04月26日 04:10, Martin Jansa
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CA+chaQcMOcc_uvyibBzwXqdRXw1F5ybuK_UipOGxcO=nA4oWPA@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">FWIW: in <a
href="http://git.openembedded.org/openembedded-core-contrib/log/?h=jansa/qemu"
moz-do-not-send="true">http://git.openembedded.org/openembedded-core-contrib/log/?h=jansa/qemu</a>
I have WIP qemu upgrade to 2.12.0 which includes this fix as
well.</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
<br>
Got it, thanks<br>
<br>
//Hongxu<br>
<br>
<blockquote type="cite"
cite="mid:CA+chaQcMOcc_uvyibBzwXqdRXw1F5ybuK_UipOGxcO=nA4oWPA@mail.gmail.com">
<div class="gmail_extra">
<div class="gmail_quote">On Tue, Apr 24, 2018 at 9:37 AM, Hongxu
Jia <span dir="ltr"><<a
href="mailto:hongxu.jia@windriver.com" target="_blank"
moz-do-not-send="true">hongxu.jia@windriver.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">During
Qemu guest migration, a destination process invokes ps2<br>
post_load function. In that, if 'rptr' and 'count' values
were<br>
invalid, it could lead to OOB access or infinite loop issue.<br>
Add check to avoid it.<br>
<br>
Signed-off-by: Hongxu Jia <<a
href="mailto:hongxu.jia@windriver.com"
moz-do-not-send="true">hongxu.jia@windriver.com</a>><br>
---<br>
...ck-PS2Queue-pointers-in-<wbr>post_load-routine.patch |
63 ++++++++++++++++++++++<br>
meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb"
rel="noreferrer" target="_blank" moz-do-not-send="true">qem<wbr>u_2.11.1.bb</a>
| 1 +<br>
2 files changed, 64 insertions(+)<br>
create mode 100644 meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
<br>
diff --git a/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch
b/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
new file mode 100644<br>
index 0000000..f8d7f66<br>
--- /dev/null<br>
+++ b/meta/recipes-devtools/qemu/<wbr>qemu/check-PS2Queue-pointers-<wbr>in-post_load-routine.patch<br>
@@ -0,0 +1,63 @@<br>
+From ee9a17d0e12143971a9676227cce95<wbr>3c0dbe52fb Mon Sep
17 00:00:00 2001<br>
+From: Prasad J Pandit <<a
href="mailto:pjp@fedoraproject.org" moz-do-not-send="true">pjp@fedoraproject.org</a>><br>
+Date: Thu, 16 Nov 2017 13:21:55 +0530<br>
+Subject: [PATCH] ps2: check PS2Queue pointers in post_load
routine<br>
+<br>
+During Qemu guest migration, a destination process invokes
ps2<br>
+post_load function. In that, if 'rptr' and 'count' values
were<br>
+invalid, it could lead to OOB access or infinite loop
issue.<br>
+Add check to avoid it.<br>
+<br>
+Reported-by: Cyrille Chatras <<a
href="mailto:cyrille.chatras@orange.com"
moz-do-not-send="true">cyrille.chatras@orange.com</a>><br>
+Signed-off-by: Prasad J Pandit <<a
href="mailto:pjp@fedoraproject.org" moz-do-not-send="true">pjp@fedoraproject.org</a>><br>
+Message-id: <a
href="mailto:20171116075155.22378-1-ppandit@redhat.com"
moz-do-not-send="true">20171116075155.22378-1-<wbr>ppandit@redhat.com</a><br>
+Signed-off-by: Gerd Hoffmann <<a
href="mailto:kraxel@redhat.com" moz-do-not-send="true">kraxel@redhat.com</a>><br>
+<br>
+CVE: CVE-2017-16845<br>
+Upstream-Status: Backport<br>
+Signed-off-by: Hongxu Jia <<a
href="mailto:hongxu.jia@windriver.com"
moz-do-not-send="true">hongxu.jia@windriver.com</a>><br>
+---<br>
+ hw/input/ps2.c | 21 +++++++++------------<br>
+ 1 file changed, 9 insertions(+), 12 deletions(-)<br>
+<br>
+diff --git a/hw/input/ps2.c b/hw/input/ps2.c<br>
+index f388a23..de171a2 100644<br>
+--- a/hw/input/ps2.c<br>
++++ b/hw/input/ps2.c<br>
+@@ -1225,24 +1225,21 @@ static void
ps2_common_reset(PS2State *s)<br>
+ static void ps2_common_post_load(PS2State *s)<br>
+ {<br>
+ PS2Queue *q = &s->queue;<br>
+- int size;<br>
+- int i;<br>
+- int tmp_data[PS2_QUEUE_SIZE];<br>
++ uint8_t i, size;<br>
++ uint8_t tmp_data[PS2_QUEUE_SIZE];<br>
+ <br>
+ /* set the useful data buffer queue size, <
PS2_QUEUE_SIZE */<br>
+- size = q->count > PS2_QUEUE_SIZE ? 0 :
q->count;<br>
++ size = (q->count < 0 || q->count >
PS2_QUEUE_SIZE) ? 0 : q->count;<br>
+ <br>
+ /* move the queue elements to the start of data array
*/<br>
+- if (size > 0) {<br>
+- for (i = 0; i < size; i++) {<br>
+- /* move the queue elements to the temporary
buffer */<br>
+- tmp_data[i] = q->data[q->rptr];<br>
+- if (++q->rptr == 256) {<br>
+- q->rptr = 0;<br>
+- }<br>
++ for (i = 0; i < size; i++) {<br>
++ if (q->rptr < 0 || q->rptr >=
sizeof(q->data)) {<br>
++ q->rptr = 0;<br>
+ }<br>
+- memcpy(q->data, tmp_data, size);<br>
++ tmp_data[i] = q->data[q->rptr++];<br>
+ }<br>
++ memcpy(q->data, tmp_data, size);<br>
++<br>
+ /* reset rptr/wptr/count */<br>
+ q->rptr = 0;<br>
+ q->wptr = size;<br>
+-- <br>
+2.7.4<br>
+<br>
diff --git a/meta/recipes-devtools/qemu/<a
href="http://qemu_2.11.1.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">q<wbr>emu_2.11.1.bb</a>
b/meta/recipes-devtools/qemu/<a href="http://qemu_2.11.1.bb"
rel="noreferrer" target="_blank" moz-do-not-send="true">q<wbr>emu_2.11.1.bb</a><br>
index f4b7d69..ab82c5f 100644<br>
--- a/meta/recipes-devtools/qemu/<a
href="http://qemu_2.11.1.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">q<wbr>emu_2.11.1.bb</a><br>
+++ b/meta/recipes-devtools/qemu/<a
href="http://qemu_2.11.1.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">q<wbr>emu_2.11.1.bb</a><br>
@@ -22,6 +22,7 @@ SRC_URI = "<a
href="http://wiki.qemu-project.org/download/$%7BBP%7D.tar.bz2"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://wiki.qemu-project.org/<wbr>download/${BP}.tar.bz2</a>
\<br>
<a class="moz-txt-link-freetext" href="file://linux-user-Fix">file://linux-user-Fix</a>-<wbr>webkitgtk-hangs-on-32-bit-x86-<wbr>target.patch
\<br>
<a class="moz-txt-link-freetext" href="file://memfd.patch">file://memfd.patch</a> \<br>
<a class="moz-txt-link-freetext" href="file://0001-arm-translate-a64">file://0001-arm-translate-a64</a>-<wbr>treat-DISAS_UPDATE-as-variant-<wbr>of-D.patch
\<br>
+ <a class="moz-txt-link-freetext" href="file://check-PS2Queue">file://check-PS2Queue</a>-<wbr>pointers-in-post_load-routine.<wbr>patch
\<br>
"<br>
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+\..*)\.tar"<br>
<span class="HOEnZb"><font color="#888888"> <br>
-- <br>
2.7.4<br>
<br>
-- <br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a
href="mailto:Openembedded-core@lists.openembedded.org"
moz-do-not-send="true">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a
href="http://lists.openembedded.org/mailman/listinfo/openembedded-core"
rel="noreferrer" target="_blank"
moz-do-not-send="true">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote>
</div>
<br>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>