rpms/qemu-kvm
8
0
Fork 0
Code Issues Pull Requests Releases Activity

Enable building for ppc64le

Browse Source 
Don't remove slof.bin for ppc64le

usb: add config options for hub and hid devices for ppc

Remove pnv_chip_find_core calls from SPRD helpers

Remove pre-3.0 migration from spapr_compat_rhel7_6
This commit is contained in:
Eduard Abdullin 2026-07-21 11:02:20 +00:00 committed by root
commit e6c2ff83cd
2 changed files with 76 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
SOURCES/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch Normal file
View File

@ -0,0 +1,61 @@
From 085815fbd5c6b291865122639a8247b19c872adb Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 26 May 2026 11:49:57 -0400
Subject: [PATCH] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
(CVE-2026-48914)
RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
RH-MergeRequest: 561: virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)
RH-Jira: RHEL-184527
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
RH-Commit: [1/1] 083076b14c0d3b83095d2202e114d8af3052d038
Check that the iovec containing struct virtio_scsi_inhdr is large enough
before storing an error value there.
Feifan Qian <bea1e@proton.me> pointed out that this can be used to
corrupt heap memory when the descriptor uses an MMIO address and a
length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer.
virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond
the bounce buffer.
Fixes: CVE-2026-48914
Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests")
Reported-by: Feifan Qian <bea1e@proton.me>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20260526154957.1741622-1-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0)
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
hw/block/virtio-blk.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 9bab2716c1..a0678300b4 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -200,10 +200,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
/*
* The scsi inhdr is placed in the second-to-last input segment, just
- * before the regular inhdr.
+ * before the regular inhdr. VIRTIO implementations normally do not rely on
+ * the precise message framing, but legacy implementations did and so we do
+ * too for the legacy virtio-blk SCSI request type.
*
* Just put anything nonzero so that the ioctl fails in the guest.
*/
+ if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) {
+ status = VIRTIO_BLK_S_IOERR;
+ goto fail;
+ }
scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base;
virtio_stl_p(vdev, &scsi->errors, 255);
status = VIRTIO_BLK_S_UNSUPP;
--
2.52.0

23
SPECS/qemu-kvm.spec
View File

@ -151,7 +151,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \
Summary: QEMU is a machine emulator and virtualizer
Name: qemu-kvm
Version: 10.1.0
Release: 17%{?rcrel}%{?dist}%{?cc_suffix}.3.alma.1
Release: 17%{?rcrel}%{?dist}%{?cc_suffix}.4.alma.1
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
# Epoch 15 used for RHEL 8
# Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -359,14 +359,16 @@ Patch105: kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch
Patch106: kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch
# For RHEL-184951 - MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]
Patch107: kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch
# For RHEL-184527 - CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]
Patch108: kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch
# AlmaLinux Patch
Patch108: 0001-Bring-back-missing-line-in-target-ppc-cpu-models.patch
Patch109: 0001-usb-add-config-options-for-hub-and-hid-devices-for-p.patch
Patch110: 0001-Add-AlmaLinux-9-to-machine-class-options.patch
Patch111: osuosl-enable-ppc64.patch
Patch112: 0001-Remove-pnv_chip_find_core-calls-from-SPRD-helpers.patch
Patch113: 0002-Remove-pre-3.0-migration-from-spapr_compat_rhel7_6.patch
Patch109: 0001-Bring-back-missing-line-in-target-ppc-cpu-models.patch
Patch110: 0001-usb-add-config-options-for-hub-and-hid-devices-for-p.patch
Patch111: 0001-Add-AlmaLinux-9-to-machine-class-options.patch
Patch112: osuosl-enable-ppc64.patch
Patch113: 0001-Remove-pnv_chip_find_core-calls-from-SPRD-helpers.patch
Patch114: 0002-Remove-pre-3.0-migration-from-spapr_compat_rhel7_6.patch
# For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
@ -2094,13 +2096,18 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
%endif
%changelog
* Tue Jul 07 2026 Eduard Abdullin <eabdullin@almalinux.org> - 17:10.1.0-17.3.alma.1
* Tue Jul 21 2026 Eduard Abdullin <eabdullin@almalinux.org> - 17:10.1.0-17.4.alma.1
- Enable building for ppc64le
- Don't remove slof.bin for ppc64le
- usb: add config options for hub and hid devices for ppc
- Remove pnv_chip_find_core calls from SPRD helpers
- Remove pre-3.0 migration from spapr_compat_rhel7_6
* Mon Jun 22 2026 Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.4
- kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527]
- Resolves: RHEL-184527
(CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z])
* Wed Jun 17 2026 Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.3
- kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951]
- kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951]