qemu-kvm/kvm-target-s390x-arch_dump-Fix-memory-corruption-in-s390.patch
Miroslav Rezanina 382f65f59d * Fri Feb 17 2023 Miroslav Rezanina <mrezanin@redhat.com> - 7.2.0-9
- kvm-tests-qtest-netdev-test-stream-and-dgram-backends.patch [bz#2169232]
- kvm-net-stream-add-a-new-option-to-automatically-reconne.patch [bz#2169232]
- kvm-linux-headers-Update-to-v6.1.patch [bz#2158704]
- kvm-util-userfaultfd-Add-uffd_open.patch [bz#2158704]
- kvm-util-userfaultfd-Support-dev-userfaultfd.patch [bz#2158704]
- kvm-io-Add-support-for-MSG_PEEK-for-socket-channel.patch [bz#2169732]
- kvm-migration-check-magic-value-for-deciding-the-mapping.patch [bz#2169732]
- kvm-target-s390x-arch_dump-Fix-memory-corruption-in-s390.patch [bz#2168172]
- Resolves: bz#2169232
  (RFE: reconnect option for stream socket back-end)
- Resolves: bz#2158704
  (RFE: Prefer /dev/userfaultfd over userfaultfd(2) syscall)
- Resolves: bz#2169732
  (Multifd migration fails under a weak network/socket ordering race)
- Resolves: bz#2168172
  ([s390x] qemu-kvm coredumps when SE crashes)
2023-02-17 02:08:06 -05:00

51 lines
1.8 KiB
Diff

From b330bf0a2ad5af73d3c62997f7f0fa5b61f1796b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Feb 2023 14:48:37 +0100
Subject: [PATCH 8/8] target/s390x/arch_dump: Fix memory corruption in
s390x_write_elf64_notes()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
RH-Author: Thomas Huth <thuth@redhat.com>
RH-MergeRequest: 152: Fix memory corruption in s390x_write_elf64_notes()
RH-Bugzilla: 2168172
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
RH-Acked-by: David Hildenbrand <david@redhat.com>
RH-Acked-by: Cédric Le Goater <clg@redhat.com>
RH-Commit: [1/1] 37a2c997b2c8b7524e0b6299891bf3ea7c9a46d0 (thuth/qemu-kvm-cs9)
Bugzilla: https://bugzilla.redhat.com/2168172
Upstream-Status: Posted (and reviewed, but not merged yet)
"note_size" can be smaller than sizeof(note), so unconditionally calling
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
case notep has been allocated dynamically, thus let's use note_size as
length argument for memset() instead.
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
target/s390x/arch_dump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c
index a2329141e8..a7c44ba49d 100644
--- a/target/s390x/arch_dump.c
+++ b/target/s390x/arch_dump.c
@@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name,
notep = g_malloc(note_size);
}
- memset(notep, 0, sizeof(note));
+ memset(notep, 0, note_size);
/* Setup note header data */
notep->hdr.n_descsz = cpu_to_be32(content_size);
--
2.31.1