797ce578a4
- kvm-Remove-7-qcow2-and-luks-iotests-that-are-taking-25-s.patch [bz#1683473] - kvm-spapr-fix-out-of-bounds-write-in-spapr_populate_drme.patch [bz#1674438] - kvm-qcow2-include-LUKS-payload-overhead-in-qemu-img-meas.patch [bz#1655065] - kvm-iotests-add-LUKS-payload-overhead-to-178-qemu-img-me.patch [bz#1655065] - kvm-vnc-detect-and-optimize-pageflips.patch [bz#1666206] - kvm-Load-kvm-module-during-boot.patch [bz#1676907 bz#1685995] - kvm-hostmem-file-reject-invalid-pmem-file-sizes.patch [bz#1669053] - kvm-iotests-Fix-test-200-on-s390x-without-virtio-pci.patch [bz#1687582] - kvm-block-file-posix-do-not-fail-on-unlock-bytes.patch [bz#1652572] - Resolves: bz#1652572 (QEMU core dumped if stop nfs service during migration) - Resolves: bz#1655065 ([rhel.8.0][fast train]'qemu-img measure' size does not match the real allocated size for luks-inside-qcow2 image) - Resolves: bz#1666206 (vnc server should detect page-flips and avoid sending fullscreen updates then.) - Resolves: bz#1669053 (Guest call trace when boot with nvdimm device backed by /dev/dax) - Resolves: bz#1674438 (RHEL8.0 - Guest reboot fails after memory hotplug multiple times (kvm)) - Resolves: bz#1676907 (/dev/kvm device exists but kernel module is not loaded on boot up causing VM start to fail in libvirt) - Resolves: bz#1683473 (Remove 7 qcow2 & luks iotests from rhel8 fast train build %check phase) - Resolves: bz#1685995 (/dev/kvm device exists but kernel module is not loaded on boot up causing VM start to fail in libvirt) - Resolves: bz#1687582 (QEMU IOTEST 200 fails with 'virtio-scsi-pci is not a valid device model name')
75 lines
2.8 KiB
Diff
75 lines
2.8 KiB
Diff
From 2744bd7eb7955e7ae995a48784760e48c33c1e73 Mon Sep 17 00:00:00 2001
|
|
From: David Gibson <dgibson@redhat.com>
|
|
Date: Wed, 27 Feb 2019 04:54:34 +0000
|
|
Subject: [PATCH 2/9] spapr: fix out of bounds write in spapr_populate_drmem_v2
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: David Gibson <dgibson@redhat.com>
|
|
Message-id: <20190227045434.23465-1-dgibson@redhat.com>
|
|
Patchwork-id: 84720
|
|
O-Subject: [RHELAV-8.1 qemu-kvm PATCH] spapr: fix out of bounds write in spapr_populate_drmem_v2
|
|
Bugzilla: 1674438
|
|
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
|
RH-Acked-by: Serhii Popovych <spopovyc@redhat.com>
|
|
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
|
From: Fabiano Rosas <farosas@linux.ibm.com>
|
|
|
|
buf_len is uint8_t which is not large enough to hold the result of:
|
|
|
|
nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);
|
|
|
|
for a nr_entries greater than 10.
|
|
|
|
This causes the allocated buffer 'int_buf' to be smaller than expected
|
|
and we eventually overwrite some of glibc's control structures (see
|
|
"chunk" in https://sourceware.org/glibc/wiki/MallocInternals)
|
|
|
|
The following error is seen while trying to free int_buf:
|
|
|
|
"free(): invalid next size (fast)"
|
|
|
|
Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property"
|
|
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
|
|
Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com>
|
|
Reviewed-by: Greg Kurz <groug@kaod.org>
|
|
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
|
|
(cherry picked from commit cc941111a5bc5f498185fa3824c3b6579c7d45ad)
|
|
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1674438
|
|
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=20382722
|
|
Branch: rhel8/master-3.1.0
|
|
|
|
Signed-off-by: David Gibson <dgibson@redhat.com>
|
|
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
---
|
|
hw/ppc/spapr.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
|
|
index bd2abb7..c1478bf 100644
|
|
--- a/hw/ppc/spapr.c
|
|
+++ b/hw/ppc/spapr.c
|
|
@@ -688,14 +688,14 @@ static int spapr_populate_drmem_v2(sPAPRMachineState *spapr, void *fdt,
|
|
int offset, MemoryDeviceInfoList *dimms)
|
|
{
|
|
MachineState *machine = MACHINE(spapr);
|
|
- uint8_t *int_buf, *cur_index, buf_len;
|
|
+ uint8_t *int_buf, *cur_index;
|
|
int ret;
|
|
uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
|
|
uint64_t addr, cur_addr, size;
|
|
uint32_t nr_boot_lmbs = (machine->device_memory->base / lmb_size);
|
|
uint64_t mem_end = machine->device_memory->base +
|
|
memory_region_size(&machine->device_memory->mr);
|
|
- uint32_t node, nr_entries = 0;
|
|
+ uint32_t node, buf_len, nr_entries = 0;
|
|
sPAPRDRConnector *drc;
|
|
DrconfCellQueue *elem, *next;
|
|
MemoryDeviceInfoList *info;
|
|
--
|
|
1.8.3.1
|
|
|