Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-09-17 10:48:57 +0200
committerTakashi Iwai <tiwai@suse.de>2019-09-17 10:48:57 +0200
commitb68beb095285a9626f4322784482ff2b89a8b4c7 (patch)
treed4723072d8d9d5b088fb46f261ff8ca0c8201226
parent7ea9d0d0e5b19402372eca64673f62ba327bb037 (diff)
vhost: make sure log_num < in_num (bsc#1150112,CVE-2019-14835).
-rw-r--r--patches.suse/vhost-make-sure-log_num-in_num.patch58
-rw-r--r--series.conf1
2 files changed, 59 insertions, 0 deletions
diff --git a/patches.suse/vhost-make-sure-log_num-in_num.patch b/patches.suse/vhost-make-sure-log_num-in_num.patch
new file mode 100644
index 0000000000..a350c6c7c4
--- /dev/null
+++ b/patches.suse/vhost-make-sure-log_num-in_num.patch
@@ -0,0 +1,58 @@
+From 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 Mon Sep 17 00:00:00 2001
+From: yongduan <yongduan@tencent.com>
+Date: Wed, 11 Sep 2019 17:44:24 +0800
+Subject: [PATCH] vhost: make sure log_num < in_num
+Git-commit: 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4
+Patch-mainline: v5.3
+References: bsc#1150112,CVE-2019-14835
+
+The code assumes log_num < in_num everywhere, and that is true as long as
+in_num is incremented by descriptor iov count, and log_num by 1. However
+this breaks if there's a zero sized descriptor.
+
+As a result, if a malicious guest creates a vring desc with desc.len = 0,
+it may cause the host kernel to crash by overflowing the log array. This
+bug can be triggered during the VM migration.
+
+There's no need to log when desc.len = 0, so just don't increment log_num
+in this case.
+
+Fixes: 3a4d5c94e959 ("vhost_net: a kernel-level virtio server")
+Cc: stable@vger.kernel.org
+Reviewed-by: Lidong Chen <lidongchen@tencent.com>
+Signed-off-by: ruippan <ruippan@tencent.com>
+Signed-off-by: yongduan <yongduan@tencent.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vhost/vhost.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 34ea219936e3..acabf20b069e 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -2180,7 +2180,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
+ /* If this is an input descriptor, increment that count. */
+ if (access == VHOST_ACCESS_WO) {
+ *in_num += ret;
+- if (unlikely(log)) {
++ if (unlikely(log && ret)) {
+ log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
+ log[*log_num].len = vhost32_to_cpu(vq, desc.len);
+ ++*log_num;
+@@ -2321,7 +2321,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
+ /* If this is an input descriptor,
+ * increment that count. */
+ *in_num += ret;
+- if (unlikely(log)) {
++ if (unlikely(log && ret)) {
+ log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
+ log[*log_num].len = vhost32_to_cpu(vq, desc.len);
+ ++*log_num;
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index e63ae98eeb..081ca5ca20 100644
--- a/series.conf
+++ b/series.conf
@@ -24238,6 +24238,7 @@
patches.suse/powerpc-tm-Fix-restoring-FP-VMX-facility-incorrectly.patch
patches.suse/iommu-amd-flush-old-domains-in-kdump-kernel
patches.suse/iommu-amd-fix-race-in-increase_address_space
+ patches.suse/vhost-make-sure-log_num-in_num.patch
patches.suse/Btrfs-fix-assertion-failure-during-fsync-and-use-of-.patch
patches.suse/Revert-Bluetooth-validate-BLE-connection-interval-up.patch
patches.suse/net-ibmvnic-free-reset-work-of-removed-device-from-q.patch