From 2e18a07e59d6a1062794e4e6e5e281c41052172d Mon Sep 17 00:00:00 2001 From: Michael Young Date: Oct 09 2015 19:53:10 +0000 Subject: Qemu: net: virtio-net possible remote DoS [CVE-2015-7295] (#1264392) --- diff --git a/qemu.git-0cf33fb6b49a19de32859e2cdc6021334f448fb3.patch b/qemu.git-0cf33fb6b49a19de32859e2cdc6021334f448fb3.patch new file mode 100644 index 0000000..da9c851 --- /dev/null +++ b/qemu.git-0cf33fb6b49a19de32859e2cdc6021334f448fb3.patch @@ -0,0 +1,45 @@ +From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:30 +0800 +Subject: [PATCH] virtio-net: correctly drop truncated packets + +When packet is truncated during receiving, we drop the packets but +neither discard the descriptor nor add and signal used +descriptor. This will lead several issues: + +- sg mappings are leaked +- rx will be stalled if a lots of packets were truncated + +In order to be consistent with vhost, fix by discarding the descriptor +in this case. + +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +--- + hw/net/virtio-net.c | 8 +------- + 1 files changed, 1 insertions(+), 7 deletions(-) + +diff --git a/tools/qemu-xen/hw/net/virtio-net.c b/tools/qemu-xen/hw/net/virtio-net.c +index d388c55..a877614 100644 +--- a/tools/qemu-xen/hw/net/virtio-net.c ++++ b/tools/qemu-xen/hw/net/virtio-net.c +@@ -1094,13 +1094,7 @@ static ssize_t virtio_net_receive(NetClientState *nc, const uint8_t *buf, size_t + * must have consumed the complete packet. + * Otherwise, drop it. */ + if (!n->mergeable_rx_bufs && offset < size) { +-#if 0 +- error_report("virtio-net truncated non-mergeable packet: " +- "i %zd mergeable %d offset %zd, size %zd, " +- "guest hdr len %zd, host hdr len %zd", +- i, n->mergeable_rx_bufs, +- offset, size, n->guest_hdr_len, n->host_hdr_len); +-#endif ++ virtqueue_discard(q->rx_vq, &elem, total); + return size; + } + +-- +1.7.0.4 + diff --git a/qemu.git-29b9f5efd78ae0f9cc02dd169b6e80d2c404bade.patch b/qemu.git-29b9f5efd78ae0f9cc02dd169b6e80d2c404bade.patch new file mode 100644 index 0000000..c1ba8dd --- /dev/null +++ b/qemu.git-29b9f5efd78ae0f9cc02dd169b6e80d2c404bade.patch @@ -0,0 +1,52 @@ +From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:29 +0800 +Subject: [PATCH] virtio: introduce virtqueue_discard() + +This patch introduces virtqueue_discard() to discard a descriptor and +unmap the sgs. This will be used by the patch that will discard +descriptor when packet is truncated. + +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +--- + hw/virtio/virtio.c | 7 +++++++ + include/hw/gvirtio/virtio.h | 2 ++ + 2 files changed, 9 insertions(+), 0 deletions(-) + +diff --git a/tools/qemu-xen/hw/virtio/virtio.c b/tools/qemu-xen/hw/virtio/virtio.c +index 6f2b96c..d0bc72e 100644 +--- a/tools/qemu-xen/hw/virtio/virtio.c ++++ b/tools/qemu-xen/hw/virtio/virtio.c +@@ -267,6 +267,13 @@ static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, + 0, elem->out_sg[i].iov_len); + } + ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) ++{ ++ vq->last_avail_idx--; ++ virtqueue_unmap_sg(vq, elem, len); ++} ++ + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx) + { +diff --git a/tools/qemu-xen/include/hw/virtio/virtio.h b/tools/qemu-xen/include/hw/virtio/virtio.h +index 6201ee8..9d09115 100644 +--- a/tools/qemu-xen/include/hw/virtio/virtio.h ++++ b/tools/qemu-xen/include/hw/virtio/virtio.h +@@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev, int n); + void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len); + void virtqueue_flush(VirtQueue *vq, unsigned int count); ++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len); + void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx); + +-- +1.7.0.4 + diff --git a/qemu.git-ce317461573bac12b10d67699b4ddf1f97cf066c.patch b/qemu.git-ce317461573bac12b10d67699b4ddf1f97cf066c.patch new file mode 100644 index 0000000..fe9f142 --- /dev/null +++ b/qemu.git-ce317461573bac12b10d67699b4ddf1f97cf066c.patch @@ -0,0 +1,56 @@ +From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 25 Sep 2015 13:21:28 +0800 +Subject: [PATCH] virtio: introduce virtqueue_unmap_sg() + +Factor out sg unmapping logic. This will be reused by the patch that +can discard descriptor. + +Cc: Michael S. Tsirkin +Cc: Andrew James +Signed-off-by: Jason Wang +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +--- + hw/virtio/virtio.c | 14 ++++++++++---- + 1 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/tools/qemu-xen/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 7504f8b..6f2b96c 100644 +--- a/tools/qemu-xen/hw/virtio/virtio.c ++++ b/tools/qemu-xen/hw/virtio/virtio.c +@@ -244,14 +244,12 @@ int virtio_queue_empty(VirtQueue *vq) + return vring_avail_idx(vq) == vq->last_avail_idx; + } + +-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, +- unsigned int len, unsigned int idx) ++static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len) + { + unsigned int offset; + int i; + +- trace_virtqueue_fill(vq, elem, len, idx); +- + offset = 0; + for (i = 0; i < elem->in_num; i++) { + size_t size = MIN(len - offset, elem->in_sg[i].iov_len); +@@ -267,6 +265,14 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + cpu_physical_memory_unmap(elem->out_sg[i].iov_base, + elem->out_sg[i].iov_len, + 0, elem->out_sg[i].iov_len); ++} ++ ++void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, ++ unsigned int len, unsigned int idx) ++{ ++ trace_virtqueue_fill(vq, elem, len, idx); ++ ++ virtqueue_unmap_sg(vq, elem, len); + + idx = (idx + vring_used_idx(vq)) % vq->vring.num; + +-- +1.7.0.4 + diff --git a/xen.spec b/xen.spec index 7adabac..7f67c39 100644 --- a/xen.spec +++ b/xen.spec @@ -51,7 +51,7 @@ Summary: Xen is a virtual machine monitor Name: xen Version: 4.5.1 -Release: 11%{?dist} +Release: 12%{?dist} Group: Development/Libraries License: GPLv2+ and LGPLv2+ and BSD URL: http://xen.org/ @@ -115,6 +115,9 @@ Patch46: qemu.trad.CVE-2015-5279.patch Patch47: qemu.trad.CVE-2015-5278.patch Patch48: qemu.git-7882080388be5088e72c425b02223c02e6cb4295.patch Patch49: qemu.git-d9033e1d3aa666c5071580617a57bd853c5d794a.patch +Patch50: qemu.git-ce317461573bac12b10d67699b4ddf1f97cf066c.patch +Patch51: qemu.git-29b9f5efd78ae0f9cc02dd169b6e80d2c404bade.patch +Patch52: qemu.git-0cf33fb6b49a19de32859e2cdc6021334f448fb3.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: transfig libidn-devel zlib-devel texi2html SDL-devel curl-devel @@ -331,6 +334,9 @@ manage Xen virtual machines. %patch47 -p1 %patch48 -p1 %patch49 -p1 +%patch50 -p1 +%patch51 -p1 +%patch52 -p1 # stubdom sources cp -v %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} stubdom @@ -854,6 +860,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Oct 08 2015 Michael Young - 4.5.1-12 +- Qemu: net: virtio-net possible remote DoS [CVE-2015-7295] (#1264392) + * Tue Oct 06 2015 Michael Young - 4.5.1-11 - create a symbolic link so libvirt VMs from xen 4.0 to 4.4 can still find qemu-dm (#1268176), (#1248843)