Update version for 2.5.1.1 release

2016-05-09T16:55:58+00:00

Signed-off-by: Michael Roth

cadence_uart: bounds check write offset

2016-05-09T16:55:58+00:00

cadence_uart_init() initializes an I/O memory region of size 0x1000 bytes. However in uart_write(), the 'offset' parameter (offset within region) is divided by 4 and then used to index the array 'r' of size CADENCE_UART_R_MAX which is much smaller: (0x48/4). If 'offset>>=2' exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory write where the offset and the value are controlled by guest. This will corrupt QEMU memory, in most situations this causes the vm to crash. Fix by checking the offset against the array size. Cc: qemu-stable@nongnu.org Reported-by: 李强 Signed-off-by: Michael S. Tsirkin Reviewed-by: Alistair Francis Message-id: 20160418100735.GA517@redhat.com Signed-off-by: Peter Maydell (cherry picked from commit 5eb0b194e9b01ba0f3613e6ddc2cb9f63ce96ae5) Signed-off-by: Michael Roth

Revert "ehci: make idt processing more robust"

2016-05-09T03:37:18+00:00

This reverts commit 156a2e4dbffa85997636a7a39ef12da6f1b40254. Breaks FreeBSD. Signed-off-by: Gerd Hoffmann (cherry picked from commit a49923d2837d20510d645d3758f1ad87c32d0730) Signed-off-by: Michael Roth

ehci: apply limit to iTD/sidt descriptors

2016-05-09T03:37:09+00:00

Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a DoS by the guest (create a circular iTD queue and let qemu ehci emulation run in circles forever). Unfortunately this has two problems: First it misses the case of siTDs, and second it reportedly breaks FreeBSD. So lets go for a different approach: just count the number of iTDs and siTDs we have seen per frame and apply a limit. That should really catch all cases now. Reported-by: 杜少博 Signed-off-by: Gerd Hoffmann (cherry picked from commit 1ae3f2f178087711f9591350abad133525ba93f2) Signed-off-by: Michael Roth

vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).

2016-05-09T01:56:43+00:00

Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz Reported-by: P J P Signed-off-by: Gerd Hoffmann Signed-off-by: Michael Roth

vga: update vga register setup on vbe changes

2016-05-09T01:56:40+00:00

Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann Signed-off-by: Michael Roth

vga: factor out vga register setup

2016-05-09T01:56:38+00:00

When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann Signed-off-by: Michael Roth

vga: add vbe_enabled() helper

2016-05-09T01:56:34+00:00

Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann Signed-off-by: Michael Roth

vga: fix banked access bounds checking (CVE-2016-3710)

2016-05-09T01:56:30+00:00

vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang Signed-off-by: Gerd Hoffmann Signed-off-by: Michael Roth

Update version for 2.5.1 release

2016-03-29T20:47:56+00:00