Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 29 7月, 2016 1 次提交
  3. 27 7月, 2016 1 次提交
    • S
      virtio: error out if guest exceeds virtqueue size · afd9096e
      由 Stefan Hajnoczi 提交于 
      A broken or malicious guest can submit more requests than the virtqueue
size permits, causing unbounded memory allocation in QEMU.

The guest can submit requests without bothering to wait for completion
and is therefore not bound by virtqueue size.  This requires reusing
vring descriptors in more than one request, which is not allowed by the
VIRTIO 1.0 specification.

In "3.2.1 Supplying Buffers to The Device", the VIRTIO 1.0 specification
says:

  1. The driver places the buffer into free descriptor(s) in the
     descriptor table, chaining as necessary

and

  Note that the above code does not take precautions against the
  available ring buffer wrapping around: this is not possible since the
  ring buffer is the same size as the descriptor table, so step (1) will
  prevent such a condition.

This implies that placing more buffers into the virtqueue than the
descriptor table size is not allowed.

QEMU is missing the check to prevent this case.  Processing a request
allocates a VirtQueueElement leading to unbounded memory allocation
controlled by the guest.

Exit with an error if the guest provides more requests than the
virtqueue size permits.  This bounds memory allocation and makes the
buggy guest visible to the user.

This patch fixes CVE-2016-5403 and was reported by Zhenhao Hong from 360
Marvel Team, China.
Reported-by: NZhenhao Hong <hongzhenhao@360.cn>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      afd9096e
  5. 22 7月, 2016 3 次提交
  7. 04 7月, 2016 1 次提交
    • M
      virtio: set low features early on load · 62cee1a2
      由 Michael S. Tsirkin 提交于 
      virtio migrates the low 32 feature bits twice, the first copy is there
for compatibility but ever since
019a3edb: ("virtio: make features 64bit
wide") it's ignored on load. This is wrong since virtio_net_load tests
self announcement and guest offloads before the second copy including
high feature bits is loaded.  This means that self announcement, control
vq and guest offloads are all broken after migration.

Fix it up by loading low feature bits: somewhat ugly since high and low
bits become out of sync temporarily, but seems unavoidable for
compatibility.  The right thing to do for new features is probably to
test the host features, anyway.

Fixes: 019a3edb
    ("virtio: make features 64bit wide")
Cc: qemu-stable@nongnu.org
Reported-by: NRobin Geuze <robing@transip.nl>
Tested-by: NRobin Geuze <robing@transip.nl>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
      62cee1a2
  9. 07 6月, 2016 1 次提交
  11. 22 4月, 2016 2 次提交
  13. 08 4月, 2016 3 次提交
  15. 23 3月, 2016 2 次提交
    • P
      hw: explicitly include qemu-common.h and cpu.h · 4771d756
      由 Paolo Bonzini 提交于 
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      4771d756
    • M
      include/qemu/osdep.h: Don't include qapi/error.h · da34e65c
      由 Markus Armbruster 提交于 
      Commit 57cb38b3 included qapi/error.h into qemu/osdep.h to get the
Error typedef.  Since then, we've moved to include qemu/osdep.h
everywhere.  Its file comment explains: "To avoid getting into
possible circular include dependencies, this file should not include
any other QEMU headers, with the exceptions of config-host.h,
compiler.h, os-posix.h and os-win32.h, all of which are doing a
similar job to this file and are under similar constraints."
qapi/error.h doesn't do a similar job, and it doesn't adhere to
similar constraints: it includes qapi-types.h.  That's in excess of
100KiB of crap most .c files don't actually need.

Add the typedef to qemu/typedefs.h, and include that instead of
qapi/error.h.  Include qapi/error.h in .c files that need it and don't
get it now.  Include qapi-types.h in qom/object.h for uint16List.

Update scripts/clean-includes accordingly.  Update it further to match
reality: replace config.h by config-target.h, add sysemu/os-posix.h,
sysemu/os-win32.h.  Update the list of includes in the qemu/osdep.h
comment quoted above similarly.

This reduces the number of objects depending on qapi/error.h from "all
of them" to less than a third.  Unfortunately, the number depending on
qapi-types.h shrinks only a little.  More work is needed for that one.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
[Fix compilation without the spice devel packages. - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      da34e65c
  17. 25 2月, 2016 2 次提交
  19. 18 2月, 2016 1 次提交
  21. 07 2月, 2016 8 次提交
  23. 05 2月, 2016 1 次提交
  25. 29 1月, 2016 1 次提交
  27. 10 1月, 2016 2 次提交
  29. 12 11月, 2015 1 次提交
    • J
      virtio-pci: fix 1.0 virtqueue migration · a6df8adf
      由 Jason Wang 提交于 
      We don't migrate the followings fields for virtio-pci:

uint32_t dfselect;
uint32_t gfselect;
uint32_t guest_features[2];
struct {
    uint16_t num;
    bool enabled;
    uint32_t desc[2];
    uint32_t avail[2];
    uint32_t used[2];
} vqs[VIRTIO_QUEUE_MAX];

This will confuse driver if migrating during initialization. Solves
this issue by:

- introduce transport specific callbacks to load and store extra
  virtqueue states.
- add a new subsection for virtio to migrate transport specific modern
  device state.
- implement pci specific callbacks.
- add a new property for virtio-pci for whether or not to migrate
  extra state.
- compat the migration for 2.4 and elder machine types

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com>
      a6df8adf
  31. 29 10月, 2015 3 次提交
  33. 01 10月, 2015 2 次提交
  35. 24 9月, 2015 2 次提交
  37. 10 9月, 2015 1 次提交
  39. 05 8月, 2015 1 次提交
  41. 12 6月, 2015 1 次提交
    • J
      migration: Use normal VMStateDescriptions for Subsections · 5cd8cada
      由 Juan Quintela 提交于 
      We create optional sections with this patch.  But we already have
optional subsections.  Instead of having two mechanism that do the
same, we can just generalize it.

For subsections we just change:

- Add a needed function to VMStateDescription
- Remove VMStateSubsection (after removal of the needed function
  it is just a VMStateDescription)
- Adjust the whole tree, moving the needed function to the corresponding
  VMStateDescription
Signed-off-by: NJuan Quintela <quintela@redhat.com>
      5cd8cada