]> git.proxmox.com Git - pve-qemu-kvm.git/blob - debian/patches/0002-exec-do-not-clamp-accesses-to-MMIO-regions.patch
Fix CVE-2015-8817 and CVE-2015-8818
[pve-qemu-kvm.git] / debian / patches / 0002-exec-do-not-clamp-accesses-to-MMIO-regions.patch
1 From 83c9a2ae066a3dd968e774a96f90a239adc7f082 Mon Sep 17 00:00:00 2001
2 From: Paolo Bonzini <pbonzini@redhat.com>
3 Date: Wed, 17 Jun 2015 10:40:27 +0200
4 Subject: [PATCH 2/4] exec: do not clamp accesses to MMIO regions
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 It is common for MMIO registers to overlap, for example a 4 byte register
10 at 0xcf8 (totally random choice... :)) and a 1 byte register at 0xcf9.
11 If these registers are implemented via separate MemoryRegions, it is
12 wrong to clamp the accesses as the value written would be truncated.
13
14 Hence for these regions the effects of commit 23820db (exec: Respect
15 as_translate_internal length clamp, 2015-03-16, previously applied as
16 commit c3c1bb99) must be skipped.
17
18 Tested-by: Hervé Poussineau <hpoussin@reactos.org>
19 Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
20 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
21 ---
22 exec.c | 8 ++++++--
23 1 file changed, 6 insertions(+), 2 deletions(-)
24
25 diff --git a/exec.c b/exec.c
26 index 1c3d210..03c9995 100644
27 --- a/exec.c
28 +++ b/exec.c
29 @@ -330,6 +330,7 @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x
30 hwaddr *plen, bool resolve_subpage)
31 {
32 MemoryRegionSection *section;
33 + MemoryRegion *mr;
34 Int128 diff;
35
36 section = address_space_lookup_region(d, addr, resolve_subpage);
37 @@ -339,8 +340,11 @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x
38 /* Compute offset within MemoryRegion */
39 *xlat = addr + section->offset_within_region;
40
41 - diff = int128_sub(section->mr->size, int128_make64(addr));
42 - *plen = int128_get64(int128_min(diff, int128_make64(*plen)));
43 + mr = section->mr;
44 + if (memory_region_is_ram(mr)) {
45 + diff = int128_sub(mr->size, int128_make64(addr));
46 + *plen = int128_get64(int128_min(diff, int128_make64(*plen)));
47 + }
48 return section;
49 }
50
51 --
52 2.1.4
53