]> git.proxmox.com Git - pve-qemu-kvm.git/blob - debian/patches/0002-rng-move-request-queue-from-RngEgd-to-RngBackend.patch
Fix CVE-2016-2841, CVE-2016-2857, CVE-2016-2858
[pve-qemu-kvm.git] / debian / patches / 0002-rng-move-request-queue-from-RngEgd-to-RngBackend.patch
1 From 8cd5c28840888a32dab08ef1387864723c092a1d Mon Sep 17 00:00:00 2001
2 From: Ladi Prosek <lprosek@redhat.com>
3 Date: Thu, 3 Mar 2016 09:37:16 +0100
4 Subject: [PATCH 2/5] rng: move request queue from RngEgd to RngBackend
5
6 The 'requests' field now lives in the RngBackend parent class.
7 There are no functional changes in this commit.
8
9 Signed-off-by: Ladi Prosek <lprosek@redhat.com>
10 Reviewed-by: Amit Shah <amit.shah@redhat.com>
11 Message-Id: <1456994238-9585-3-git-send-email-lprosek@redhat.com>
12 Signed-off-by: Amit Shah <amit.shah@redhat.com>
13 ---
14 backends/rng-egd.c | 28 +++++++++-------------------
15 include/sysemu/rng.h | 11 +++++++++++
16 2 files changed, 20 insertions(+), 19 deletions(-)
17
18 diff --git a/backends/rng-egd.c b/backends/rng-egd.c
19 index 3c6362e..19eee70 100644
20 --- a/backends/rng-egd.c
21 +++ b/backends/rng-egd.c
22 @@ -24,19 +24,8 @@ typedef struct RngEgd
23
24 CharDriverState *chr;
25 char *chr_name;
26 -
27 - GSList *requests;
28 } RngEgd;
29
30 -typedef struct RngRequest
31 -{
32 - EntropyReceiveFunc *receive_entropy;
33 - uint8_t *data;
34 - void *opaque;
35 - size_t offset;
36 - size_t size;
37 -} RngRequest;
38 -
39 static void rng_egd_request_entropy(RngBackend *b, size_t size,
40 EntropyReceiveFunc *receive_entropy,
41 void *opaque)
42 @@ -65,7 +54,7 @@ static void rng_egd_request_entropy(RngBackend *b, size_t size,
43 size -= len;
44 }
45
46 - s->requests = g_slist_append(s->requests, req);
47 + s->parent.requests = g_slist_append(s->parent.requests, req);
48 }
49
50 static void rng_egd_free_request(RngRequest *req)
51 @@ -80,7 +69,7 @@ static int rng_egd_chr_can_read(void *opaque)
52 GSList *i;
53 int size = 0;
54
55 - for (i = s->requests; i; i = i->next) {
56 + for (i = s->parent.requests; i; i = i->next) {
57 RngRequest *req = i->data;
58 size += req->size - req->offset;
59 }
60 @@ -93,8 +82,8 @@ static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
61 RngEgd *s = RNG_EGD(opaque);
62 size_t buf_offset = 0;
63
64 - while (size > 0 && s->requests) {
65 - RngRequest *req = s->requests->data;
66 + while (size > 0 && s->parent.requests) {
67 + RngRequest *req = s->parent.requests->data;
68 int len = MIN(size, req->size - req->offset);
69
70 memcpy(req->data + req->offset, buf + buf_offset, len);
71 @@ -103,7 +92,8 @@ static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
72 size -= len;
73
74 if (req->offset == req->size) {
75 - s->requests = g_slist_remove_link(s->requests, s->requests);
76 + s->parent.requests = g_slist_remove_link(s->parent.requests,
77 + s->parent.requests);
78
79 req->receive_entropy(req->opaque, req->data, req->size);
80
81 @@ -116,12 +106,12 @@ static void rng_egd_free_requests(RngEgd *s)
82 {
83 GSList *i;
84
85 - for (i = s->requests; i; i = i->next) {
86 + for (i = s->parent.requests; i; i = i->next) {
87 rng_egd_free_request(i->data);
88 }
89
90 - g_slist_free(s->requests);
91 - s->requests = NULL;
92 + g_slist_free(s->parent.requests);
93 + s->parent.requests = NULL;
94 }
95
96 static void rng_egd_opened(RngBackend *b, Error **errp)
97 diff --git a/include/sysemu/rng.h b/include/sysemu/rng.h
98 index c7da17d..084164c 100644
99 --- a/include/sysemu/rng.h
100 +++ b/include/sysemu/rng.h
101 @@ -25,6 +25,7 @@
102 #define RNG_BACKEND_CLASS(klass) \
103 OBJECT_CLASS_CHECK(RngBackendClass, (klass), TYPE_RNG_BACKEND)
104
105 +typedef struct RngRequest RngRequest;
106 typedef struct RngBackendClass RngBackendClass;
107 typedef struct RngBackend RngBackend;
108
109 @@ -32,6 +33,15 @@ typedef void (EntropyReceiveFunc)(void *opaque,
110 const void *data,
111 size_t size);
112
113 +struct RngRequest
114 +{
115 + EntropyReceiveFunc *receive_entropy;
116 + uint8_t *data;
117 + void *opaque;
118 + size_t offset;
119 + size_t size;
120 +};
121 +
122 struct RngBackendClass
123 {
124 ObjectClass parent_class;
125 @@ -48,6 +58,7 @@ struct RngBackend
126
127 /*< protected >*/
128 bool opened;
129 + GSList *requests;
130 };
131
132 /**
133 --
134 2.1.4
135