]> git.proxmox.com Git - pve-qemu-kvm.git/blob - debian/patches/0004-exec-clamp-accesses-against-the-MemoryRegionSection.patch
Fix CVE-2015-8817 and CVE-2015-8818
[pve-qemu-kvm.git] / debian / patches / 0004-exec-clamp-accesses-against-the-MemoryRegionSection.patch
1 From 4b5d6bca704a8fba4d00e28ac7678639c1434a95 Mon Sep 17 00:00:00 2001
2 From: Paolo Bonzini <pbonzini@redhat.com>
3 Date: Wed, 17 Jun 2015 10:36:54 +0200
4 Subject: [PATCH 4/4] exec: clamp accesses against the MemoryRegionSection
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 Because the clamping was done against the MemoryRegion,
10 address_space_rw was effectively broken if a write spanned
11 multiple sections that are not linear in underlying memory
12 (with the memory not being under an IOMMU).
13
14 This is visible with the MIPS rc4030 IOMMU, which is implemented
15 as a series of alias memory regions that point to the actual RAM.
16
17 Tested-by: Hervé Poussineau <hpoussin@reactos.org>
18 Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
19 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
20 ---
21 exec.c | 2 +-
22 1 file changed, 1 insertion(+), 1 deletion(-)
23
24 diff --git a/exec.c b/exec.c
25 index 80c9d79..2d7b62f 100644
26 --- a/exec.c
27 +++ b/exec.c
28 @@ -354,7 +354,7 @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x
29 * the caller really has to do the clamping through memory_access_size.
30 */
31 if (memory_region_is_ram(mr)) {
32 - diff = int128_sub(mr->size, int128_make64(addr));
33 + diff = int128_sub(section->size, int128_make64(addr));
34 *plen = int128_get64(int128_min(diff, int128_make64(*plen)));
35 }
36 return section;
37 --
38 2.1.4
39