debian/patches/CVE-2015-8817-exec-Respect-as_tranlsate_internal-length-clamp.patch

   1 From 5f918b05bc7d2c6b9c3b60f01c8ee0446736f8de Mon Sep 17 00:00:00 2001
   2 From: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
   3 Date: Mon, 16 Mar 2015 22:35:54 -0700
   4 Subject: [PATCH 1/4] exec: Respect as_tranlsate_internal length clamp
   5
   6 address_space_translate_internal will clamp the *plen length argument
   7 based on the size of the memory region being queried. The iommu walker
   8 logic in addresss_space_translate was ignoring this by discarding the
   9 post fn call value of *plen. Fix by just always using *plen as the
  10 length argument throughout the fn, removing the len local variable.
  11
  12 This fixes a bootloader bug when a single elf section spans multiple
  13 QEMU memory regions.
  14
  15 Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
  16 Message-Id: <1426570554-15940-1-git-send-email-peter.crosthwaite@xilinx.com>
  17 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  18 ---
  19  exec.c | 6 ++----
  20  1 file changed, 2 insertions(+), 4 deletions(-)
  21
  22 diff --git a/exec.c b/exec.c
  23 index 46fe70e..1c3d210 100644
  24 --- a/exec.c
  25 +++ b/exec.c
  26 @@ -363,7 +363,6 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
  27      IOMMUTLBEntry iotlb;
  28      MemoryRegionSection *section;
  29      MemoryRegion *mr;
  30 -    hwaddr len = *plen;
  31
  32      for (;;) {
  33          section = address_space_translate_internal(as->dispatch, addr, &addr, plen, true);
  34 @@ -376,7 +375,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
  35          iotlb = mr->iommu_ops->translate(mr, addr, is_write);
  36          addr = ((iotlb.translated_addr & ~iotlb.addr_mask)
  37                  | (addr & iotlb.addr_mask));
  38 -        len = MIN(len, (addr | iotlb.addr_mask) - addr + 1);
  39 +        *plen = MIN(*plen, (addr | iotlb.addr_mask) - addr + 1);
  40          if (!(iotlb.perm & (1 << is_write))) {
  41              mr = &io_mem_unassigned;
  42              break;
  43 @@ -387,10 +386,9 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
  44
  45      if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
  46          hwaddr page = ((addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE) - addr;
  47 -        len = MIN(page, len);
  48 +        *plen = MIN(page, *plen);
  49      }
  50
  51 -    *plen = len;
  52      *xlat = addr;
  53      return mr;
  54  }
  55 --
  56 2.1.4
  57