File 0216-pvrdma-Ensure-correct-input-on-ring.patch of Package qemu.28156

Overview Repositories Revisions Requests Users Attributes Meta

File 0216-pvrdma-Ensure-correct-input-on-ring.patch of Package qemu.28156

From: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Date: Wed, 30 Jun 2021 14:46:34 +0300
Subject: pvrdma: Ensure correct input on ring init (CVE-2021-3607)

Git-commit: 32e5703cfea07c91e6e84bcb0313f633bb146534
References: CVE-2021-3607 bsc#1187539

Check the guest passed a non zero page count
for pvrdma device ring buffers.

Fixes: CVE-2021-3607
Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com>
Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com>
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Message-Id: <20210630114634.2168872-1-marcel@redhat.com>
Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
[JRZ: changed patch to use pr_err]
Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>
---
 hw/rdma/vmw/pvrdma_main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c
index c9d9631769416c6be740d44c9510..d7fc5c2a56439234dfeb23ec28f6 100644
--- a/hw/rdma/vmw/pvrdma_main.c
+++ b/hw/rdma/vmw/pvrdma_main.c
@@ -71,6 +71,11 @@ static int init_dev_ring(PvrdmaRing *ring, struct pvrdma_ring **ring_state,
     pr_dbg("Initializing device ring %s\n", name);
     pr_dbg("pdir_dma=0x%llx\n", (long long unsigned int)dir_addr);
     pr_dbg("num_pages=%d\n", num_pages);
+    if (!num_pages) {
+        pr_err("Ring pages count must be strictly positive\n");
+        return -EINVAL;
+    }
+
     dir = rdma_pci_dma_map(pci_dev, dir_addr, TARGET_PAGE_SIZE);
     if (!dir) {
         pr_err("Failed to map to page directory\n");

Places

File 0216-pvrdma-Ensure-correct-input-on-ring.patch of Package qemu.28156

Places