From 56b61d84b285a32018af02c0d63a61487d340a2b Mon Sep 17 00:00:00 2001 From: "Huawei Technologies Co., Ltd" Date: Wed, 21 Oct 2020 11:35:50 +0530 Subject: [PATCH 1/3] net: remove an assert call in eth_get_gso_type fix CVE-2020-27617 eth_get_gso_type() routine returns segmentation offload type based on L3 protocol type. It calls g_assert_not_reached if L3 protocol is unknown, making the following return statement unreachable. Remove the g_assert call, it maybe triggered by a guest user. Reported-by: Gaoning Pan Signed-off-by: Prasad J Pandit Signed-off-by: Jason Wang cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1 Signed-off-by: Jiajie Li --- ...e-an-assert-call-in-eth_get_gso_type.patch | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 net-remove-an-assert-call-in-eth_get_gso_type.patch diff --git a/net-remove-an-assert-call-in-eth_get_gso_type.patch b/net-remove-an-assert-call-in-eth_get_gso_type.patch new file mode 100644 index 0000000..917695b --- /dev/null +++ b/net-remove-an-assert-call-in-eth_get_gso_type.patch @@ -0,0 +1,49 @@ +From 82ea222162a837397f6c21aa7a818824c3e61c0e Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Wed, 21 Oct 2020 11:35:50 +0530 +Subject: [PATCH] net: remove an assert call in eth_get_gso_type + +fix CVE-2020-27617 + +eth_get_gso_type() routine returns segmentation offload type based on +L3 protocol type. It calls g_assert_not_reached if L3 protocol is +unknown, making the following return statement unreachable. Remove the +g_assert call, it maybe triggered by a guest user. + +Reported-by: Gaoning Pan +Signed-off-by: Prasad J Pandit +Signed-off-by: Jason Wang + +cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1 +Signed-off-by: Jiajie Li +--- + net/eth.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/eth.c b/net/eth.c +index 0c1d413ee2..1e0821c5f8 100644 +--- a/net/eth.c ++++ b/net/eth.c +@@ -16,6 +16,7 @@ + */ + + #include "qemu/osdep.h" ++#include "qemu/log.h" + #include "net/eth.h" + #include "net/checksum.h" + #include "net/tap.h" +@@ -71,9 +72,8 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto) + return VIRTIO_NET_HDR_GSO_TCPV6 | ecn_state; + } + } +- +- /* Unsupported offload */ +- g_assert_not_reached(); ++ qemu_log_mask(LOG_UNIMP, "%s: probably not GSO frame, " ++ "unknown L3 protocol: 0x%04"PRIx16"\n", __func__, l3_proto); + + return VIRTIO_NET_HDR_GSO_NONE | ecn_state; + } +-- +2.27.0 + -- Gitee From a5d4f4616b5540c9ef9e5868ac37f1f6dc61e725 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Mon, 7 Dec 2020 11:26:54 +0800 Subject: [PATCH 2/3] spec: Update patch and changelog with !41 net: remove an assert call in eth_get_gso_type Signed-off-by: Alex Chen --- qemu.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qemu.spec b/qemu.spec index 2cc2ec7..8bc5881 100644 --- a/qemu.spec +++ b/qemu.spec @@ -223,6 +223,7 @@ Patch0210: target-arm-Update-the-ID-registers-of-Kunpeng-920.patch Patch0211: target-arm-only-set-ID_PFR1_EL1.GIC-for-AArch32-gues.patch Patch0212: target-arm-clear-EL2-and-EL3-only-when-kvm-is-not-en.patch Patch0213: ati-check-x-y-display-parameter-values.patch +Patch0214: net-remove-an-assert-call-in-eth_get_gso_type.patch BuildRequires: flex BuildRequires: bison @@ -568,6 +569,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Wed Oct 21 2020 Huawei Technologies Co., Ltd +- net: remove an assert call in eth_get_gso_type + * Wed Nov 18 2020 Huawei Technologies Co., Ltd - ati: check x y display parameter values -- Gitee From a33eebb1feeb4432d154c86a5a675fe83982ec89 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Mon, 7 Dec 2020 11:26:56 +0800 Subject: [PATCH 3/3] spec: Update release version with !41 increase release verison by one Signed-off-by: Euler Robot --- qemu.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index 8bc5881..b983dd0 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 25 +Release: 26 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY -- Gitee