From 6d04e47f63cc35883f4680012ffe86da6f580e98 Mon Sep 17 00:00:00 2001 From: zhangxinhao Date: Fri, 30 Sep 2022 15:29:13 +0800 Subject: [PATCH] Backport upstream bugfix Signed-off-by: zhangxinhao (cherry picked from commit a2786109b9d5ffd86d5df523efeff80064e01501) --- ...act-address_space_set-from-dma_memor.patch | 116 ++++++++++++++++++ ...ps-clear-uninitialized-segment-space.patch | 74 +++++++++++ qemu.spec | 14 ++- ...-queue-state-in-the-vhost_dev_set_lo.patch | 39 ++++++ ...-improper-cleanup-in-vhost_net_start.patch | 44 +++++++ ...-vhost_dev-and-notifiers-for-cvq-onl.patch | 40 ++++++ 6 files changed, 326 insertions(+), 1 deletion(-) create mode 100644 exec-memory-Extract-address_space_set-from-dma_memor.patch create mode 100644 hw-elf_ops-clear-uninitialized-segment-space.patch create mode 100644 vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch create mode 100644 vhost-net-fix-improper-cleanup-in-vhost_net_start.patch create mode 100644 virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch diff --git a/exec-memory-Extract-address_space_set-from-dma_memor.patch b/exec-memory-Extract-address_space_set-from-dma_memor.patch new file mode 100644 index 0000000..e42d70b --- /dev/null +++ b/exec-memory-Extract-address_space_set-from-dma_memor.patch @@ -0,0 +1,116 @@ +From d9a1de34f34c853dc8596ba64b5d9c5d33c2f0cd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Sat, 15 Jan 2022 21:37:23 +0100 +Subject: [PATCH 1/5] exec/memory: Extract address_space_set() from + dma_memory_set() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +dma_memory_set() does a DMA barrier, set the address space with +a constant value. The constant value filling code is not specific +to DMA and can be used for AddressSpace. Extract it as a new +helper: address_space_set(). + +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Laurent Vivier +Reviewed-by: Stefano Garzarella +Reviewed-by: Richard Henderson +[lv: rebase] +Signed-off-by: Laurent Vivier +Reviewed-by: David Hildenbrand +Reviewed-by: Peter Xu +Message-Id: <20220115203725.3834712-2-laurent@vivier.eu> +Signed-off-by: zhangxinhao +--- + include/exec/memory.h | 16 ++++++++++++++++ + softmmu/dma-helpers.c | 15 +-------------- + softmmu/physmem.c | 19 +++++++++++++++++++ + 3 files changed, 36 insertions(+), 14 deletions(-) + +diff --git a/include/exec/memory.h b/include/exec/memory.h +index 3e84d62e40..afa6039a9f 100644 +--- a/include/exec/memory.h ++++ b/include/exec/memory.h +@@ -2966,6 +2966,22 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr, + } + } + ++/** ++ * address_space_set: Fill address space with a constant byte. ++ * ++ * Return a MemTxResult indicating whether the operation succeeded ++ * or failed (eg unassigned memory, device rejected the transaction, ++ * IOMMU fault). ++ * ++ * @as: #AddressSpace to be accessed ++ * @addr: address within that address space ++ * @c: constant byte to fill the memory ++ * @len: the number of bytes to fill with the constant byte ++ * @attrs: memory transaction attributes ++ */ ++MemTxResult address_space_set(AddressSpace *as, hwaddr addr, ++ uint8_t c, hwaddr len, MemTxAttrs attrs); ++ + #ifdef NEED_CPU_H + /* enum device_endian to MemOp. */ + static inline MemOp devend_memop(enum device_endian end) +diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c +index b0be156479..c2028b6585 100644 +--- a/softmmu/dma-helpers.c ++++ b/softmmu/dma-helpers.c +@@ -23,20 +23,7 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr, + { + dma_barrier(as, DMA_DIRECTION_FROM_DEVICE); + +-#define FILLBUF_SIZE 512 +- uint8_t fillbuf[FILLBUF_SIZE]; +- int l; +- MemTxResult error = MEMTX_OK; +- +- memset(fillbuf, c, FILLBUF_SIZE); +- while (len > 0) { +- l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE; +- error |= address_space_write(as, addr, attrs, fillbuf, l); +- len -= l; +- addr += l; +- } +- +- return error; ++ return address_space_set(as, addr, c, len, attrs); + } + + void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint, +diff --git a/softmmu/physmem.c b/softmmu/physmem.c +index be39a49ceb..0e709ae384 100644 +--- a/softmmu/physmem.c ++++ b/softmmu/physmem.c +@@ -2983,6 +2983,25 @@ MemTxResult address_space_rw(AddressSpace *as, hwaddr addr, MemTxAttrs attrs, + } + } + ++MemTxResult address_space_set(AddressSpace *as, hwaddr addr, ++ uint8_t c, hwaddr len, MemTxAttrs attrs) ++{ ++#define FILLBUF_SIZE 512 ++ uint8_t fillbuf[FILLBUF_SIZE]; ++ int l; ++ MemTxResult error = MEMTX_OK; ++ ++ memset(fillbuf, c, FILLBUF_SIZE); ++ while (len > 0) { ++ l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE; ++ error |= address_space_write(as, addr, attrs, fillbuf, l); ++ len -= l; ++ addr += l; ++ } ++ ++ return error; ++} ++ + void cpu_physical_memory_rw(hwaddr addr, void *buf, + hwaddr len, bool is_write) + { +-- +2.27.0 + diff --git a/hw-elf_ops-clear-uninitialized-segment-space.patch b/hw-elf_ops-clear-uninitialized-segment-space.patch new file mode 100644 index 0000000..f502e7d --- /dev/null +++ b/hw-elf_ops-clear-uninitialized-segment-space.patch @@ -0,0 +1,74 @@ +From 081ccc809448bec8e2bf144b2d49e64ed01b0e9f Mon Sep 17 00:00:00 2001 +From: Laurent Vivier +Date: Sat, 15 Jan 2022 21:37:24 +0100 +Subject: [PATCH 2/5] hw/elf_ops: clear uninitialized segment space +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When the mem_size of the segment is bigger than the file_size, +and if this space doesn't overlap another segment, it needs +to be cleared. + +This bug is very similar to the one we had for linux-user, +22d113b52f41 ("linux-user: Fix loading of BSS segments"), +where .bss section is encoded as an extension of the the data +one by setting the segment p_memsz > p_filesz. + +Signed-off-by: Laurent Vivier +[PMD: Use recently added address_space_set()] +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Stefano Garzarella +Reviewed-by: Richard Henderson +Message-Id: <20220115203725.3834712-3-laurent@vivier.eu> +Signed-off-by: zhangxinhao +--- + hw/core/loader.c | 4 ++++ + include/hw/elf_ops.h | 13 +++++++++++++ + 2 files changed, 17 insertions(+) + +diff --git a/hw/core/loader.c b/hw/core/loader.c +index 052a0fd719..19edb928e9 100644 +--- a/hw/core/loader.c ++++ b/hw/core/loader.c +@@ -1164,9 +1164,13 @@ static void rom_reset(void *unused) + if (rom->mr) { + void *host = memory_region_get_ram_ptr(rom->mr); + memcpy(host, rom->data, rom->datasize); ++ memset(host + rom->datasize, 0, rom->romsize - rom->datasize); + } else { + address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED, + rom->data, rom->datasize); ++ address_space_set(rom->as, rom->addr + rom->datasize, 0, ++ rom->romsize - rom->datasize, ++ MEMTXATTRS_UNSPECIFIED); + } + if (rom->isrom) { + /* rom needs to be written only once */ +diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h +index 995de8495c..7c3b1d0f6c 100644 +--- a/include/hw/elf_ops.h ++++ b/include/hw/elf_ops.h +@@ -555,6 +555,19 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd, + if (res != MEMTX_OK) { + goto fail; + } ++ /* ++ * We need to zero'ify the space that is not copied ++ * from file ++ */ ++ if (file_size < mem_size) { ++ res = address_space_set(as ? as : &address_space_memory, ++ addr + file_size, 0, ++ mem_size - file_size, ++ MEMTXATTRS_UNSPECIFIED); ++ if (res != MEMTX_OK) { ++ goto fail; ++ } ++ } + } + } + +-- +2.27.0 + diff --git a/qemu.spec b/qemu.spec index a01f935..ce46fca 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 6.2.0 -Release: 50 +Release: 51 Epoch: 10 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 @@ -305,6 +305,11 @@ Patch0292: scsi-lsi53c895a-fix-use-after-free-in-lsi_do_msgout-.patch Patch0293: scsi-lsi53c895a-really-fix-use-after-free-in-lsi_do_.patch Patch0294: hw-usb-hcd-xhci-Fix-unbounded-loop-in-xhci_ring_chai.patch Patch0295: net-tulip-Restrict-DMA-engine-to-memories.patch +Patch0296: exec-memory-Extract-address_space_set-from-dma_memor.patch +Patch0297: hw-elf_ops-clear-uninitialized-segment-space.patch +Patch0298: vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch +Patch0299: vhost-net-fix-improper-cleanup-in-vhost_net_start.patch +Patch0300: virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch BuildRequires: flex BuildRequires: gcc @@ -817,6 +822,13 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Fri Sep 30 2022 zhangxinhao - 10:6.2.0-51 +- exec/memory: Extract address_space_set() from dma_memory_set() +- hw/elf_ops: clear uninitialized segment space +- vhost: also check queue state in the vhost_dev_set_log +- vhost-net: fix improper cleanup in vhost_net_start +- virtio-net: setup vhost_dev and notifiers for cvq only + * Fri Sep 30 2022 zhangbo - 10:6.2.0-50 - net: tulip: Restrict DMA engine to memories (CVE-2020-14394) diff --git a/vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch b/vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch new file mode 100644 index 0000000..4299b26 --- /dev/null +++ b/vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch @@ -0,0 +1,39 @@ +From cb16f58f6db98113f9079b27e7e313c91060e6e4 Mon Sep 17 00:00:00 2001 +From: Ni Xun +Date: Thu, 9 Jun 2022 21:10:12 +0800 +Subject: [PATCH 3/5] vhost: also check queue state in the vhost_dev_set_log + error routine + +When check queue state in the vhost_dev_set_log routine, it miss the error +routine check, this patch also check queue state in error case. + +Fixes: 1e5a050f5798 ("check queue state in the vhost_dev_set_log routine") +Signed-off-by: Ni Xun +Reviewed-by: Zhigang Lu +Message-Id: +Reviewed-by: Michael S. Tsirkin +Acked-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Signed-off-by: zhangxinhao +--- + hw/virtio/vhost.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c +index 4c4072951c..3ac6cfde03 100644 +--- a/hw/virtio/vhost.c ++++ b/hw/virtio/vhost.c +@@ -900,6 +900,10 @@ static int vhost_dev_set_log(struct vhost_dev *dev, bool enable_log) + err_vq: + for (; i >= 0; --i) { + idx = dev->vhost_ops->vhost_get_vq_index(dev, dev->vq_index + i); ++ addr = virtio_queue_get_desc_addr(dev->vdev, idx); ++ if (!addr) { ++ continue; ++ } + vhost_virtqueue_set_addr(dev, dev->vqs + i, idx, + dev->log_enabled); + } +-- +2.27.0 + diff --git a/vhost-net-fix-improper-cleanup-in-vhost_net_start.patch b/vhost-net-fix-improper-cleanup-in-vhost_net_start.patch new file mode 100644 index 0000000..e2db14c --- /dev/null +++ b/vhost-net-fix-improper-cleanup-in-vhost_net_start.patch @@ -0,0 +1,44 @@ +From 4670dbaa57d7f034c2b5720d2a4c141a82f73025 Mon Sep 17 00:00:00 2001 +From: Si-Wei Liu +Date: Fri, 6 May 2022 19:28:15 -0700 +Subject: [PATCH 4/5] vhost-net: fix improper cleanup in vhost_net_start + +vhost_net_start() missed a corresponding stop_one() upon error from +vhost_set_vring_enable(). While at it, make the error handling for +err_start more robust. No real issue was found due to this though. + +Signed-off-by: Si-Wei Liu +Acked-by: Jason Wang +Message-Id: <1651890498-24478-5-git-send-email-si-wei.liu@oracle.com> +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Signed-off-by: zhangxinhao +--- + hw/net/vhost_net.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c +index e8a79db94d..1911ffd7ed 100644 +--- a/hw/net/vhost_net.c ++++ b/hw/net/vhost_net.c +@@ -439,6 +439,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs, + r = vhost_set_vring_enable(peer, peer->vring_enable); + + if (r < 0) { ++ vhost_net_stop_one(get_vhost_net(peer), dev); + goto err_start; + } + } +@@ -448,7 +449,8 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs, + + err_start: + while (--i >= 0) { +- peer = qemu_get_peer(ncs , i); ++ peer = qemu_get_peer(ncs, i < data_queue_pairs ? ++ i : n->max_queue_pairs); + vhost_net_stop_one(get_vhost_net(peer), dev); + } + e = k->set_guest_notifiers(qbus->parent, total_notifiers, false); +-- +2.27.0 + diff --git a/virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch b/virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch new file mode 100644 index 0000000..7a31bd4 --- /dev/null +++ b/virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch @@ -0,0 +1,40 @@ +From 89409c7268be2feb85d33af1f3571c0cb62298fb Mon Sep 17 00:00:00 2001 +From: Si-Wei Liu +Date: Fri, 6 May 2022 19:28:12 -0700 +Subject: [PATCH 5/5] virtio-net: setup vhost_dev and notifiers for cvq only + when feature is negotiated + +When the control virtqueue feature is absent or not negotiated, +vhost_net_start() still tries to set up vhost_dev and install +vhost notifiers for the control virtqueue, which results in +erroneous ioctl calls with incorrect queue index sending down +to driver. Do that only when needed. + +Fixes: 22288fe ("virtio-net: vhost control virtqueue support") +Signed-off-by: Si-Wei Liu +Acked-by: Jason Wang +Message-Id: <1651890498-24478-2-git-send-email-si-wei.liu@oracle.com> +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Signed-off-by: zhangxinhao +--- + hw/net/virtio-net.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c +index d33da9b7ef..918a7aba89 100644 +--- a/hw/net/virtio-net.c ++++ b/hw/net/virtio-net.c +@@ -243,7 +243,8 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t status) + VirtIODevice *vdev = VIRTIO_DEVICE(n); + NetClientState *nc = qemu_get_queue(n->nic); + int queue_pairs = n->multiqueue ? n->max_queue_pairs : 1; +- int cvq = n->max_ncs - n->max_queue_pairs; ++ int cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ? ++ n->max_ncs - n->max_queue_pairs : 0; + + if (!get_vhost_net(nc->peer)) { + return; +-- +2.27.0 + -- Gitee