debian/patches/extra/CVE-2016-1922-i386-avoid-null-pointer-dereference.patch

   1 From 47568e18c6599962f711bc2ae3cc45fe6900130d Mon Sep 17 00:00:00 2001
   2 From: P J P <ppandit@redhat.com>
   3 Date: Fri, 18 Dec 2015 11:35:07 +0530
   4 Subject: [PATCH] i386: avoid null pointer dereference
   5
   6     Hello,
   7
   8 A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It
   9 occurs while doing I/O port write operations via hmp interface. In that,
  10 'current_cpu' remains null as it is not called from cpu_exec loop, which
  11 results in the said issue.
  12
  13 Below is a proposed (tested)patch to fix this issue; Does it look okay?
  14
  15 ===
  16 From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001
  17 From: Prasad J Pandit <pjp@fedoraproject.org>
  18 Date: Fri, 18 Dec 2015 11:16:07 +0530
  19 Subject: [PATCH] i386: avoid null pointer dereference
  20
  21 When I/O port write operation is called from hmp interface,
  22 'current_cpu' remains null, as it is not called from cpu_exec()
  23 loop. This leads to a null pointer dereference in vapic_write
  24 routine. Add check to avoid it.
  25
  26 Reported-by: Ling Liu <liuling-it@360.cn>
  27 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  28 Message-Id: <alpine.LFD.2.20.1512181129320.9805@wniryva>
  29 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  30 ---
  31  hw/i386/kvmvapic.c | 15 ++++++++++-----
  32  1 file changed, 10 insertions(+), 5 deletions(-)
  33
  34 diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
  35 index c6d34b2..f0922da 100644
  36 --- a/hw/i386/kvmvapic.c
  37 +++ b/hw/i386/kvmvapic.c
  38 @@ -634,13 +634,18 @@ static int vapic_prepare(VAPICROMState *s)
  39  static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
  40                          unsigned int size)
  41  {
  42 -    CPUState *cs = current_cpu;
  43 -    X86CPU *cpu = X86_CPU(cs);
  44 -    CPUX86State *env = &cpu->env;
  45 -    hwaddr rom_paddr;
  46      VAPICROMState *s = opaque;
  47 +    X86CPU *cpu;
  48 +    CPUX86State *env;
  49 +    hwaddr rom_paddr;
  50
  51 -    cpu_synchronize_state(cs);
  52 +    if (!current_cpu) {
  53 +        return;
  54 +    }
  55 +
  56 +    cpu_synchronize_state(current_cpu);
  57 +    cpu = X86_CPU(current_cpu);
  58 +    env = &cpu->env;
  59
  60      /*
  61       * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
  62 --
  63 2.1.4
  64