debian/patches/CVE-2015-8666-acpi-fix-buffer-overrun-on-migration.patch

   1 From d9a3b33d2c9f996537b7f1d0246dee2d0120cefb Mon Sep 17 00:00:00 2001
   2 From: "Michael S. Tsirkin" <mst@redhat.com>
   3 Date: Thu, 19 Nov 2015 15:14:07 +0200
   4 Subject: [PATCH] acpi: fix buffer overrun on migration
   5
   6 ich calls acpi_gpe_init with length ICH9_PMIO_GPE0_LEN so
   7 ICH9_PMIO_GPE0_LEN/2 bytes are allocated, but then the full
   8 ICH9_PMIO_GPE0_LEN bytes are migrated.
   9
  10 As a quick work-around, allocate twice the memory.
  11 We'll probably want to tweak code to avoid
  12 migrating the extra ICH9_PMIO_GPE0_LEN/2 bytes,
  13 but that is a bit trickier to do without breaking
  14 migration compatibility.
  15
  16 Tested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
  17 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
  18 Cc: qemu-stable@nongnu.org
  19 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  20 ---
  21  hw/acpi/core.c | 8 ++++++--
  22  1 file changed, 6 insertions(+), 2 deletions(-)
  23
  24 diff --git a/hw/acpi/core.c b/hw/acpi/core.c
  25 index fe6215a..21e113d 100644
  26 --- a/hw/acpi/core.c
  27 +++ b/hw/acpi/core.c
  28 @@ -625,8 +625,12 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar)
  29  void acpi_gpe_init(ACPIREGS *ar, uint8_t len)
  30  {
  31      ar->gpe.len = len;
  32 -    ar->gpe.sts = g_malloc0(len / 2);
  33 -    ar->gpe.en = g_malloc0(len / 2);
  34 +    /* Only first len / 2 bytes are ever used,
  35 +     * but the caller in ich9.c migrates full len bytes.
  36 +     * TODO: fix ich9.c and drop the extra allocation.
  37 +     */
  38 +    ar->gpe.sts = g_malloc0(len);
  39 +    ar->gpe.en = g_malloc0(len);
  40  }
  41
  42  void acpi_gpe_reset(ACPIREGS *ar)
  43 --
  44 2.1.4
  45