head 1.3; access; symbols pkgsrc-2020Q2:1.2.0.30 pkgsrc-2020Q2-base:1.2 pkgsrc-2020Q1:1.2.0.10 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.32 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.2.0.28 pkgsrc-2019Q3-base:1.2 pkgsrc-2019Q2:1.2.0.26 pkgsrc-2019Q2-base:1.2 pkgsrc-2019Q1:1.2.0.24 pkgsrc-2019Q1-base:1.2 pkgsrc-2018Q4:1.2.0.22 pkgsrc-2018Q4-base:1.2 pkgsrc-2018Q3:1.2.0.20 pkgsrc-2018Q3-base:1.2 pkgsrc-2018Q2:1.2.0.18 pkgsrc-2018Q2-base:1.2 pkgsrc-2018Q1:1.2.0.16 pkgsrc-2018Q1-base:1.2 pkgsrc-2017Q4:1.2.0.14 pkgsrc-2017Q4-base:1.2 pkgsrc-2017Q3:1.2.0.12 pkgsrc-2017Q3-base:1.2 pkgsrc-2017Q2:1.2.0.8 pkgsrc-2017Q2-base:1.2 pkgsrc-2017Q1:1.2.0.6 pkgsrc-2017Q1-base:1.2 pkgsrc-2016Q4:1.2.0.4 pkgsrc-2016Q4-base:1.2 pkgsrc-2016Q3:1.2.0.2 pkgsrc-2016Q3-base:1.2; locks; strict; comment @# @; 1.3 date 2020.08.19.10.39.25; author bouyer; state dead; branches; next 1.2; commitid DGAMglRf0Jde6FkC; 1.2 date 2016.09.21.17.03.38; author bouyer; state Exp; branches; next 1.1; commitid DpaVr9YcAfk37bnz; 1.1 date 2016.09.11.11.38.10; author spz; state Exp; branches; next ; commitid 5DHWDQVPHRGwERlz; desc @@ 1.3 log @Remove xenkernel and xentools packages older than 4.11. They're not maintained anymore upstream, and don't build on supported NetBSD releases. @ text @patches for XSA-184 from upstream: From 17d8c4e47dfb41cb6778520ff2eab7a11fe12dfd Mon Sep 17 00:00:00 2001 From: P J P Date: Tue, 26 Jul 2016 15:31:59 +0100 Subject: [PATCH] virtio: error out if guest exceeds virtqueue size A broken or malicious guest can submit more requests than the virtqueue size permits. The guest can submit requests without bothering to wait for completion and is therefore not bound by virtqueue size. This requires reusing vring descriptors in more than one request, which is incorrect but possible. Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation controlled by the guest. Exit with an error if the guest provides more requests than the virtqueue size permits. This bounds memory allocation and makes the buggy guest visible to the user. Reported-by: Zhenhao Hong Signed-off-by: Stefan Hajnoczi --- hw/virtio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/virtio.c b/hw/virtio.c index c26feff..42897bf 100644 --- qemu-xen-traditional/hw/virtio.c.orig 2016-01-04 15:36:03.000000000 +0000 +++ qemu-xen-traditional/hw/virtio.c 2016-09-11 11:01:37.000000000 +0000 @@@@ -421,6 +421,11 @@@@ int virtqueue_pop(VirtQueue *vq, VirtQue /* When we start there are none of either input nor output. */ elem->out_num = elem->in_num = 0; + if (vq->inuse >= vq->vring.num) { + fprintf(stderr, "Virtqueue size exceeded"); + exit(1); + } + i = head = virtqueue_get_head(vq, vq->last_avail_idx++); do { struct iovec *sg; @ 1.2 log @Update xenkernel45 and xentools45 to 4.5.5. Changes since 4.5.3: mostly bugfixes, including fixes for security issues XSA-172, XSA-173, XSA-175, XSA-176, XSA-178, XSA-179, XSA-180, XSA-181, XSA-182, XSA-183, XSA-184, XSA-185, XSA-186 and XSA-187. All but XSA-175 were already fixed in pkgsrc. Complete list of changes and links to the XSA advisories: https://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-455.html @ text @@ 1.1 log @add the patch for XSA-184 @ text @a43 40 From e469db25d6b2e5c71cd15451889226641c53a5cd Mon Sep 17 00:00:00 2001 From: P J P Date: Mon, 25 Jul 2016 17:37:18 +0530 Subject: [PATCH] virtio: error out if guest exceeds virtqueue size A broken or malicious guest can submit more requests than the virtqueue size permits. The guest can submit requests without bothering to wait for completion and is therefore not bound by virtqueue size. This requires reusing vring descriptors in more than one request, which is incorrect but possible. Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation controlled by the guest. Exit with an error if the guest provides more requests than the virtqueue size permits. This bounds memory allocation and makes the buggy guest visible to the user. Reported-by: Zhenhao Hong Signed-off-by: Stefan Hajnoczi --- hw/virtio/virtio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index d24f775..f8ac0fb 100644 --- qemu-xen/hw/virtio/virtio.c.orig 2016-02-18 17:30:28.000000000 +0000 +++ qemu-xen/hw/virtio/virtio.c 2016-09-11 11:01:48.000000000 +0000 @@@@ -459,6 +459,11 @@@@ int virtqueue_pop(VirtQueue *vq, VirtQue max = vq->vring.num; + if (vq->inuse >= max) { + error_report("Virtqueue size exceeded"); + exit(1); + } + i = head = virtqueue_get_head(vq, vq->last_avail_idx++); if (vq->vdev->guest_features & (1 << VIRTIO_RING_F_EVENT_IDX)) { vring_avail_event(vq, vring_avail_idx(vq)); @