@@ -75,6 +75,8 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2021-3930.patch \
file://CVE-2021-20196_1.patch \
file://CVE-2021-20196_2.patch \
+ file://CVE-2021-4145_1.patch \
+ file://CVE-2021-4145_2.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
new file mode 100644
@@ -0,0 +1,67 @@
+From 59fe260a352156261ad0d89be446e5dd0ac96de3 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Date: Sat, 3 Jul 2021 00:16:36 +0300
+Subject: [PATCH 1/2] block/mirror: fix active mirror dead-lock in
+ mirror_wait_on_conflicts
+
+It's possible that requests start to wait each other in
+mirror_wait_on_conflicts(). To avoid it let's use same technique as in
+block/io.c in bdrv_wait_serialising_requests_locked() /
+bdrv_find_conflicting_request(): don't wait on intersecting request if
+it is already waiting for some other request.
+
+For details of the dead-lock look at testIntersectingActiveIO()
+test-case which we actually fixing now.
+
+Fixes: d06107ade0ce74dc39739bac80de84b51ec18546
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20210702211636.228981-4-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+
+CVE: CVE-2021-4145
+Upstream-Status: Backport [d44dae1a7cf782ec9235746ebb0e6c1a20dd7288]
+
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+---
+ block/mirror.c | 12 ++++++++++++
+ tests/qemu-iotests/151 | 0
+ 2 files changed, 12 insertions(+)
+ mode change 100755 => 100644 tests/qemu-iotests/151
+
+diff --git a/block/mirror.c b/block/mirror.c
+index 8e1ad6ece..fab008568 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -106,6 +106,7 @@ struct MirrorOp {
+ bool is_in_flight;
+ CoQueue waiting_requests;
+ Coroutine *co;
++ MirrorOp *waiting_for_op;
+
+ QTAILQ_ENTRY(MirrorOp) next;
+ };
+@@ -158,7 +159,18 @@ static void coroutine_fn mirror_wait_on_conflicts(MirrorOp *self,
+ if (ranges_overlap(self_start_chunk, self_nb_chunks,
+ op_start_chunk, op_nb_chunks))
+ {
++ /*
++ * If the operation is already (indirectly) waiting for us, or
++ * will wait for us as soon as it wakes up, then just go on
++ * (instead of producing a deadlock in the former case).
++ */
++ if (op->waiting_for_op) {
++ continue;
++ }
++
++ self->waiting_for_op = op;
+ qemu_co_queue_wait(&op->waiting_requests, NULL);
++ self->waiting_for_op = NULL;
+ break;
+ }
+ }
+diff --git a/tests/qemu-iotests/151 b/tests/qemu-iotests/151
+old mode 100755
+new mode 100644
+--
+2.33.0
+
new file mode 100644
@@ -0,0 +1,85 @@
+From 09036c63a4a498d65de0d035211b01f0482e3533 Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 10 Sep 2021 14:45:33 +0200
+Subject: [PATCH 2/2] block/mirror: fix NULL pointer dereference in
+ mirror_wait_on_conflicts()
+
+In mirror_iteration() we call mirror_wait_on_conflicts() with
+`self` parameter set to NULL.
+
+Starting from commit d44dae1a7c we dereference `self` pointer in
+mirror_wait_on_conflicts() without checks if it is not NULL.
+
+Backtrace:
+ Program terminated with signal SIGSEGV, Segmentation fault.
+ #0 mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
+ at ../block/mirror.c:172
+ 172 self->waiting_for_op = op;
+ [Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))]
+ (gdb) bt
+ #0 mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
+ at ../block/mirror.c:172
+ #1 0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=<optimized out>) at ../block/mirror.c:491
+ #2 0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917
+ #3 0x00005610c5f046c6 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>)
+ at ../util/coroutine-ucontext.c:173
+ #4 0x00007f0909975820 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91
+ from /usr/lib64/libc.so.6
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404
+Fixes: d44dae1a7c ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Message-Id: <20210910124533.288318-1-sgarzare@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+
+CVE: CVE-2021-4145
+Upstream-Status: Backport [66fed30c9cd11854fc878a4eceb507e915d7c9cd]
+
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+---
+ block/mirror.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/block/mirror.c b/block/mirror.c
+index fab008568..ca0be146f 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -159,18 +159,25 @@ static void coroutine_fn mirror_wait_on_conflicts(MirrorOp *self,
+ if (ranges_overlap(self_start_chunk, self_nb_chunks,
+ op_start_chunk, op_nb_chunks))
+ {
+- /*
+- * If the operation is already (indirectly) waiting for us, or
+- * will wait for us as soon as it wakes up, then just go on
+- * (instead of producing a deadlock in the former case).
+- */
+- if (op->waiting_for_op) {
+- continue;
++ if (self) {
++ /*
++ * If the operation is already (indirectly) waiting for us,
++ * or will wait for us as soon as it wakes up, then just go
++ * on (instead of producing a deadlock in the former case).
++ */
++ if (op->waiting_for_op) {
++ continue;
++ }
++
++ self->waiting_for_op = op;
+ }
+
+- self->waiting_for_op = op;
+ qemu_co_queue_wait(&op->waiting_requests, NULL);
+- self->waiting_for_op = NULL;
++
++ if (self) {
++ self->waiting_for_op = NULL;
++ }
++
+ break;
+ }
+ }
+--
+2.33.0
+
Fix for CVE-2021-4145, commit 66fed30c9c, fixes another commit: d44dae1a7c ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts") Hence, backport both the patches to resolve the CVE. Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> --- meta/recipes-devtools/qemu/qemu.inc | 2 + .../qemu/qemu/CVE-2021-4145_1.patch | 67 +++++++++++++++ .../qemu/qemu/CVE-2021-4145_2.patch | 85 +++++++++++++++++++ 3 files changed, 154 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-4145_1.patch create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-4145_2.patch