adding Irix (and, to a lesser extent, Solaris) userland emulation to QEMU
Go to file
Petr Matousek 49ef542e41 i8254: fix out-of-bounds memory access in pit_ioport_read()
Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcdec8
Cc: qemu-stable@nongnu.org
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d4862a87e3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29 18:40:21 -05:00
audio
backends hostmem: Prevent removing an in-use memory backend 2015-04-01 10:06:38 +02:00
block vmdk: Use vmdk_find_index_in_cluster everywhere 2015-07-29 18:33:01 -05:00
bsd-user cpu: Make cpu_init() return QOM CPUState object 2015-03-10 17:33:51 +01:00
default-configs hw/usb: Include USB files only if necessary 2015-03-18 11:50:47 +01:00
disas cris: remove unused cris_cond15 declarations 2015-03-19 11:11:55 +03:00
docs fw_cfg: add documentation file (docs/specs/fw_cfg.txt) 2015-04-14 13:21:08 +02:00
dtc@bc895d6d09
fpu
fsdev Fix typos in comments 2015-03-19 11:30:37 +03:00
gdb-xml
hw i8254: fix out-of-bounds memory access in pit_ioport_read() 2015-07-29 18:40:21 -05:00
include stm32f205: Fix SoC type name 2015-04-13 11:37:10 +01:00
libcacard
libdecnumber
linux-headers
linux-user rcu: do not create thread in pthread_atfork callback 2015-04-01 10:06:38 +02:00
migration rdma: Fix cleanup in error paths 2015-03-26 15:31:46 +01:00
net net: synchronize net_host_device_remove with host_net_remove_completion 2015-03-12 19:59:39 +00:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20150313 2015-03-25 22:49:45 +01:00
pixman@87eea99e44
po
qapi block: Document blockdev-add's immaturity 2015-03-27 10:01:12 +00:00
qga qga/commands-posix: Fix bug in guest-fstrim 2015-07-29 18:24:00 -05:00
qobject
qom qom: Add can_be_deleted callback to UserCreatableClass 2015-04-01 10:06:38 +02:00
roms pseries: Update SLOF firmware image to qemu-slof-20150313 2015-03-25 22:49:45 +01:00
scripts build: pass .d file name to scripts/make_device_config.sh, fix makefile target 2015-03-18 12:07:25 +01:00
slirp
stubs
sysconfigs/target
target-alpha tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-arm target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd 2015-07-28 18:23:18 -05:00
target-cris cris: remove unused cris_cond15 declarations 2015-03-19 11:11:55 +03:00
target-i386 target-i386: remove superfluous TARGET_HAS_SMC macro 2015-04-04 09:45:59 +03:00
target-lm32 tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-m68k tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-microblaze tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-mips trivial patches for 2015-03-19 2015-03-19 14:10:20 +00:00
target-moxie target-moxie: Fix warnings from Sparse (one-bit signed bitfield) 2015-03-19 11:11:55 +03:00
target-openrisc tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-ppc target-ppc: don't invalidate msr MSR_HVB bit in cpu_post_load 2015-04-17 11:44:01 +01:00
target-s390x Final batch of s390x enhancements/fixes for 2.3: 2015-03-16 11:44:55 +00:00
target-sh4 tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-sparc tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-tricore target-tricore: Fix check which was always false 2015-04-04 09:45:59 +03:00
target-unicore32 tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
target-xtensa tcg: Change translator-side labels to a pointer 2015-03-13 12:28:18 -07:00
tcg tcg/tcg-op.c: Fix ld/st of 64 bit values on 32-bit bigendian hosts 2015-04-09 10:51:10 +01:00
tests iotests: qcow2 COW with minimal L2 cache size 2015-07-29 18:27:34 -05:00
trace
ui spice-display: fix segfault in qemu_spice_create_update 2015-07-29 18:34:12 -05:00
util util/qemu-config: fix regression of qmp_query_command_line_options 2015-04-02 15:57:27 +02:00
.exrc
.gitignore gitignore: Ignore more .pod files. 2015-04-04 09:45:59 +03:00
.gitmodules
.mailmap
.travis.yml
CODING_STYLE
COPYING
COPYING.LIB
Changelog
HACKING
LICENSE
MAINTAINERS misc fixes and cleanups 2015-03-12 09:13:07 +00:00
Makefile Use $(MAKE) for recursive make 2015-04-02 15:58:39 +02:00
Makefile.objs
Makefile.target
README
VERSION Update version for v2.3.0 release 2015-04-24 15:05:06 +01:00
accel.c
aio-posix.c
aio-win32.c
arch_init.c migration: remove last_sent_block from save_page_header 2015-03-26 15:31:46 +01:00
async.c aio: strengthen memory barriers for bottom half scheduling 2015-04-09 10:29:29 +01:00
balloon.c
block.c block: Fix NULL deference for unaligned write if qiov is NULL 2015-07-29 18:15:27 -05:00
blockdev-nbd.c nbd: Fix up comment after commit e140177 2015-03-25 13:38:07 +01:00
blockdev.c block: Fix blockdev-backup not to use funky error class 2015-03-19 16:02:59 +01:00
blockjob.c
bootdevice.c misc: fix typos in copyright declaration 2015-03-26 14:21:43 +01:00
bt-host.c
bt-vhci.c
configure Revert seccomp tests that allow it to be used on non-x86 architectures 2015-04-13 12:28:48 +01:00
coroutine-gthread.c
coroutine-sigaltstack.c
coroutine-ucontext.c
coroutine-win32.c
cpu-exec.c
cpus.c cpus: Don't kick un-realized cpus. 2015-03-25 13:38:07 +01:00
cputlb.c
device-hotplug.c
device_tree.c machine: query phandle-start machine property 2015-03-11 18:17:11 +01:00
disas.c
dma-helpers.c
dump.c
exec.c Revert "exec: Respect as_tranlsate_internal length clamp" 2015-04-01 10:06:38 +02:00
gdbstub.c
hmp-commands.hx hmp: Fix texinfo documentation 2015-03-19 11:35:52 +03:00
hmp.c hmp: fix crash in 'info block -n -v' 2015-04-17 14:27:42 +01:00
hmp.h qom: Implement qom-set HMP command 2015-03-17 14:31:15 +01:00
iohandler.c
ioport.c
iothread.c
kvm-all.c kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap 2015-04-02 15:58:37 +02:00
kvm-stub.c
main-loop.c
memory.c memory: Move owner-less MemoryRegions to /machine/unattached 2015-03-17 14:31:26 +01:00
memory_mapping.c
module-common.c
monitor.c usb: bugfix collection. 2015-03-20 09:50:08 +00:00
nbd.c nbd/trivial: fix type cast for ioctl 2015-07-28 18:14:07 -05:00
numa.c numa: Print warning if no node is assigned to a CPU 2015-03-19 16:20:15 -03:00
os-posix.c rcu: do not create thread in pthread_atfork callback 2015-04-01 10:06:38 +02:00
os-win32.c
page_cache.c
qapi-schema.json kbd: add brazil kbd keys to qemu 2015-07-29 18:25:03 -05:00
qdev-monitor.c qom: Implement info qom-tree HMP command 2015-03-17 14:31:21 +01:00
qdict-test-data.txt
qemu-bridge-helper.c
qemu-char.c
qemu-coroutine-io.c coroutine-io: Return -errno in case of error 2015-03-18 12:07:21 +01:00
qemu-coroutine-lock.c
qemu-coroutine-sleep.c
qemu-coroutine.c
qemu-doc.texi raw-posix: Deprecate host floppy passthrough 2015-03-19 11:43:02 +01:00
qemu-img-cmds.hx
qemu-img.c qemu-img: Avoid qerror_report_err() outside QMP handlers, again 2015-03-16 17:07:25 +01:00
qemu-img.texi
qemu-io-cmds.c
qemu-io.c
qemu-log.c
qemu-nbd.c nbd: Set block size to BDRV_SECTOR_SIZE 2015-03-18 12:07:01 +01:00
qemu-nbd.texi
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx Block patches for 2.3.0-rc1 2015-03-19 17:47:08 +00:00
qemu-seccomp.c
qemu-tech.texi
qemu-timer.c
qemu.nsi
qemu.sasl
qjson.c
qmp-commands.hx block: Document blockdev-add's immaturity 2015-03-27 10:01:12 +00:00
qmp.c qom: Add can_be_deleted callback to UserCreatableClass 2015-04-01 10:06:38 +02:00
qtest.c
rules.mak
savevm.c error: Replace error_report() & error_free() with error_report_err() 2015-03-19 11:11:55 +03:00
softmmu_template.h
spice-qemu-char.c
tcg-runtime.c
tci.c
thread-pool.c
thunk.c
tpm.c
trace-events
translate-all.c target-i386: remove superfluous TARGET_HAS_SMC macro 2015-04-04 09:45:59 +03:00
translate-all.h
user-exec.c user-exec.c: fix build on NetBSD/sparc64 and NetBSD/arm 2015-03-13 15:57:00 +00:00
version.rc
vl.c Avoid crashing on multiple -incoming 2015-03-26 15:31:46 +01:00
xen-common-stub.c
xen-common.c
xen-hvm-stub.c
xen-hvm.c
xen-mapcache.c

README

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team