← Back to branch summary

~ubuntu-branches/ubuntu/precise/xen/precise-proposed

« back to all changes in this revision

Viewing changes to debian/patches/qemu-cve-2012-6075-1.patch

  • Committer: Package Import Robot
  • Author(s): Stefan Bader
  • Date: 2013-04-08 17:53:45 UTC
  • mfrom: (29.1.4 precise-security)
  • Revision ID: package-import@ubuntu.com-20130408175345-3y01zmy1lud2w757
Tags: 4.1.2-2ubuntu2.7
https://launchpad.net/bugs/1157757
* Fix HVM VCPUs getting stuck on boot when host supports SMEP (LP: #1157757)
  - 0008-vmx-Simplify-cr0-update-handling-by-deferring-cr4-ch.patch
  - 0009-VMX-disable-SMEP-feature-when-guest-is-in-non-paging.patch
  - 0010-VMX-Always-disable-SMEP-when-guest-is-in-non-paging-.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/qemu-cve-2012-6075-1.patch
 
1
From: Michael Contreras <michael@inetric.com>
 
2
Date: Mon, 3 Dec 2012 04:11:22 +0000 (-0800)
 
3
Subject: e1000: Discard packets that are too long if !SBP and !LPE
 
4
X-Git-Tag: v1.3.0~1
 
5
X-Git-Url: http://git.qemu.org/?p=qemu.git;a=commitdiff_plain;h=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb
 
6
 
 
7
e1000: Discard packets that are too long if !SBP and !LPE
 
8
 
 
9
The e1000_receive function for the e1000 needs to discard packets longer than
 
10
1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes
 
11
this behavior and allocates memory based on this assumption.
 
12
 
 
13
Signed-off-by: Michael Contreras <michael@inetric.com>
 
14
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
 
15
---
 
16
 
 
17
Index: xen-4.1.2/qemu/hw/e1000.c
 
18
===================================================================
 
19
--- xen-4.1.2.orig/qemu/hw/e1000.c      2011-04-28 09:38:36.000000000 +0200
 
20
+++ xen-4.1.2/qemu/hw/e1000.c   2013-01-07 18:58:08.762854040 +0100
 
21
@@ -55,6 +55,9 @@ static int debugflags = DBGBIT(TXERR) |
 
22
 #define REG_IOADDR 0x0
 
23
 #define REG_IODATA 0x4
 
24
 
 
25
+/* this is the size past which hardware will drop packets when setting LPE=0 */
 
26
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
 
27
+
 
28
 /*
 
29
  * HW models:
 
30
  *  E1000_DEV_ID_82540EM works with Windows and Linux
 
31
@@ -625,6 +628,13 @@ e1000_receive(void *opaque, const uint8_
 
32
         return;
 
33
     }
 
34
 
 
35
+    /* Discard oversized packets if !LPE and !SBP. */
 
36
+    if (size > MAXIMUM_ETHERNET_VLAN_SIZE
 
37
+        && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)
 
38
+        && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
 
39
+        return;
 
40
+    }
 
41
+
 
42
     if (!receive_filter(s, buf, size))
 
43
         return;
 
44