diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2021-12-02 08:49:51 -0800 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2021-12-02 08:49:51 -0800 |
| commit | a69254a2b320e31d3aa63ca910b7aa02efcd5492 (patch) | |
| tree | 794167714b258376097fa0eb90e6a8d2904fae92 /hw | |
| parent | 682aa69b1f4dd5f2905a94066fa4c853adc33251 (diff) | |
| parent | cc20926e9b8077bff6813efc8dcdeae90d1a3b10 (diff) | |
| download | qemu-a69254a2b320e31d3aa63ca910b7aa02efcd5492.zip qemu-a69254a2b320e31d3aa63ca910b7aa02efcd5492.tar.gz qemu-a69254a2b320e31d3aa63ca910b7aa02efcd5492.tar.bz2 | |
Merge tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu into staging
Pull request
# gpg: Signature made Wed 01 Dec 2021 10:17:38 PM PST
# gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]
* tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu:
tests/qtest/fdc-test: Add a regression test for CVE-2021-20196
hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
hw/block/fdc: Extract blk_create_empty_drive()
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/block/fdc.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/hw/block/fdc.c b/hw/block/fdc.c index fa933cd..21d18ac 100644 --- a/hw/block/fdc.c +++ b/hw/block/fdc.c @@ -61,6 +61,12 @@ } while (0) +/* Anonymous BlockBackend for empty drive */ +static BlockBackend *blk_create_empty_drive(void) +{ + return blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL); +} + /********************************************************/ /* qdev floppy bus */ @@ -486,8 +492,7 @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp) } if (!dev->conf.blk) { - /* Anonymous BlockBackend for an empty drive */ - dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL); + dev->conf.blk = blk_create_empty_drive(); ret = blk_attach_dev(dev->conf.blk, qdev); assert(ret == 0); @@ -1161,7 +1166,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit) static FDrive *get_cur_drv(FDCtrl *fdctrl) { - return get_drv(fdctrl, fdctrl->cur_drv); + FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv); + + if (!cur_drv->blk) { + /* + * Kludge: empty drive line selected. Create an anonymous + * BlockBackend to avoid NULL deref with various BlockBackend + * API calls within this model (CVE-2021-20196). + * Due to the controller QOM model limitations, we don't + * attach the created to the controller device. + */ + cur_drv->blk = blk_create_empty_drive(); + } + return cur_drv; } /* Status A register : 0x00 (read-only) */ |