Kevin Wolf 6cc8a11c84 fdc: Fix MSR.RQM flag ... The RQM bit in MSR should be set whenever the guest is supposed to access the FIFO, and it should be cleared in all other cases. This is important so the guest can't continue writing/reading the FIFO beyond the length that it's suppossed to access (see CVE-2015-3456). Commit e9077462 fixed the CVE by adding code that avoids the buffer overflow; however it doesn't correct the wrong behaviour of the floppy controller which should already have cleared RQM. Currently, RQM stays set all the time and during all phases while a command is being processed. This is error-prone because the command has to explicitly clear the flag if it doesn't need data (and indeed, the two buggy commands that are the culprits for the CVE just forgot to do that). This patch clears RQM immediately as soon as all bytes that are expected have been received. If the the FIFO is used in the next phase, the flag has to be set explicitly there. It also clear RQM after receiving all bytes even if the phase transition immediately sets it again. While it's technically not necessary at the moment because the state between clearing and setting RQM is not observable by the guest, this is more explicit and matches how real hardware works. It will actually become necessary in qemu once asynchronous code paths are introduced. This alone should have been enough to fix the CVE, but now we have two lines of defense - even better. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>		2015-06-02 13:34:44 -04:00
..
dataplane	virtio-blk: correctly dirty guest memory	2015-04-08 10:39:18 +01:00
block.c	BlockConf: Call backend functions to detect geometry and blocksizes	2015-03-10 14:02:22 +01:00
cdrom.c
ecc.c
fdc.c	fdc: Fix MSR.RQM flag	2015-06-02 13:34:44 -04:00
hd-geometry.c	BlockConf: Call backend functions to detect geometry and blocksizes	2015-03-10 14:02:22 +01:00
m25p80.c	m25p80: fix s->blk usage before assignment	2015-04-28 15:36:09 +02:00
Makefile.objs
nand.c	block: remove superfluous '\n' around error_report/error_setg	2015-03-10 08:15:33 +03:00
nvme.c	nvme: support NVME_VOLATILE_WRITE_CACHE feature	2015-05-22 17:08:00 +02:00
nvme.h
onenand.c	onenand: g_malloc() can't fail, bury dead error handling	2015-02-10 09:27:20 +03:00
pflash_cfi01.c	hw: Propagate errors through qdev_prop_set_drive()	2015-03-10 11:18:23 +01:00
pflash_cfi02.c	hw: Propagate errors through qdev_prop_set_drive()	2015-03-10 11:18:23 +01:00
tc58128.c
virtio-blk.c	virtio: make features 64bit wide	2015-06-01 14:18:55 +02:00
xen_blkif.h
xen_disk.c	block/xen: Use blk_new_open() in blk_connect()	2015-02-16 15:07:18 +00:00