[pve-devel] [PATCH kvm] Fix 'i386: leakage of stack memory to guest in kvmvapic.c'

[Wolfgang Bumiller]

---
 ...1-i386-kvmvapic-initialise-imm32-variable.patch | 32 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch

diff --git a/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch b/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch
new file mode 100644
index 0000000..30dd40e
--- /dev/null
+++ b/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch
@@ -0,0 +1,32 @@
+From 45fcb0d1c15d7be4915404cd0e6e1ce380e6cd1f Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp at fedoraproject.org>
+Date: Thu, 7 Apr 2016 12:50:08 +0530
+Subject: [PATCH] i386: kvmvapic: initialise imm32 variable
+
+When processing Task Priorty Register(TPR) access, it could leak
+automatic stack variable 'imm32' in patch_instruction().
+Initialise the variable to avoid it.
+
+Reported by: Donghai Zdh <donghai.zdh at alibaba-inc.com>
+
+Signed-off-by: Prasad J Pandit <pjp at fedoraproject.org>
+---
+ hw/i386/kvmvapic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
+index f0922da..97f3646 100644
+--- a/hw/i386/kvmvapic.c
++++ b/hw/i386/kvmvapic.c
+@@ -393,7 +393,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
+     CPUX86State *env = &cpu->env;
+     VAPICHandlers *handlers;
+     uint8_t opcode[2];
+-    uint32_t imm32;
++    uint32_t imm32 = 0;
+     target_ulong current_pc = 0;
+     target_ulong current_cs_base = 0;
+     int current_flags = 0;
+-- 
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index ecb8ad4..806692e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -52,3 +52,4 @@ extra/0003-rng-move-request-queue-cleanup-from-RngEgd-to-RngBac.patch
 extra/CVE-2016-2858-0004-rng-add-request-queue-support-to-rng-random.patch
 extra/0005-virtio-rng-ask-for-more-data-if-queue-is-not-fully-d.patch
 extra/0001-target-i386-do-not-read-write-MSR_TSC_AUX-from-KVM-i.patch
+extra/0001-i386-kvmvapic-initialise-imm32-variable.patch
-- 
2.1.4