[gentoo-commits] repo/gentoo:master commit in: app-emulation/qemu/files/, app-emulation/qemu/

[John Helmert III]

commit:     0ad99be8a35aff4afc249dd3b596b2eed6b5c884
Author:     John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 21 23:29:36 2021 +0000
Commit:     John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Tue Dec 21 23:42:17 2021 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ad99be8

app-emulation/qemu: fix unix socket path copy

This adds a patch of upstream commit
118d527f2e4baec5fe8060b22a6212468b8e4d3f. It is included in 6.2.0, but
fixes a 6.1.0 regression, so committing straight to stable.

Signed-off-by: John Helmert III <ajak <AT> gentoo.org>

 .../files/qemu-6.1.0-fix-unix-socket-copy.patch    | 76 ++++++++++++++++++++++
 .../{qemu-6.1.0-r2.ebuild => qemu-6.1.0-r3.ebuild} |  1 +
 2 files changed, 77 insertions(+)

diff --git a/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch
new file mode 100644
index 000000000000..7701b26b4f9a
--- /dev/null
+++ b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch
@@ -0,0 +1,76 @@
+commit 118d527f2e4baec5fe8060b22a6212468b8e4d3f
+Author: Michael Tokarev <mjt@×××××××.ru>
+Date:   Wed Sep 1 16:16:24 2021 +0300
+
+    qemu-sockets: fix unix socket path copy (again)
+    
+    Commit 4cfd970ec188558daa6214f26203fe553fb1e01f added an
+    assert which ensures the path within an address of a unix
+    socket returned from the kernel is at least one byte and
+    does not exceed sun_path buffer. Both of this constraints
+    are wrong:
+    
+    A unix socket can be unnamed, in this case the path is
+    completely empty (not even \0)
+    
+    And some implementations (notable linux) can add extra
+    trailing byte (\0) _after_ the sun_path buffer if we
+    passed buffer larger than it (and we do).
+    
+    So remove the assertion (since it causes real-life breakage)
+    but at the same time fix the usage of sun_path. Namely,
+    we should not access sun_path[0] if kernel did not return
+    it at all (this is the case for unnamed sockets),
+    and use the returned salen when copyig actual path as an
+    upper constraint for the amount of bytes to copy - this
+    will ensure we wont exceed the information provided by
+    the kernel, regardless whenever there is a trailing \0
+    or not. This also helps with unnamed sockets.
+    
+    Note the case of abstract socket, the sun_path is actually
+    a blob and can contain \0 characters, - it should not be
+    passed to g_strndup and the like, it should be accessed by
+    memcpy-like functions.
+    
+    Fixes: 4cfd970ec188558daa6214f26203fe553fb1e01f
+    Fixes: http://bugs.debian.org/993145
+    Signed-off-by: Michael Tokarev <mjt@×××××××.ru>
+    Reviewed-by: Daniel P. Berrangé <berrange@××××××.com>
+    Reviewed-by: Marc-André Lureau <marcandre.lureau@××××××.com>
+    CC: qemu-stable@××××××.org
+
+diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
+index f2f3676d1f..c5043999e9 100644
+--- a/util/qemu-sockets.c
++++ b/util/qemu-sockets.c
+@@ -1345,25 +1345,22 @@ socket_sockaddr_to_address_unix(struct sockaddr_storage *sa,
+     SocketAddress *addr;
+     struct sockaddr_un *su = (struct sockaddr_un *)sa;
+ 
+-    assert(salen >= sizeof(su->sun_family) + 1 &&
+-           salen <= sizeof(struct sockaddr_un));
+-
+     addr = g_new0(SocketAddress, 1);
+     addr->type = SOCKET_ADDRESS_TYPE_UNIX;
++    salen -= offsetof(struct sockaddr_un, sun_path);
+ #ifdef CONFIG_LINUX
+-    if (!su->sun_path[0]) {
++    if (salen > 0 && !su->sun_path[0]) {
+         /* Linux abstract socket */
+-        addr->u.q_unix.path = g_strndup(su->sun_path + 1,
+-                                        salen - sizeof(su->sun_family) - 1);
++        addr->u.q_unix.path = g_strndup(su->sun_path + 1, salen - 1);
+         addr->u.q_unix.has_abstract = true;
+         addr->u.q_unix.abstract = true;
+         addr->u.q_unix.has_tight = true;
+-        addr->u.q_unix.tight = salen < sizeof(*su);
++        addr->u.q_unix.tight = salen < sizeof(su->sun_path);
+         return addr;
+     }
+ #endif
+ 
+-    addr->u.q_unix.path = g_strndup(su->sun_path, sizeof(su->sun_path));
++    addr->u.q_unix.path = g_strndup(su->sun_path, salen);
+     return addr;
+ }
+ #endif /* WIN32 */

diff --git a/app-emulation/qemu/qemu-6.1.0-r2.ebuild b/app-emulation/qemu/qemu-6.1.0-r3.ebuild
similarity index 99%
rename from app-emulation/qemu/qemu-6.1.0-r2.ebuild
rename to app-emulation/qemu/qemu-6.1.0-r3.ebuild
index b91f85e5d967..8d2ca068f00d 100644
--- a/app-emulation/qemu/qemu-6.1.0-r2.ebuild
+++ b/app-emulation/qemu/qemu-6.1.0-r3.ebuild
@@ -277,6 +277,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
 	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${P}-fix-unix-socket-copy.patch
 	"${FILESDIR}"/${P}-automagic-libbpf.patch
 	"${FILESDIR}"/${P}-data-corruption.patch
 )