1 |
commit: 71ba961e21b1493ae7b335a6e2fa5a6669baf64c |
2 |
Author: Matthias Maier <tamiko <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Nov 12 20:01:23 2017 +0000 |
4 |
Commit: Matthias Maier <tamiko <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Nov 12 20:21:51 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71ba961e |
7 |
|
8 |
app-emulation/qemu: drop obsolete patches |
9 |
|
10 |
Package-Manager: Portage-2.3.8, Repoman-2.3.4 |
11 |
|
12 |
.../qemu/files/qemu-2.9.0-CVE-2017-10664.patch | 47 ----- |
13 |
.../qemu/files/qemu-2.9.0-CVE-2017-10806.patch | 50 ------ |
14 |
.../qemu/files/qemu-2.9.0-CVE-2017-11334.patch | 40 ----- |
15 |
.../qemu/files/qemu-2.9.0-CVE-2017-11434.patch | 29 --- |
16 |
.../qemu/files/qemu-2.9.0-CVE-2017-7493.patch | 174 ------------------ |
17 |
.../qemu/files/qemu-2.9.0-CVE-2017-8112.patch | 22 --- |
18 |
.../qemu/files/qemu-2.9.0-CVE-2017-8309.patch | 22 --- |
19 |
.../qemu/files/qemu-2.9.0-CVE-2017-8379.patch | 76 -------- |
20 |
.../qemu/files/qemu-2.9.0-CVE-2017-8380.patch | 34 ---- |
21 |
.../qemu/files/qemu-2.9.0-CVE-2017-9503-1.patch | 122 ------------- |
22 |
.../qemu/files/qemu-2.9.0-CVE-2017-9503-2.patch | 114 ------------ |
23 |
.../qemu/files/qemu-2.9.0-CVE-2017-9524-1.patch | 80 --------- |
24 |
.../qemu/files/qemu-2.9.0-CVE-2017-9524-2.patch | 197 --------------------- |
25 |
13 files changed, 1007 deletions(-) |
26 |
|
27 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10664.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10664.patch |
28 |
deleted file mode 100644 |
29 |
index 7db06929cf2..00000000000 |
30 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10664.patch |
31 |
+++ /dev/null |
32 |
@@ -1,47 +0,0 @@ |
33 |
-From 041e32b8d9d076980b4e35317c0339e57ab888f1 Mon Sep 17 00:00:00 2001 |
34 |
-From: Max Reitz <mreitz@××××××.com> |
35 |
-Date: Sun, 11 Jun 2017 14:37:14 +0200 |
36 |
-Subject: [PATCH] qemu-nbd: Ignore SIGPIPE |
37 |
- |
38 |
-qemu proper has done so for 13 years |
39 |
-(8a7ddc38a60648257dc0645ab4a05b33d6040063), qemu-img and qemu-io have |
40 |
-done so for four years (526eda14a68d5b3596be715505289b541288ef2a). |
41 |
-Ignoring this signal is especially important in qemu-nbd because |
42 |
-otherwise a client can easily take down the qemu-nbd server by dropping |
43 |
-the connection when the server wants to send something, for example: |
44 |
- |
45 |
-$ qemu-nbd -x foo -f raw -t null-co:// & |
46 |
-[1] 12726 |
47 |
-$ qemu-io -c quit nbd://localhost/bar |
48 |
-can't open device nbd://localhost/bar: No export with name 'bar' available |
49 |
-[1] + 12726 broken pipe qemu-nbd -x foo -f raw -t null-co:// |
50 |
- |
51 |
-In this case, the client sends an NBD_OPT_ABORT and closes the |
52 |
-connection (because it is not required to wait for a reply), but the |
53 |
-server replies with an NBD_REP_ACK (because it is required to reply). |
54 |
- |
55 |
-Signed-off-by: Max Reitz <mreitz@××××××.com> |
56 |
-Message-Id: <20170611123714.31292-1-mreitz@××××××.com> |
57 |
-Signed-off-by: Paolo Bonzini <pbonzini@××××××.com> |
58 |
---- |
59 |
- qemu-nbd.c | 4 ++++ |
60 |
- 1 file changed, 4 insertions(+) |
61 |
- |
62 |
-diff --git a/qemu-nbd.c b/qemu-nbd.c |
63 |
-index 9464a0461c..4dd3fd4732 100644 |
64 |
---- a/qemu-nbd.c |
65 |
-+++ b/qemu-nbd.c |
66 |
-@@ -581,6 +581,10 @@ int main(int argc, char **argv) |
67 |
- sa_sigterm.sa_handler = termsig_handler; |
68 |
- sigaction(SIGTERM, &sa_sigterm, NULL); |
69 |
- |
70 |
-+#ifdef CONFIG_POSIX |
71 |
-+ signal(SIGPIPE, SIG_IGN); |
72 |
-+#endif |
73 |
-+ |
74 |
- module_call_init(MODULE_INIT_TRACE); |
75 |
- qcrypto_init(&error_fatal); |
76 |
- |
77 |
--- |
78 |
-2.13.0 |
79 |
- |
80 |
|
81 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10806.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10806.patch |
82 |
deleted file mode 100644 |
83 |
index 0074f5f8c77..00000000000 |
84 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-10806.patch |
85 |
+++ /dev/null |
86 |
@@ -1,50 +0,0 @@ |
87 |
-From bd4a683505b27adc1ac809f71e918e58573d851d Mon Sep 17 00:00:00 2001 |
88 |
-From: Gerd Hoffmann <kraxel@××××××.com> |
89 |
-Date: Tue, 9 May 2017 13:01:28 +0200 |
90 |
-Subject: [PATCH] usb-redir: fix stack overflow in usbredir_log_data |
91 |
-MIME-Version: 1.0 |
92 |
-Content-Type: text/plain; charset=UTF-8 |
93 |
-Content-Transfer-Encoding: 8bit |
94 |
- |
95 |
-Don't reinvent a broken wheel, just use the hexdump function we have. |
96 |
- |
97 |
-Impact: low, broken code doesn't run unless you have debug logging |
98 |
-enabled. |
99 |
- |
100 |
-Reported-by: 李强 <liqiang6-s@×××.cn> |
101 |
-Signed-off-by: Gerd Hoffmann <kraxel@××××××.com> |
102 |
-Message-id: 20170509110128.27261-1-kraxel@××××××.com |
103 |
---- |
104 |
- hw/usb/redirect.c | 13 +------------ |
105 |
- 1 file changed, 1 insertion(+), 12 deletions(-) |
106 |
- |
107 |
-diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c |
108 |
-index b001a27f05..ad5ef783a6 100644 |
109 |
---- a/hw/usb/redirect.c |
110 |
-+++ b/hw/usb/redirect.c |
111 |
-@@ -229,21 +229,10 @@ static void usbredir_log(void *priv, int level, const char *msg) |
112 |
- static void usbredir_log_data(USBRedirDevice *dev, const char *desc, |
113 |
- const uint8_t *data, int len) |
114 |
- { |
115 |
-- int i, j, n; |
116 |
-- |
117 |
- if (dev->debug < usbredirparser_debug_data) { |
118 |
- return; |
119 |
- } |
120 |
-- |
121 |
-- for (i = 0; i < len; i += j) { |
122 |
-- char buf[128]; |
123 |
-- |
124 |
-- n = sprintf(buf, "%s", desc); |
125 |
-- for (j = 0; j < 8 && i + j < len; j++) { |
126 |
-- n += sprintf(buf + n, " %02X", data[i + j]); |
127 |
-- } |
128 |
-- error_report("%s", buf); |
129 |
-- } |
130 |
-+ qemu_hexdump((char *)data, stderr, desc, len); |
131 |
- } |
132 |
- |
133 |
- /* |
134 |
--- |
135 |
-2.13.0 |
136 |
- |
137 |
|
138 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11334.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11334.patch |
139 |
deleted file mode 100644 |
140 |
index bfe4c7d89f2..00000000000 |
141 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11334.patch |
142 |
+++ /dev/null |
143 |
@@ -1,40 +0,0 @@ |
144 |
-[Qemu-devel] [PULL 21/41] exec: use qemu_ram_ptr_length to access guest |
145 |
-From: Prasad J Pandit <address@hidden> |
146 |
- |
147 |
-When accessing guest's ram block during DMA operation, use |
148 |
-'qemu_ram_ptr_length' to get ram block pointer. It ensures |
149 |
-that DMA operation of given length is possible; And avoids |
150 |
-any OOB memory access situations. |
151 |
- |
152 |
-Reported-by: Alex <address@hidden> |
153 |
-Signed-off-by: Prasad J Pandit <address@hidden> |
154 |
-Message-Id: <address@hidden> |
155 |
-Signed-off-by: Paolo Bonzini <address@hidden> |
156 |
---- |
157 |
- exec.c | 4 ++-- |
158 |
- 1 file changed, 2 insertions(+), 2 deletions(-) |
159 |
- |
160 |
-diff --git a/exec.c b/exec.c |
161 |
-index a083ff8..ad103ce 100644 |
162 |
---- a/exec.c |
163 |
-+++ b/exec.c |
164 |
-@@ -2929,7 +2929,7 @@ static MemTxResult address_space_write_continue(AddressSpace *as, hwaddr addr, |
165 |
- } |
166 |
- } else { |
167 |
- /* RAM case */ |
168 |
-- ptr = qemu_map_ram_ptr(mr->ram_block, addr1); |
169 |
-+ ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l); |
170 |
- memcpy(ptr, buf, l); |
171 |
- invalidate_and_set_dirty(mr, addr1, l); |
172 |
- } |
173 |
-@@ -3020,7 +3020,7 @@ MemTxResult address_space_read_continue(AddressSpace *as, hwaddr addr, |
174 |
- } |
175 |
- } else { |
176 |
- /* RAM case */ |
177 |
-- ptr = qemu_map_ram_ptr(mr->ram_block, addr1); |
178 |
-+ ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l); |
179 |
- memcpy(buf, ptr, l); |
180 |
- } |
181 |
- |
182 |
--- |
183 |
-1.8.3.1 |
184 |
|
185 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11434.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11434.patch |
186 |
deleted file mode 100644 |
187 |
index 5d32067c7a0..00000000000 |
188 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-11434.patch |
189 |
+++ /dev/null |
190 |
@@ -1,29 +0,0 @@ |
191 |
-[Qemu-devel] [PATCH] slirp: check len against dhcp options array end |
192 |
-From: Prasad J Pandit <address@hidden> |
193 |
- |
194 |
-While parsing dhcp options string in 'dhcp_decode', if an options' |
195 |
-length 'len' appeared towards the end of 'bp_vend' array, ensuing |
196 |
-read could lead to an OOB memory access issue. Add check to avoid it. |
197 |
- |
198 |
-Reported-by: Reno Robert <address@hidden> |
199 |
-Signed-off-by: Prasad J Pandit <address@hidden> |
200 |
---- |
201 |
- slirp/bootp.c | 3 +++ |
202 |
- 1 file changed, 3 insertions(+) |
203 |
- |
204 |
-diff --git a/slirp/bootp.c b/slirp/bootp.c |
205 |
-index 5a4646c..5dd1a41 100644 |
206 |
---- a/slirp/bootp.c |
207 |
-+++ b/slirp/bootp.c |
208 |
-@@ -123,6 +123,9 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type, |
209 |
- if (p >= p_end) |
210 |
- break; |
211 |
- len = *p++; |
212 |
-+ if (p + len > p_end) { |
213 |
-+ break; |
214 |
-+ } |
215 |
- DPRINTF("dhcp: tag=%d len=%d\n", tag, len); |
216 |
- |
217 |
- switch(tag) { |
218 |
--- |
219 |
-2.9.4 |
220 |
|
221 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch |
222 |
deleted file mode 100644 |
223 |
index 346e7713f74..00000000000 |
224 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch |
225 |
+++ /dev/null |
226 |
@@ -1,174 +0,0 @@ |
227 |
-From 7a95434e0ca8a037fd8aa1a2e2461f92585eb77b Mon Sep 17 00:00:00 2001 |
228 |
-From: Greg Kurz <groug@××××.org> |
229 |
-Date: Fri, 5 May 2017 14:48:08 +0200 |
230 |
-Subject: [PATCH] 9pfs: local: forbid client access to metadata (CVE-2017-7493) |
231 |
- |
232 |
-When using the mapped-file security mode, we shouldn't let the client mess |
233 |
-with the metadata. The current code already tries to hide the metadata dir |
234 |
-from the client by skipping it in local_readdir(). But the client can still |
235 |
-access or modify it through several other operations. This can be used to |
236 |
-escalate privileges in the guest. |
237 |
- |
238 |
-Affected backend operations are: |
239 |
-- local_mknod() |
240 |
-- local_mkdir() |
241 |
-- local_open2() |
242 |
-- local_symlink() |
243 |
-- local_link() |
244 |
-- local_unlinkat() |
245 |
-- local_renameat() |
246 |
-- local_rename() |
247 |
-- local_name_to_path() |
248 |
- |
249 |
-Other operations are safe because they are only passed a fid path, which |
250 |
-is computed internally in local_name_to_path(). |
251 |
- |
252 |
-This patch converts all the functions listed above to fail and return |
253 |
-EINVAL when being passed the name of the metadata dir. This may look |
254 |
-like a poor choice for errno, but there's no such thing as an illegal |
255 |
-path name on Linux and I could not think of anything better. |
256 |
- |
257 |
-This fixes CVE-2017-7493. |
258 |
- |
259 |
-Reported-by: Leo Gaspard <leo@×××××××.io> |
260 |
-Signed-off-by: Greg Kurz <groug@××××.org> |
261 |
-Reviewed-by: Eric Blake <eblake@××××××.com> |
262 |
---- |
263 |
- hw/9pfs/9p-local.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- |
264 |
- 1 file changed, 56 insertions(+), 2 deletions(-) |
265 |
- |
266 |
-diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c |
267 |
-index f3ebca4f7a..a2486566af 100644 |
268 |
---- a/hw/9pfs/9p-local.c |
269 |
-+++ b/hw/9pfs/9p-local.c |
270 |
-@@ -452,6 +452,11 @@ static off_t local_telldir(FsContext *ctx, V9fsFidOpenState *fs) |
271 |
- return telldir(fs->dir.stream); |
272 |
- } |
273 |
- |
274 |
-+static bool local_is_mapped_file_metadata(FsContext *fs_ctx, const char *name) |
275 |
-+{ |
276 |
-+ return !strcmp(name, VIRTFS_META_DIR); |
277 |
-+} |
278 |
-+ |
279 |
- static struct dirent *local_readdir(FsContext *ctx, V9fsFidOpenState *fs) |
280 |
- { |
281 |
- struct dirent *entry; |
282 |
-@@ -465,8 +470,8 @@ again: |
283 |
- if (ctx->export_flags & V9FS_SM_MAPPED) { |
284 |
- entry->d_type = DT_UNKNOWN; |
285 |
- } else if (ctx->export_flags & V9FS_SM_MAPPED_FILE) { |
286 |
-- if (!strcmp(entry->d_name, VIRTFS_META_DIR)) { |
287 |
-- /* skp the meta data directory */ |
288 |
-+ if (local_is_mapped_file_metadata(ctx, entry->d_name)) { |
289 |
-+ /* skip the meta data directory */ |
290 |
- goto again; |
291 |
- } |
292 |
- entry->d_type = DT_UNKNOWN; |
293 |
-@@ -559,6 +564,12 @@ static int local_mknod(FsContext *fs_ctx, V9fsPath *dir_path, |
294 |
- int err = -1; |
295 |
- int dirfd; |
296 |
- |
297 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
298 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
299 |
-+ errno = EINVAL; |
300 |
-+ return -1; |
301 |
-+ } |
302 |
-+ |
303 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
304 |
- if (dirfd == -1) { |
305 |
- return -1; |
306 |
-@@ -605,6 +616,12 @@ static int local_mkdir(FsContext *fs_ctx, V9fsPath *dir_path, |
307 |
- int err = -1; |
308 |
- int dirfd; |
309 |
- |
310 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
311 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
312 |
-+ errno = EINVAL; |
313 |
-+ return -1; |
314 |
-+ } |
315 |
-+ |
316 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
317 |
- if (dirfd == -1) { |
318 |
- return -1; |
319 |
-@@ -694,6 +711,12 @@ static int local_open2(FsContext *fs_ctx, V9fsPath *dir_path, const char *name, |
320 |
- int err = -1; |
321 |
- int dirfd; |
322 |
- |
323 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
324 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
325 |
-+ errno = EINVAL; |
326 |
-+ return -1; |
327 |
-+ } |
328 |
-+ |
329 |
- /* |
330 |
- * Mark all the open to not follow symlinks |
331 |
- */ |
332 |
-@@ -752,6 +775,12 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath, |
333 |
- int err = -1; |
334 |
- int dirfd; |
335 |
- |
336 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
337 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
338 |
-+ errno = EINVAL; |
339 |
-+ return -1; |
340 |
-+ } |
341 |
-+ |
342 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
343 |
- if (dirfd == -1) { |
344 |
- return -1; |
345 |
-@@ -826,6 +855,12 @@ static int local_link(FsContext *ctx, V9fsPath *oldpath, |
346 |
- int ret = -1; |
347 |
- int odirfd, ndirfd; |
348 |
- |
349 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
350 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
351 |
-+ errno = EINVAL; |
352 |
-+ return -1; |
353 |
-+ } |
354 |
-+ |
355 |
- odirfd = local_opendir_nofollow(ctx, odirpath); |
356 |
- if (odirfd == -1) { |
357 |
- goto out; |
358 |
-@@ -1096,6 +1131,12 @@ static int local_lremovexattr(FsContext *ctx, V9fsPath *fs_path, |
359 |
- static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path, |
360 |
- const char *name, V9fsPath *target) |
361 |
- { |
362 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
363 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
364 |
-+ errno = EINVAL; |
365 |
-+ return -1; |
366 |
-+ } |
367 |
-+ |
368 |
- if (dir_path) { |
369 |
- v9fs_path_sprintf(target, "%s/%s", dir_path->data, name); |
370 |
- } else if (strcmp(name, "/")) { |
371 |
-@@ -1116,6 +1157,13 @@ static int local_renameat(FsContext *ctx, V9fsPath *olddir, |
372 |
- int ret; |
373 |
- int odirfd, ndirfd; |
374 |
- |
375 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
376 |
-+ (local_is_mapped_file_metadata(ctx, old_name) || |
377 |
-+ local_is_mapped_file_metadata(ctx, new_name))) { |
378 |
-+ errno = EINVAL; |
379 |
-+ return -1; |
380 |
-+ } |
381 |
-+ |
382 |
- odirfd = local_opendir_nofollow(ctx, olddir->data); |
383 |
- if (odirfd == -1) { |
384 |
- return -1; |
385 |
-@@ -1206,6 +1254,12 @@ static int local_unlinkat(FsContext *ctx, V9fsPath *dir, |
386 |
- int ret; |
387 |
- int dirfd; |
388 |
- |
389 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
390 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
391 |
-+ errno = EINVAL; |
392 |
-+ return -1; |
393 |
-+ } |
394 |
-+ |
395 |
- dirfd = local_opendir_nofollow(ctx, dir->data); |
396 |
- if (dirfd == -1) { |
397 |
- return -1; |
398 |
--- |
399 |
-2.13.0 |
400 |
- |
401 |
|
402 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8112.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8112.patch |
403 |
deleted file mode 100644 |
404 |
index 31fb69bf897..00000000000 |
405 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8112.patch |
406 |
+++ /dev/null |
407 |
@@ -1,22 +0,0 @@ |
408 |
-CVE-2017-8112 |
409 |
- |
410 |
-https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04494.html |
411 |
---- |
412 |
- hw/scsi/vmw_pvscsi.c | 2 +- |
413 |
- 1 file changed, 1 insertion(+), 1 deletion(-) |
414 |
- |
415 |
-diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c |
416 |
-index 7557546..4a106da 100644 |
417 |
---- a/hw/scsi/vmw_pvscsi.c |
418 |
-+++ b/hw/scsi/vmw_pvscsi.c |
419 |
-@@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) |
420 |
- uint32_t len_log2; |
421 |
- uint32_t ring_size; |
422 |
- |
423 |
-- if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { |
424 |
-+ if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { |
425 |
- return -1; |
426 |
- } |
427 |
- ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE; |
428 |
--- |
429 |
-2.9.3 |
430 |
|
431 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8309.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8309.patch |
432 |
deleted file mode 100644 |
433 |
index 4f7f870210c..00000000000 |
434 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8309.patch |
435 |
+++ /dev/null |
436 |
@@ -1,22 +0,0 @@ |
437 |
-bug #616870 |
438 |
- |
439 |
-https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html |
440 |
---- |
441 |
- audio/audio.c | 2 ++ |
442 |
- 1 file changed, 2 insertions(+) |
443 |
- |
444 |
-diff --git a/audio/audio.c b/audio/audio.c |
445 |
-index c8898d8422..beafed209b 100644 |
446 |
---- a/audio/audio.c |
447 |
-+++ b/audio/audio.c |
448 |
-@@ -2028,6 +2028,8 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque) |
449 |
- sw = sw1; |
450 |
- } |
451 |
- QLIST_REMOVE (cap, entries); |
452 |
-+ g_free (cap->hw.mix_buf); |
453 |
-+ g_free (cap->buf); |
454 |
- g_free (cap); |
455 |
- } |
456 |
- return; |
457 |
--- |
458 |
-2.9.3 |
459 |
|
460 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8379.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8379.patch |
461 |
deleted file mode 100644 |
462 |
index 0a34dae671c..00000000000 |
463 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8379.patch |
464 |
+++ /dev/null |
465 |
@@ -1,76 +0,0 @@ |
466 |
-bug #616872 |
467 |
- |
468 |
-https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html |
469 |
---- |
470 |
- ui/input.c | 14 +++++++++++--- |
471 |
- 1 file changed, 11 insertions(+), 3 deletions(-) |
472 |
- |
473 |
-diff --git a/ui/input.c b/ui/input.c |
474 |
-index ed88cda6d6..fb1f404095 100644 |
475 |
---- a/ui/input.c |
476 |
-+++ b/ui/input.c |
477 |
-@@ -41,6 +41,8 @@ static QTAILQ_HEAD(QemuInputEventQueueHead, QemuInputEventQueue) kbd_queue = |
478 |
- QTAILQ_HEAD_INITIALIZER(kbd_queue); |
479 |
- static QEMUTimer *kbd_timer; |
480 |
- static uint32_t kbd_default_delay_ms = 10; |
481 |
-+static uint32_t queue_count; |
482 |
-+static uint32_t queue_limit = 1024; |
483 |
- |
484 |
- QemuInputHandlerState *qemu_input_handler_register(DeviceState *dev, |
485 |
- QemuInputHandler *handler) |
486 |
-@@ -268,6 +270,7 @@ static void qemu_input_queue_process(void *opaque) |
487 |
- break; |
488 |
- } |
489 |
- QTAILQ_REMOVE(queue, item, node); |
490 |
-+ queue_count--; |
491 |
- g_free(item); |
492 |
- } |
493 |
- } |
494 |
-@@ -282,6 +285,7 @@ static void qemu_input_queue_delay(struct QemuInputEventQueueHead *queue, |
495 |
- item->delay_ms = delay_ms; |
496 |
- item->timer = timer; |
497 |
- QTAILQ_INSERT_TAIL(queue, item, node); |
498 |
-+ queue_count++; |
499 |
- |
500 |
- if (start_timer) { |
501 |
- timer_mod(item->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) |
502 |
-@@ -298,6 +302,7 @@ static void qemu_input_queue_event(struct QemuInputEventQueueHead *queue, |
503 |
- item->src = src; |
504 |
- item->evt = evt; |
505 |
- QTAILQ_INSERT_TAIL(queue, item, node); |
506 |
-+ queue_count++; |
507 |
- } |
508 |
- |
509 |
- static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) |
510 |
-@@ -306,6 +311,7 @@ static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) |
511 |
- |
512 |
- item->type = QEMU_INPUT_QUEUE_SYNC; |
513 |
- QTAILQ_INSERT_TAIL(queue, item, node); |
514 |
-+ queue_count++; |
515 |
- } |
516 |
- |
517 |
- void qemu_input_event_send_impl(QemuConsole *src, InputEvent *evt) |
518 |
-@@ -381,7 +387,7 @@ void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down) |
519 |
- qemu_input_event_send(src, evt); |
520 |
- qemu_input_event_sync(); |
521 |
- qapi_free_InputEvent(evt); |
522 |
-- } else { |
523 |
-+ } else if (queue_count < queue_limit) { |
524 |
- qemu_input_queue_event(&kbd_queue, src, evt); |
525 |
- qemu_input_queue_sync(&kbd_queue); |
526 |
- } |
527 |
-@@ -409,8 +415,10 @@ void qemu_input_event_send_key_delay(uint32_t delay_ms) |
528 |
- kbd_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, qemu_input_queue_process, |
529 |
- &kbd_queue); |
530 |
- } |
531 |
-- qemu_input_queue_delay(&kbd_queue, kbd_timer, |
532 |
-- delay_ms ? delay_ms : kbd_default_delay_ms); |
533 |
-+ if (queue_count < queue_limit) { |
534 |
-+ qemu_input_queue_delay(&kbd_queue, kbd_timer, |
535 |
-+ delay_ms ? delay_ms : kbd_default_delay_ms); |
536 |
-+ } |
537 |
- } |
538 |
- |
539 |
- InputEvent *qemu_input_event_new_btn(InputButton btn, bool down) |
540 |
--- |
541 |
-2.9.3 |
542 |
|
543 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8380.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8380.patch |
544 |
deleted file mode 100644 |
545 |
index 08911dd0bfb..00000000000 |
546 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-8380.patch |
547 |
+++ /dev/null |
548 |
@@ -1,34 +0,0 @@ |
549 |
-bug #616874 |
550 |
- |
551 |
-https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04147.html |
552 |
---- |
553 |
- hw/scsi/megasas.c | 10 +++++----- |
554 |
- 1 file changed, 5 insertions(+), 5 deletions(-) |
555 |
- |
556 |
-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c |
557 |
-index 84b8caf..804122a 100644 |
558 |
---- a/hw/scsi/megasas.c |
559 |
-+++ b/hw/scsi/megasas.c |
560 |
-@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, |
561 |
- case MFI_SEQ: |
562 |
- trace_megasas_mmio_writel("MFI_SEQ", val); |
563 |
- /* Magic sequence to start ADP reset */ |
564 |
-- if (adp_reset_seq[s->adp_reset] == val) { |
565 |
-- s->adp_reset++; |
566 |
-+ if (adp_reset_seq[s->adp_reset++] == val) { |
567 |
-+ if (s->adp_reset == 6) { |
568 |
-+ s->adp_reset = 0; |
569 |
-+ s->diag = MFI_DIAG_WRITE_ENABLE; |
570 |
-+ } |
571 |
- } else { |
572 |
- s->adp_reset = 0; |
573 |
- s->diag = 0; |
574 |
- } |
575 |
-- if (s->adp_reset == 6) { |
576 |
-- s->diag = MFI_DIAG_WRITE_ENABLE; |
577 |
-- } |
578 |
- break; |
579 |
- case MFI_DIAG: |
580 |
- trace_megasas_mmio_writel("MFI_DIAG", val); |
581 |
--- |
582 |
-2.9.3 |
583 |
|
584 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-1.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-1.patch |
585 |
deleted file mode 100644 |
586 |
index 01c81d10ec0..00000000000 |
587 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-1.patch |
588 |
+++ /dev/null |
589 |
@@ -1,122 +0,0 @@ |
590 |
-From 87e459a810d7b1ec1638085b5a80ea3d9b43119a Mon Sep 17 00:00:00 2001 |
591 |
-From: Paolo Bonzini <pbonzini@××××××.com> |
592 |
-Date: Thu, 1 Jun 2017 17:26:14 +0200 |
593 |
-Subject: [PATCH] megasas: always store SCSIRequest* into MegasasCmd |
594 |
- |
595 |
-This ensures that the request is unref'ed properly, and avoids a |
596 |
-segmentation fault in the new qtest testcase that is added. |
597 |
-This is CVE-2017-9503. |
598 |
- |
599 |
-Reported-by: Zhangyanyu <zyy4013@×××××××××××.cn> |
600 |
-Signed-off-by: Paolo Bonzini <pbonzini@××××××.com> |
601 |
---- |
602 |
- hw/scsi/megasas.c | 31 ++++++++++++++++--------------- |
603 |
- 2 files changed, 51 insertions(+), 15 deletions(-) |
604 |
- |
605 |
-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c |
606 |
-index 135662df31..734fdaef90 100644 |
607 |
---- a/hw/scsi/megasas.c |
608 |
-+++ b/hw/scsi/megasas.c |
609 |
-@@ -609,6 +609,9 @@ static void megasas_reset_frames(MegasasState *s) |
610 |
- static void megasas_abort_command(MegasasCmd *cmd) |
611 |
- { |
612 |
- /* Never abort internal commands. */ |
613 |
-+ if (cmd->dcmd_opcode != -1) { |
614 |
-+ return; |
615 |
-+ } |
616 |
- if (cmd->req != NULL) { |
617 |
- scsi_req_cancel(cmd->req); |
618 |
- } |
619 |
-@@ -1017,7 +1020,6 @@ static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun, |
620 |
- uint64_t pd_size; |
621 |
- uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF); |
622 |
- uint8_t cmdbuf[6]; |
623 |
-- SCSIRequest *req; |
624 |
- size_t len, resid; |
625 |
- |
626 |
- if (!cmd->iov_buf) { |
627 |
-@@ -1026,8 +1028,8 @@ static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun, |
628 |
- info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */ |
629 |
- info->vpd_page83[0] = 0x7f; |
630 |
- megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data)); |
631 |
-- req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd); |
632 |
-- if (!req) { |
633 |
-+ cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd); |
634 |
-+ if (!cmd->req) { |
635 |
- trace_megasas_dcmd_req_alloc_failed(cmd->index, |
636 |
- "PD get info std inquiry"); |
637 |
- g_free(cmd->iov_buf); |
638 |
-@@ -1036,26 +1038,26 @@ static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun, |
639 |
- } |
640 |
- trace_megasas_dcmd_internal_submit(cmd->index, |
641 |
- "PD get info std inquiry", lun); |
642 |
-- len = scsi_req_enqueue(req); |
643 |
-+ len = scsi_req_enqueue(cmd->req); |
644 |
- if (len > 0) { |
645 |
- cmd->iov_size = len; |
646 |
-- scsi_req_continue(req); |
647 |
-+ scsi_req_continue(cmd->req); |
648 |
- } |
649 |
- return MFI_STAT_INVALID_STATUS; |
650 |
- } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) { |
651 |
- megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83)); |
652 |
-- req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd); |
653 |
-- if (!req) { |
654 |
-+ cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd); |
655 |
-+ if (!cmd->req) { |
656 |
- trace_megasas_dcmd_req_alloc_failed(cmd->index, |
657 |
- "PD get info vpd inquiry"); |
658 |
- return MFI_STAT_FLASH_ALLOC_FAIL; |
659 |
- } |
660 |
- trace_megasas_dcmd_internal_submit(cmd->index, |
661 |
- "PD get info vpd inquiry", lun); |
662 |
-- len = scsi_req_enqueue(req); |
663 |
-+ len = scsi_req_enqueue(cmd->req); |
664 |
- if (len > 0) { |
665 |
- cmd->iov_size = len; |
666 |
-- scsi_req_continue(req); |
667 |
-+ scsi_req_continue(cmd->req); |
668 |
- } |
669 |
- return MFI_STAT_INVALID_STATUS; |
670 |
- } |
671 |
-@@ -1217,7 +1219,6 @@ static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun, |
672 |
- struct mfi_ld_info *info = cmd->iov_buf; |
673 |
- size_t dcmd_size = sizeof(struct mfi_ld_info); |
674 |
- uint8_t cdb[6]; |
675 |
-- SCSIRequest *req; |
676 |
- ssize_t len, resid; |
677 |
- uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF); |
678 |
- uint64_t ld_size; |
679 |
-@@ -1226,8 +1227,8 @@ static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun, |
680 |
- cmd->iov_buf = g_malloc0(dcmd_size); |
681 |
- info = cmd->iov_buf; |
682 |
- megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83)); |
683 |
-- req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd); |
684 |
-- if (!req) { |
685 |
-+ cmd->req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd); |
686 |
-+ if (!cmd->req) { |
687 |
- trace_megasas_dcmd_req_alloc_failed(cmd->index, |
688 |
- "LD get info vpd inquiry"); |
689 |
- g_free(cmd->iov_buf); |
690 |
-@@ -1236,10 +1237,10 @@ static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun, |
691 |
- } |
692 |
- trace_megasas_dcmd_internal_submit(cmd->index, |
693 |
- "LD get info vpd inquiry", lun); |
694 |
-- len = scsi_req_enqueue(req); |
695 |
-+ len = scsi_req_enqueue(cmd->req); |
696 |
- if (len > 0) { |
697 |
- cmd->iov_size = len; |
698 |
-- scsi_req_continue(req); |
699 |
-+ scsi_req_continue(cmd->req); |
700 |
- } |
701 |
- return MFI_STAT_INVALID_STATUS; |
702 |
- } |
703 |
-@@ -1851,7 +1852,7 @@ static void megasas_command_complete(SCSIRequest *req, uint32_t status, |
704 |
- return; |
705 |
- } |
706 |
- |
707 |
-- if (cmd->req == NULL) { |
708 |
-+ if (cmd->dcmd_opcode != -1) { |
709 |
- /* |
710 |
- * Internal command complete |
711 |
- */ |
712 |
|
713 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-2.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-2.patch |
714 |
deleted file mode 100644 |
715 |
index 74725a92736..00000000000 |
716 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9503-2.patch |
717 |
+++ /dev/null |
718 |
@@ -1,114 +0,0 @@ |
719 |
-From 5104fac8539eaf155fc6de93e164be43e1e62242 Mon Sep 17 00:00:00 2001 |
720 |
-From: Paolo Bonzini <pbonzini@××××××.com> |
721 |
-Date: Thu, 1 Jun 2017 17:18:23 +0200 |
722 |
-Subject: [PATCH] megasas: do not read DCMD opcode more than once from frame |
723 |
- |
724 |
-Avoid TOC-TOU bugs by storing the DCMD opcode in the MegasasCmd |
725 |
- |
726 |
-Signed-off-by: Paolo Bonzini <pbonzini@××××××.com> |
727 |
---- |
728 |
- hw/scsi/megasas.c | 25 +++++++++++-------------- |
729 |
- 1 file changed, 11 insertions(+), 14 deletions(-) |
730 |
- |
731 |
-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c |
732 |
-index c353118882..a3f75c1650 100644 |
733 |
---- a/hw/scsi/megasas.c |
734 |
-+++ b/hw/scsi/megasas.c |
735 |
-@@ -63,6 +63,7 @@ typedef struct MegasasCmd { |
736 |
- |
737 |
- hwaddr pa; |
738 |
- hwaddr pa_size; |
739 |
-+ uint32_t dcmd_opcode; |
740 |
- union mfi_frame *frame; |
741 |
- SCSIRequest *req; |
742 |
- QEMUSGList qsg; |
743 |
-@@ -513,6 +514,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s, |
744 |
- cmd->context &= (uint64_t)0xFFFFFFFF; |
745 |
- } |
746 |
- cmd->count = count; |
747 |
-+ cmd->dcmd_opcode = -1; |
748 |
- s->busy++; |
749 |
- |
750 |
- if (s->consumer_pa) { |
751 |
-@@ -1562,22 +1564,21 @@ static const struct dcmd_cmd_tbl_t { |
752 |
- |
753 |
- static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd) |
754 |
- { |
755 |
-- int opcode; |
756 |
- int retval = 0; |
757 |
- size_t len; |
758 |
- const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl; |
759 |
- |
760 |
-- opcode = le32_to_cpu(cmd->frame->dcmd.opcode); |
761 |
-- trace_megasas_handle_dcmd(cmd->index, opcode); |
762 |
-+ cmd->dcmd_opcode = le32_to_cpu(cmd->frame->dcmd.opcode); |
763 |
-+ trace_megasas_handle_dcmd(cmd->index, cmd->dcmd_opcode); |
764 |
- if (megasas_map_dcmd(s, cmd) < 0) { |
765 |
- return MFI_STAT_MEMORY_NOT_AVAILABLE; |
766 |
- } |
767 |
-- while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) { |
768 |
-+ while (cmdptr->opcode != -1 && cmdptr->opcode != cmd->dcmd_opcode) { |
769 |
- cmdptr++; |
770 |
- } |
771 |
- len = cmd->iov_size; |
772 |
- if (cmdptr->opcode == -1) { |
773 |
-- trace_megasas_dcmd_unhandled(cmd->index, opcode, len); |
774 |
-+ trace_megasas_dcmd_unhandled(cmd->index, cmd->dcmd_opcode, len); |
775 |
- retval = megasas_dcmd_dummy(s, cmd); |
776 |
- } else { |
777 |
- trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len); |
778 |
-@@ -1592,13 +1593,11 @@ static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd) |
779 |
- static int megasas_finish_internal_dcmd(MegasasCmd *cmd, |
780 |
- SCSIRequest *req) |
781 |
- { |
782 |
-- int opcode; |
783 |
- int retval = MFI_STAT_OK; |
784 |
- int lun = req->lun; |
785 |
- |
786 |
-- opcode = le32_to_cpu(cmd->frame->dcmd.opcode); |
787 |
-- trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun); |
788 |
-- switch (opcode) { |
789 |
-+ trace_megasas_dcmd_internal_finish(cmd->index, cmd->dcmd_opcode, lun); |
790 |
-+ switch (cmd->dcmd_opcode) { |
791 |
- case MFI_DCMD_PD_GET_INFO: |
792 |
- retval = megasas_pd_get_info_submit(req->dev, lun, cmd); |
793 |
- break; |
794 |
-@@ -1606,7 +1605,7 @@ static int megasas_finish_internal_dcmd(MegasasCmd *cmd, |
795 |
- retval = megasas_ld_get_info_submit(req->dev, lun, cmd); |
796 |
- break; |
797 |
- default: |
798 |
-- trace_megasas_dcmd_internal_invalid(cmd->index, opcode); |
799 |
-+ trace_megasas_dcmd_internal_invalid(cmd->index, cmd->dcmd_opcode); |
800 |
- retval = MFI_STAT_INVALID_DCMD; |
801 |
- break; |
802 |
- } |
803 |
-@@ -1827,7 +1826,6 @@ static void megasas_xfer_complete(SCSIRequest *req, uint32_t len) |
804 |
- { |
805 |
- MegasasCmd *cmd = req->hba_private; |
806 |
- uint8_t *buf; |
807 |
-- uint32_t opcode; |
808 |
- |
809 |
- trace_megasas_io_complete(cmd->index, len); |
810 |
- |
811 |
-@@ -1837,8 +1835,7 @@ static void megasas_xfer_complete(SCSIRequest *req, uint32_t len) |
812 |
- } |
813 |
- |
814 |
- buf = scsi_req_get_buf(req); |
815 |
-- opcode = le32_to_cpu(cmd->frame->dcmd.opcode); |
816 |
-- if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) { |
817 |
-+ if (cmd->dcmd_opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) { |
818 |
- struct mfi_pd_info *info = cmd->iov_buf; |
819 |
- |
820 |
- if (info->inquiry_data[0] == 0x7f) { |
821 |
-@@ -1849,7 +1846,7 @@ static void megasas_xfer_complete(SCSIRequest *req, uint32_t len) |
822 |
- memcpy(info->vpd_page83, buf, len); |
823 |
- } |
824 |
- scsi_req_continue(req); |
825 |
-- } else if (opcode == MFI_DCMD_LD_GET_INFO) { |
826 |
-+ } else if (cmd->dcmd_opcode == MFI_DCMD_LD_GET_INFO) { |
827 |
- struct mfi_ld_info *info = cmd->iov_buf; |
828 |
- |
829 |
- if (cmd->iov_buf) { |
830 |
--- |
831 |
-2.13.0 |
832 |
- |
833 |
|
834 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-1.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-1.patch |
835 |
deleted file mode 100644 |
836 |
index 9d77193b1f6..00000000000 |
837 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-1.patch |
838 |
+++ /dev/null |
839 |
@@ -1,80 +0,0 @@ |
840 |
-From df8ad9f128c15aa0a0ebc7b24e9a22c9775b67af Mon Sep 17 00:00:00 2001 |
841 |
-From: Eric Blake <eblake@××××××.com> |
842 |
-Date: Fri, 26 May 2017 22:04:21 -0500 |
843 |
-Subject: [PATCH] nbd: Fully initialize client in case of failed negotiation |
844 |
- |
845 |
-If a non-NBD client connects to qemu-nbd, we would end up with |
846 |
-a SIGSEGV in nbd_client_put() because we were trying to |
847 |
-unregister the client's association to the export, even though |
848 |
-we skipped inserting the client into that list. Easy trigger |
849 |
-in two terminals: |
850 |
- |
851 |
-$ qemu-nbd -p 30001 --format=raw file |
852 |
-$ nmap 127.0.0.1 -p 30001 |
853 |
- |
854 |
-nmap claims that it thinks it connected to a pago-services1 |
855 |
-server (which probably means nmap could be updated to learn the |
856 |
-NBD protocol and give a more accurate diagnosis of the open |
857 |
-port - but that's not our problem), then terminates immediately, |
858 |
-so our call to nbd_negotiate() fails. The fix is to reorder |
859 |
-nbd_co_client_start() to ensure that all initialization occurs |
860 |
-before we ever try talking to a client in nbd_negotiate(), so |
861 |
-that the teardown sequence on negotiation failure doesn't fault |
862 |
-while dereferencing a half-initialized object. |
863 |
- |
864 |
-While debugging this, I also noticed that nbd_update_server_watch() |
865 |
-called by nbd_client_closed() was still adding a channel to accept |
866 |
-the next client, even when the state was no longer RUNNING. That |
867 |
-is fixed by making nbd_can_accept() pay attention to the current |
868 |
-state. |
869 |
- |
870 |
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1451614 |
871 |
- |
872 |
-Signed-off-by: Eric Blake <eblake@××××××.com> |
873 |
-Message-Id: <20170527030421.28366-1-eblake@××××××.com> |
874 |
-Signed-off-by: Paolo Bonzini <pbonzini@××××××.com> |
875 |
---- |
876 |
- nbd/server.c | 8 +++----- |
877 |
- qemu-nbd.c | 2 +- |
878 |
- 2 files changed, 4 insertions(+), 6 deletions(-) |
879 |
- |
880 |
-diff --git a/nbd/server.c b/nbd/server.c |
881 |
-index ee59e5d234..49b55f6ede 100644 |
882 |
---- a/nbd/server.c |
883 |
-+++ b/nbd/server.c |
884 |
-@@ -1358,16 +1358,14 @@ static coroutine_fn void nbd_co_client_start(void *opaque) |
885 |
- |
886 |
- if (exp) { |
887 |
- nbd_export_get(exp); |
888 |
-+ QTAILQ_INSERT_TAIL(&exp->clients, client, next); |
889 |
- } |
890 |
-+ qemu_co_mutex_init(&client->send_lock); |
891 |
-+ |
892 |
- if (nbd_negotiate(data)) { |
893 |
- client_close(client); |
894 |
- goto out; |
895 |
- } |
896 |
-- qemu_co_mutex_init(&client->send_lock); |
897 |
-- |
898 |
-- if (exp) { |
899 |
-- QTAILQ_INSERT_TAIL(&exp->clients, client, next); |
900 |
-- } |
901 |
- |
902 |
- nbd_client_receive_next_request(client); |
903 |
- |
904 |
-diff --git a/qemu-nbd.c b/qemu-nbd.c |
905 |
-index f60842fd86..651f85ecc1 100644 |
906 |
---- a/qemu-nbd.c |
907 |
-+++ b/qemu-nbd.c |
908 |
-@@ -325,7 +325,7 @@ out: |
909 |
- |
910 |
- static int nbd_can_accept(void) |
911 |
- { |
912 |
-- return nb_fds < shared; |
913 |
-+ return state == RUNNING && nb_fds < shared; |
914 |
- } |
915 |
- |
916 |
- static void nbd_export_closed(NBDExport *exp) |
917 |
--- |
918 |
-2.13.0 |
919 |
- |
920 |
|
921 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-2.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-2.patch |
922 |
deleted file mode 100644 |
923 |
index e6934b379a2..00000000000 |
924 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-9524-2.patch |
925 |
+++ /dev/null |
926 |
@@ -1,197 +0,0 @@ |
927 |
-From 0c9390d978cbf61e8f16c9f580fa96b305c43568 Mon Sep 17 00:00:00 2001 |
928 |
-From: Eric Blake <eblake@××××××.com> |
929 |
-Date: Thu, 8 Jun 2017 17:26:17 -0500 |
930 |
-Subject: [PATCH] nbd: Fix regression on resiliency to port scan |
931 |
- |
932 |
-Back in qemu 2.5, qemu-nbd was immune to port probes (a transient |
933 |
-server would not quit, regardless of how many probe connections |
934 |
-came and went, until a connection actually negotiated). But we |
935 |
-broke that in commit ee7d7aa when removing the return value to |
936 |
-nbd_client_new(), although that patch also introduced a bug causing |
937 |
-an assertion failure on a client that fails negotiation. We then |
938 |
-made it worse during refactoring in commit 1a6245a (a segfault |
939 |
-before we could even assert); the (masked) assertion was cleaned |
940 |
-up in d3780c2 (still in 2.6), and just recently we finally fixed |
941 |
-the segfault ("nbd: Fully intialize client in case of failed |
942 |
-negotiation"). But that still means that ever since we added |
943 |
-TLS support to qemu-nbd, we have been vulnerable to an ill-timed |
944 |
-port-scan being able to cause a denial of service by taking down |
945 |
-qemu-nbd before a real client has a chance to connect. |
946 |
- |
947 |
-Since negotiation is now handled asynchronously via coroutines, |
948 |
-we no longer have a synchronous point of return by re-adding a |
949 |
-return value to nbd_client_new(). So this patch instead wires |
950 |
-things up to pass the negotiation status through the close_fn |
951 |
-callback function. |
952 |
- |
953 |
-Simple test across two terminals: |
954 |
-$ qemu-nbd -f raw -p 30001 file |
955 |
-$ nmap 127.0.0.1 -p 30001 && \ |
956 |
- qemu-io -c 'r 0 512' -f raw nbd://localhost:30001 |
957 |
- |
958 |
-Note that this patch does not change what constitutes successful |
959 |
-negotiation (thus, a client must enter transmission phase before |
960 |
-that client can be considered as a reason to terminate the server |
961 |
-when the connection ends). Perhaps we may want to tweak things |
962 |
-in a later patch to also treat a client that uses NBD_OPT_ABORT |
963 |
-as being a 'successful' negotiation (the client correctly talked |
964 |
-the NBD protocol, and informed us it was not going to use our |
965 |
-export after all), but that's a discussion for another day. |
966 |
- |
967 |
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1451614 |
968 |
- |
969 |
-Signed-off-by: Eric Blake <eblake@××××××.com> |
970 |
-Message-Id: <20170608222617.20376-1-eblake@××××××.com> |
971 |
-Signed-off-by: Paolo Bonzini <pbonzini@××××××.com> |
972 |
---- |
973 |
- blockdev-nbd.c | 6 +++++- |
974 |
- include/block/nbd.h | 2 +- |
975 |
- nbd/server.c | 24 +++++++++++++++--------- |
976 |
- qemu-nbd.c | 4 ++-- |
977 |
- 4 files changed, 23 insertions(+), 13 deletions(-) |
978 |
- |
979 |
-diff --git a/blockdev-nbd.c b/blockdev-nbd.c |
980 |
-index dd0860f4a6..28f551a7b0 100644 |
981 |
---- a/blockdev-nbd.c |
982 |
-+++ b/blockdev-nbd.c |
983 |
-@@ -27,6 +27,10 @@ typedef struct NBDServerData { |
984 |
- |
985 |
- static NBDServerData *nbd_server; |
986 |
- |
987 |
-+static void nbd_blockdev_client_closed(NBDClient *client, bool ignored) |
988 |
-+{ |
989 |
-+ nbd_client_put(client); |
990 |
-+} |
991 |
- |
992 |
- static gboolean nbd_accept(QIOChannel *ioc, GIOCondition condition, |
993 |
- gpointer opaque) |
994 |
-@@ -46,7 +50,7 @@ static gboolean nbd_accept(QIOChannel *ioc, GIOCondition condition, |
995 |
- qio_channel_set_name(QIO_CHANNEL(cioc), "nbd-server"); |
996 |
- nbd_client_new(NULL, cioc, |
997 |
- nbd_server->tlscreds, NULL, |
998 |
-- nbd_client_put); |
999 |
-+ nbd_blockdev_client_closed); |
1000 |
- object_unref(OBJECT(cioc)); |
1001 |
- return TRUE; |
1002 |
- } |
1003 |
-diff --git a/include/block/nbd.h b/include/block/nbd.h |
1004 |
-index 416257abca..8fa5ce51f3 100644 |
1005 |
---- a/include/block/nbd.h |
1006 |
-+++ b/include/block/nbd.h |
1007 |
-@@ -162,7 +162,7 @@ void nbd_client_new(NBDExport *exp, |
1008 |
- QIOChannelSocket *sioc, |
1009 |
- QCryptoTLSCreds *tlscreds, |
1010 |
- const char *tlsaclname, |
1011 |
-- void (*close)(NBDClient *)); |
1012 |
-+ void (*close_fn)(NBDClient *, bool)); |
1013 |
- void nbd_client_get(NBDClient *client); |
1014 |
- void nbd_client_put(NBDClient *client); |
1015 |
- |
1016 |
-diff --git a/nbd/server.c b/nbd/server.c |
1017 |
-index 49b55f6ede..f2b1aa47ce 100644 |
1018 |
---- a/nbd/server.c |
1019 |
-+++ b/nbd/server.c |
1020 |
-@@ -81,7 +81,7 @@ static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports); |
1021 |
- |
1022 |
- struct NBDClient { |
1023 |
- int refcount; |
1024 |
-- void (*close)(NBDClient *client); |
1025 |
-+ void (*close_fn)(NBDClient *client, bool negotiated); |
1026 |
- |
1027 |
- bool no_zeroes; |
1028 |
- NBDExport *exp; |
1029 |
-@@ -778,7 +778,7 @@ void nbd_client_put(NBDClient *client) |
1030 |
- } |
1031 |
- } |
1032 |
- |
1033 |
--static void client_close(NBDClient *client) |
1034 |
-+static void client_close(NBDClient *client, bool negotiated) |
1035 |
- { |
1036 |
- if (client->closing) { |
1037 |
- return; |
1038 |
-@@ -793,8 +793,8 @@ static void client_close(NBDClient *client) |
1039 |
- NULL); |
1040 |
- |
1041 |
- /* Also tell the client, so that they release their reference. */ |
1042 |
-- if (client->close) { |
1043 |
-- client->close(client); |
1044 |
-+ if (client->close_fn) { |
1045 |
-+ client->close_fn(client, negotiated); |
1046 |
- } |
1047 |
- } |
1048 |
- |
1049 |
-@@ -975,7 +975,7 @@ void nbd_export_close(NBDExport *exp) |
1050 |
- |
1051 |
- nbd_export_get(exp); |
1052 |
- QTAILQ_FOREACH_SAFE(client, &exp->clients, next, next) { |
1053 |
-- client_close(client); |
1054 |
-+ client_close(client, true); |
1055 |
- } |
1056 |
- nbd_export_set_name(exp, NULL); |
1057 |
- nbd_export_set_description(exp, NULL); |
1058 |
-@@ -1337,7 +1337,7 @@ done: |
1059 |
- |
1060 |
- out: |
1061 |
- nbd_request_put(req); |
1062 |
-- client_close(client); |
1063 |
-+ client_close(client, true); |
1064 |
- nbd_client_put(client); |
1065 |
- } |
1066 |
- |
1067 |
-@@ -1363,7 +1363,7 @@ static coroutine_fn void nbd_co_client_start(void *opaque) |
1068 |
- qemu_co_mutex_init(&client->send_lock); |
1069 |
- |
1070 |
- if (nbd_negotiate(data)) { |
1071 |
-- client_close(client); |
1072 |
-+ client_close(client, false); |
1073 |
- goto out; |
1074 |
- } |
1075 |
- |
1076 |
-@@ -1373,11 +1373,17 @@ out: |
1077 |
- g_free(data); |
1078 |
- } |
1079 |
- |
1080 |
-+/* |
1081 |
-+ * Create a new client listener on the given export @exp, using the |
1082 |
-+ * given channel @sioc. Begin servicing it in a coroutine. When the |
1083 |
-+ * connection closes, call @close_fn with an indication of whether the |
1084 |
-+ * client completed negotiation. |
1085 |
-+ */ |
1086 |
- void nbd_client_new(NBDExport *exp, |
1087 |
- QIOChannelSocket *sioc, |
1088 |
- QCryptoTLSCreds *tlscreds, |
1089 |
- const char *tlsaclname, |
1090 |
-- void (*close_fn)(NBDClient *)) |
1091 |
-+ void (*close_fn)(NBDClient *, bool)) |
1092 |
- { |
1093 |
- NBDClient *client; |
1094 |
- NBDClientNewData *data = g_new(NBDClientNewData, 1); |
1095 |
-@@ -1394,7 +1400,7 @@ void nbd_client_new(NBDExport *exp, |
1096 |
- object_ref(OBJECT(client->sioc)); |
1097 |
- client->ioc = QIO_CHANNEL(sioc); |
1098 |
- object_ref(OBJECT(client->ioc)); |
1099 |
-- client->close = close_fn; |
1100 |
-+ client->close_fn = close_fn; |
1101 |
- |
1102 |
- data->client = client; |
1103 |
- data->co = qemu_coroutine_create(nbd_co_client_start, data); |
1104 |
-diff --git a/qemu-nbd.c b/qemu-nbd.c |
1105 |
-index 651f85ecc1..9464a0461c 100644 |
1106 |
---- a/qemu-nbd.c |
1107 |
-+++ b/qemu-nbd.c |
1108 |
-@@ -336,10 +336,10 @@ static void nbd_export_closed(NBDExport *exp) |
1109 |
- |
1110 |
- static void nbd_update_server_watch(void); |
1111 |
- |
1112 |
--static void nbd_client_closed(NBDClient *client) |
1113 |
-+static void nbd_client_closed(NBDClient *client, bool negotiated) |
1114 |
- { |
1115 |
- nb_fds--; |
1116 |
-- if (nb_fds == 0 && !persistent && state == RUNNING) { |
1117 |
-+ if (negotiated && nb_fds == 0 && !persistent && state == RUNNING) { |
1118 |
- state = TERMINATE; |
1119 |
- } |
1120 |
- nbd_update_server_watch(); |
1121 |
--- |
1122 |
-2.13.0 |
1123 |
- |