From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 337EA139085 for ; Thu, 29 Dec 2016 20:09:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 8D957E0C2B; Thu, 29 Dec 2016 20:09:12 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5F8DEE0C2B for ; Thu, 29 Dec 2016 20:09:12 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 56EBF34168E for ; Thu, 29 Dec 2016 20:09:11 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id BB54124E7 for ; Thu, 29 Dec 2016 20:09:09 +0000 (UTC) From: "Mike Frysinger" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Frysinger" Message-ID: <1483041908.538fed1c866f2b1ef17d97295a06bd666e828d6f.vapier@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-emulation/qemu/, app-emulation/qemu/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-emulation/qemu/Manifest app-emulation/qemu/files/qemu-2.8.0-CVE-2016-10028.patch app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9908.patch app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9912.patch app-emulation/qemu/qemu-2.8.0.ebuild app-emulation/qemu/qemu-9999.ebuild X-VCS-Directories: app-emulation/qemu/ app-emulation/qemu/files/ X-VCS-Committer: vapier X-VCS-Committer-Name: Mike Frysinger X-VCS-Revision: 538fed1c866f2b1ef17d97295a06bd666e828d6f X-VCS-Branch: master Date: Thu, 29 Dec 2016 20:09:09 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 739b98e8-f630-46de-acd0-67a03dc523df X-Archives-Hash: 25760c4b531ae54e0f61b05e1f110f87 commit: 538fed1c866f2b1ef17d97295a06bd666e828d6f Author: Mike Frysinger gentoo org> AuthorDate: Thu Dec 29 18:20:31 2016 +0000 Commit: Mike Frysinger gentoo org> CommitDate: Thu Dec 29 20:05:08 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=538fed1c app-emulation/qemu: version bump to 2.8.0 app-emulation/qemu/Manifest | 1 + .../qemu/files/qemu-2.8.0-CVE-2016-10028.patch | 40 ++++++++++++++++++++++ .../qemu/files/qemu-2.8.0-CVE-2016-9908.patch | 35 +++++++++++++++++++ .../qemu/files/qemu-2.8.0-CVE-2016-9912.patch | 38 ++++++++++++++++++++ .../qemu/{qemu-9999.ebuild => qemu-2.8.0.ebuild} | 6 +++- app-emulation/qemu/qemu-9999.ebuild | 2 +- 6 files changed, 120 insertions(+), 2 deletions(-) diff --git a/app-emulation/qemu/Manifest b/app-emulation/qemu/Manifest index 5d40bbd..46537bc 100644 --- a/app-emulation/qemu/Manifest +++ b/app-emulation/qemu/Manifest @@ -1,2 +1,3 @@ DIST qemu-2.7.0.tar.bz2 26867760 SHA256 326e739506ba690daf69fc17bd3913a6c313d9928d743bd8eddb82f403f81e53 SHA512 654acaa7b3724a288e5d7e2a26ab780d9c9ed9f647fba00a906cbaffbe9d58fd666f2d962514aa2c5b391b4c53811ac3170d2eb51727f090bd19dfe45ca9a9db WHIRLPOOL dcb3e5f7da89dd8e14d636d7ebd476e076e0043880bb9ea3fb1c03cb4bcd4e5c7d3c4719da26c3ce521e3a3db5ae671e86f198ac1bc3474e774d75504fef8b8d DIST qemu-2.7.1.tar.bz2 26868403 SHA256 68636788eb69bcb0b44ba220b32b50495d6bd5712a934c282217831c4822958f SHA512 16a83946e9064733254c82c961749bf9c56a0a2a8ee46145b4a78e1452ac0e2548d888963d18c80e28f65202890fd643b0011951b5b1c66ef16234767ed91898 WHIRLPOOL ae3d3c2b2a3700613733659847de6187755631cb09e8c3548ea30cd994357c9ff128646edce88dfe4dce53e6c1c0f37f8de3688ee7e22262033b40f3fc706efa +DIST qemu-2.8.0.tar.bz2 28368517 SHA256 dafd5d7f649907b6b617b822692f4c82e60cf29bc0fc58bc2036219b591e5e62 SHA512 50f2988d822388ba9fd1bf5dbe68359033ed7432d7f0f9790299f32f63faa6dc72979256b5632ba572d47ee3e74ed40e3e8e331dc6303ec1599f1b4367cb78c2 WHIRLPOOL 0ce4e0539657eb832e4039819e7360c792b6aa41c718f0e0d762f4933217f0d370af94b1d6d9776853575b4a6811d8c85db069bf09d21bd15399ac8b50440ff5 diff --git a/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-10028.patch b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-10028.patch new file mode 100644 index 00000000..466c819 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-10028.patch @@ -0,0 +1,40 @@ +https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.html +https://bugs.gentoo.org/603444 + +From: P J P +Subject: [Qemu-devel] [PATCH] display: virtio-gpu-3d: check virgl capabilities max_size +Date: Wed, 14 Dec 2016 12:31:56 +0530 +From: Prasad J Pandit + +Virtio GPU device while processing 'VIRTIO_GPU_CMD_GET_CAPSET' +command, retrieves the maximum capabilities size to fill in the +response object. It continues to fill in capabilities even if +retrieved 'max_size' is zero(0), thus resulting in OOB access. +Add check to avoid it. + +Reported-by: Zhenhao Hong +Signed-off-by: Prasad J Pandit +--- + hw/display/virtio-gpu-3d.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/hw/display/virtio-gpu-3d.c b/hw/display/virtio-gpu-3d.c +index 758d33a..6ceeba3 100644 +--- a/hw/display/virtio-gpu-3d.c ++++ b/hw/display/virtio-gpu-3d.c +@@ -370,8 +370,12 @@ static void virgl_cmd_get_capset(VirtIOGPU *g, + + virgl_renderer_get_cap_set(gc.capset_id, &max_ver, + &max_size); ++ if (!max_size) { ++ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; ++ return; ++ } ++ + resp = g_malloc0(sizeof(*resp) + max_size); +- + resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET; + virgl_renderer_fill_caps(gc.capset_id, + gc.capset_version, +-- +2.9.3 diff --git a/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9908.patch b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9908.patch new file mode 100644 index 00000000..841de65 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9908.patch @@ -0,0 +1,35 @@ +https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg00059.html +https://bugs.gentoo.org/601826 + +From: Li Qiang +Subject: [Qemu-devel] [PATCH] virtio-gpu: fix information leak in capset get dispatch +Date: Tue, 1 Nov 2016 05:37:57 -0700 +From: Li Qiang + +In virgl_cmd_get_capset function, it uses g_malloc to allocate +a response struct to the guest. As the 'resp'struct hasn't been full +initialized it will lead the 'resp->padding' field to the guest. +Use g_malloc0 to avoid this. + +Signed-off-by: Li Qiang +--- + hw/display/virtio-gpu-3d.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/display/virtio-gpu-3d.c b/hw/display/virtio-gpu-3d.c +index 23f39de..d98b140 100644 +--- a/hw/display/virtio-gpu-3d.c ++++ b/hw/display/virtio-gpu-3d.c +@@ -371,7 +371,7 @@ static void virgl_cmd_get_capset(VirtIOGPU *g, + + virgl_renderer_get_cap_set(gc.capset_id, &max_ver, + &max_size); +- resp = g_malloc(sizeof(*resp) + max_size); ++ resp = g_malloc0(sizeof(*resp) + max_size); + + resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET; + virgl_renderer_fill_caps(gc.capset_id, +-- +1.8.3.1 + + diff --git a/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9912.patch b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9912.patch new file mode 100644 index 00000000..55963f7 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.8.0-CVE-2016-9912.patch @@ -0,0 +1,38 @@ +https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05043.html +https://bugs.gentoo.org/602630 + +From: Li Qiang +Subject: [Qemu-devel] [PATCH] virtio-gpu: call cleanup mapping function in resource destroy +Date: Mon, 28 Nov 2016 21:29:25 -0500 +If the guest destroy the resource before detach banking, the 'iov' +and 'addrs' field in resource is not freed thus leading memory +leak issue. This patch avoid this. + +Signed-off-by: Li Qiang +--- + hw/display/virtio-gpu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index 60bce94..98dadf2 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -28,6 +28,8 @@ + static struct virtio_gpu_simple_resource* + virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id); + ++static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res); ++ + #ifdef CONFIG_VIRGL + #include + #define VIRGL(_g, _virgl, _simple, ...) \ +@@ -358,6 +360,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g, + struct virtio_gpu_simple_resource *res) + { + pixman_image_unref(res->image); ++ virtio_gpu_cleanup_mapping(res); + QTAILQ_REMOVE(&g->reslist, res, next); + g_free(res); + } +-- +1.8.3.1 diff --git a/app-emulation/qemu/qemu-9999.ebuild b/app-emulation/qemu/qemu-2.8.0.ebuild similarity index 98% copy from app-emulation/qemu/qemu-9999.ebuild copy to app-emulation/qemu/qemu-2.8.0.ebuild index 4859990..de01f6c 100644 --- a/app-emulation/qemu/qemu-9999.ebuild +++ b/app-emulation/qemu/qemu-2.8.0.ebuild @@ -142,7 +142,7 @@ USER_LIB_DEPEND="${COMMON_LIB_DEPEND}" X86_FIRMWARE_DEPEND=" >=sys-firmware/ipxe-1.0.0_p20130624 pin-upstream-blobs? ( - ~sys-firmware/seabios-1.8.2 + ~sys-firmware/seabios-1.10.1 ~sys-firmware/sgabios-0.1_pre8 ~sys-firmware/vgabios-0.7a ) @@ -333,6 +333,10 @@ src_prepare() { epatch "${FILESDIR}"/${PN}-2.5.0-cflags.patch epatch "${FILESDIR}"/${PN}-2.5.0-sysmacros.patch + epatch "${FILESDIR}"/${PN}-2.7.0-CVE-2016-8669-1.patch #597108 + epatch "${FILESDIR}"/${PN}-2.8.0-CVE-2016-9908.patch #601826 + epatch "${FILESDIR}"/${PN}-2.8.0-CVE-2016-9912.patch #602630 + epatch "${FILESDIR}"/${PN}-2.8.0-CVE-2016-10028.patch #603444 # Fix ld and objcopy being called directly tc-export AR LD OBJCOPY diff --git a/app-emulation/qemu/qemu-9999.ebuild b/app-emulation/qemu/qemu-9999.ebuild index 4859990..8b5b30c 100644 --- a/app-emulation/qemu/qemu-9999.ebuild +++ b/app-emulation/qemu/qemu-9999.ebuild @@ -142,7 +142,7 @@ USER_LIB_DEPEND="${COMMON_LIB_DEPEND}" X86_FIRMWARE_DEPEND=" >=sys-firmware/ipxe-1.0.0_p20130624 pin-upstream-blobs? ( - ~sys-firmware/seabios-1.8.2 + ~sys-firmware/seabios-1.10.1 ~sys-firmware/sgabios-0.1_pre8 ~sys-firmware/vgabios-0.7a )