summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Volkov <pva@gentoo.org>2008-05-12 23:59:21 +0000
committerPeter Volkov <pva@gentoo.org>2008-05-12 23:59:21 +0000
commitc96b06e1c2ff2544ba70e170967c7096cd669f9d (patch)
tree6c8200afbe9456973913fb3b2f3bce23d784c3c1 /app-emulation
parentStable for HPPA (bug #221063). (diff)
downloadgentoo-2-c96b06e1c2ff2544ba70e170967c7096cd669f9d.tar.gz
gentoo-2-c96b06e1c2ff2544ba70e170967c7096cd669f9d.tar.bz2
gentoo-2-c96b06e1c2ff2544ba70e170967c7096cd669f9d.zip
Updated patch for security bug #212351 to avoid qcow2 image regression. Filtering CFLAGS to allow building with gcc-3.4.
(Portage version: 2.1.4.4)
Diffstat (limited to 'app-emulation')
-rw-r--r--app-emulation/qemu-softmmu/ChangeLog10
-rw-r--r--app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch239
-rw-r--r--app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild128
3 files changed, 376 insertions, 1 deletions
diff --git a/app-emulation/qemu-softmmu/ChangeLog b/app-emulation/qemu-softmmu/ChangeLog
index eb4f54f6f74b..d09d3da851fc 100644
--- a/app-emulation/qemu-softmmu/ChangeLog
+++ b/app-emulation/qemu-softmmu/ChangeLog
@@ -1,6 +1,14 @@
# ChangeLog for app-emulation/qemu-softmmu
# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.49 2008/04/20 19:01:08 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.50 2008/05/12 23:59:20 pva Exp $
+
+*qemu-softmmu-0.9.1-r2 (12 May 2008)
+
+ 12 May 2008; Peter Volkov <pva@gentoo.org>
+ +files/qemu-softmmu-0.9.1-CVE-2008-0928.patch,
+ +qemu-softmmu-0.9.1-r2.ebuild:
+ Updated patch for security bug #212351 to avoid qcow2 image regression.
+ Filtering CFLAGS to allow building with gcc-3.4.
20 Apr 2008; Luca Barbato <lu_zero@gentoo.org>
qemu-softmmu-0.9.1-r1.ebuild:
diff --git a/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch
new file mode 100644
index 000000000000..ee410d64e713
--- /dev/null
+++ b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch
@@ -0,0 +1,239 @@
+https://bugzilla.redhat.com/show_bug.cgi?id=433560
+
+Revised block device address range patch
+
+The original patch adds checks to the main bdrv_XXX apis to validate that
+the I/O operation does not exceed the bounds of the disk - ie beyond the
+total_sectors count. This works correctly for bdrv_XXX calls from the IDE
+driver. With disk formats like QCow though, bdrv_XXX is re-entrant,
+because the QCow driver uses the block APIs for dealing with its underlying
+file. The problem is that QCow files are grow-on-demand, so writes will
+*explicitly* be beyond the end of the file. The original patch blocks any
+I/O operation which would cause the QCow file to grow, resulting it more
+or less catasatrophic data loss.
+
+Basically the bounds checking needs to distinguish between checking for
+the logical disk extents, vs the physical disk extents. For raw files
+these are the same so initial tests showed no problems, but for QCow
+format disks they are different & thus we see a problem
+
+What follows is a revised patch which introduces a flag BDRV_O_AUTOGROW
+which can be passed to bdrv_open to indicate that the files can be allowed
+to automatically extend their extents. This flag should only be used by
+internal block drivers such as block-qcow2.c, block-vmdk.c In my testing
+this has fixed the qcow corruption, and still maintains the goal of Ian's
+original patch which was to prevent the guest VM writing beyond the logical
+disk extents.
+
+diff -rup kvm-60.orig/qemu/block.c kvm-60.new/qemu/block.c
+--- kvm-60.orig/qemu/block.c 2008-02-26 18:44:28.000000000 -0500
++++ kvm-60.new/qemu/block.c 2008-02-26 18:44:52.000000000 -0500
+@@ -124,6 +124,60 @@ void path_combine(char *dest, int dest_s
+ }
+ }
+
++static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
++ int64_t sector_num, int nb_sectors)
++{
++ return
++ nb_sectors < 0 ||
++ sector_num < 0 ||
++ nb_sectors > bs->total_sectors ||
++ sector_num > bs->total_sectors - nb_sectors;
++}
++
++static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
++ int64_t offset, int count)
++{
++ int64_t size = bs->total_sectors << SECTOR_BITS;
++ return
++ count < 0 ||
++ size < 0 ||
++ count > size ||
++ offset > size - count;
++}
++
++static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
++ int64_t sector_num, int nb_sectors)
++{
++ if (sector_num < 0 ||
++ nb_sectors < 0)
++ return 1;
++
++ if (sector_num > bs->total_sectors - nb_sectors) {
++ if (bs->autogrow)
++ bs->total_sectors = sector_num + nb_sectors;
++ else
++ return 1;
++ }
++ return 0;
++}
++
++static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
++ int64_t offset, int count)
++{
++ int64_t size = bs->total_sectors << SECTOR_BITS;
++ if (count < 0 ||
++ offset < 0)
++ return 1;
++
++ if (offset > size - count) {
++ if (bs->autogrow)
++ bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
++ else
++ return 1;
++ }
++ return 0;
++}
++
+
+ static void bdrv_register(BlockDriver *bdrv)
+ {
+@@ -332,6 +386,10 @@ int bdrv_open2(BlockDriverState *bs, con
+ bs->read_only = 0;
+ bs->is_temporary = 0;
+ bs->encrypted = 0;
++ bs->autogrow = 0;
++
++ if (flags & BDRV_O_AUTOGROW)
++ bs->autogrow = 1;
+
+ if (flags & BDRV_O_SNAPSHOT) {
+ BlockDriverState *bs1;
+@@ -376,6 +434,7 @@ int bdrv_open2(BlockDriverState *bs, con
+ }
+ bs->drv = drv;
+ bs->opaque = qemu_mallocz(drv->instance_size);
++ bs->total_sectors = 0; /* driver will set if it does not do getlength */
+ if (bs->opaque == NULL && drv->instance_size > 0)
+ return -1;
+ /* Note: for compatibility, we open disk image files as RDWR, and
+@@ -441,6 +500,7 @@ void bdrv_close(BlockDriverState *bs)
+ bs->drv = NULL;
+
+ /* call the change callback */
++ bs->total_sectors = 0;
+ bs->media_changed = 1;
+ if (bs->change_cb)
+ bs->change_cb(bs->change_opaque);
+@@ -506,6 +566,8 @@ int bdrv_read(BlockDriverState *bs, int6
+ if (!drv)
+ return -ENOMEDIUM;
+
++ if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++ return -EDOM;
+ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+ memcpy(buf, bs->boot_sector_data, 512);
+ sector_num++;
+@@ -546,6 +608,8 @@ int bdrv_write(BlockDriverState *bs, int
+ return -ENOMEDIUM;
+ if (bs->read_only)
+ return -EACCES;
++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++ return -EDOM;
+ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+ memcpy(bs->boot_sector_data, buf, 512);
+ }
+@@ -671,6 +735,8 @@ int bdrv_pread(BlockDriverState *bs, int
+ return -ENOMEDIUM;
+ if (!drv->bdrv_pread)
+ return bdrv_pread_em(bs, offset, buf1, count1);
++ if (bdrv_rd_badreq_bytes(bs, offset, count1))
++ return -EDOM;
+ return drv->bdrv_pread(bs, offset, buf1, count1);
+ }
+
+@@ -686,6 +752,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
+ return -ENOMEDIUM;
+ if (!drv->bdrv_pwrite)
+ return bdrv_pwrite_em(bs, offset, buf1, count1);
++ if (bdrv_wr_badreq_bytes(bs, offset, count1))
++ return -EDOM;
+ return drv->bdrv_pwrite(bs, offset, buf1, count1);
+ }
+
+@@ -1091,6 +1159,8 @@ int bdrv_write_compressed(BlockDriverSta
+ return -ENOMEDIUM;
+ if (!drv->bdrv_write_compressed)
+ return -ENOTSUP;
++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++ return -EDOM;
+ return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+ }
+
+@@ -1237,6 +1307,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
+
+ if (!drv)
+ return NULL;
++ if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++ return NULL;
+
+ /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+@@ -1268,6 +1340,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
+ return NULL;
+ if (bs->read_only)
+ return NULL;
++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++ return NULL;
+ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+ memcpy(bs->boot_sector_data, buf, 512);
+ }
+diff -rup kvm-60.orig/qemu/block.h kvm-60.new/qemu/block.h
+--- kvm-60.orig/qemu/block.h 2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block.h 2008-02-26 18:44:52.000000000 -0500
+@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo {
+ it (default for
+ bdrv_file_open()) */
+ #define BDRV_O_DIRECT 0x0020
++#define BDRV_O_AUTOGROW 0x0040 /* Allow backing file to extend when writing past end of file */
+
+ #ifndef QEMU_IMG
+ void bdrv_info(void);
+diff -rup kvm-60.orig/qemu/block_int.h kvm-60.new/qemu/block_int.h
+--- kvm-60.orig/qemu/block_int.h 2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block_int.h 2008-02-26 18:44:52.000000000 -0500
+@@ -97,6 +97,7 @@ struct BlockDriverState {
+ int locked; /* if true, the media cannot temporarily be ejected */
+ int encrypted; /* if true, the media is encrypted */
+ int sg; /* if true, the device is a /dev/sg* */
++ int autogrow; /* if true, the backing store can auto-extend to allocate new extents */
+ /* event callback when inserting/removing */
+ void (*change_cb)(void *opaque);
+ void *change_opaque;
+diff -rup kvm-60.orig/qemu/block-qcow2.c kvm-60.new/qemu/block-qcow2.c
+--- kvm-60.orig/qemu/block-qcow2.c 2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow2.c 2008-02-26 18:44:52.000000000 -0500
+@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b
+ int len, i, shift, ret;
+ QCowHeader header;
+
+- ret = bdrv_file_open(&s->hd, filename, flags);
++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+ if (ret < 0)
+ return ret;
+ if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-qcow.c kvm-60.new/qemu/block-qcow.c
+--- kvm-60.orig/qemu/block-qcow.c 2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow.c 2008-02-26 18:44:52.000000000 -0500
+@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b
+ int len, i, shift, ret;
+ QCowHeader header;
+
+- ret = bdrv_file_open(&s->hd, filename, flags);
++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+ if (ret < 0)
+ return ret;
+ if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-vmdk.c kvm-60.new/qemu/block-vmdk.c
+--- kvm-60.orig/qemu/block-vmdk.c 2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-vmdk.c 2008-02-26 18:44:52.000000000 -0500
+@@ -375,7 +375,7 @@ static int vmdk_open(BlockDriverState *b
+ flags = BDRV_O_RDONLY;
+ fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename);
+
+- ret = bdrv_file_open(&s->hd, filename, flags);
++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+ if (ret < 0)
+ return ret;
+ if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
diff --git a/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild
new file mode 100644
index 000000000000..a457edc755b5
--- /dev/null
+++ b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild,v 1.1 2008/05/12 23:59:20 pva Exp $
+
+inherit eutils flag-o-matic toolchain-funcs
+
+DESCRIPTION="Multi-platform & multi-targets cpu emulator and dynamic translator"
+HOMEPAGE="http://fabrice.bellard.free.fr/qemu/"
+SRC_URI="${HOMEPAGE}${P/-softmmu/}.tar.gz"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="-alpha ~amd64 ~ppc -sparc ~x86"
+IUSE="sdl kqemu gnutls alsa"
+RESTRICT="binchecks test"
+
+DEPEND="virtual/libc
+ sys-libs/zlib
+ sdl? ( media-libs/libsdl )
+ !<=app-emulation/qemu-0.7.0
+ kqemu? ( >=app-emulation/kqemu-1.3.0_pre10 )
+ gnutls? (
+ dev-util/pkgconfig
+ net-libs/gnutls
+ )
+ app-text/texi2html"
+RDEPEND="sys-libs/zlib
+ sdl? ( media-libs/libsdl )
+ gnutls? ( net-libs/gnutls )
+ alsa? ( media-libs/alsa-lib )"
+
+S=${WORKDIR}/${P/-softmmu/}
+
+pkg_setup() {
+ if [ "$(gcc-major-version)" == "4" ]; then
+ eerror "qemu requires gcc-3 in order to build and work correctly"
+ eerror "please compile it switching to gcc-3."
+ eerror "We are aware that qemu can guess a gcc-3 but this feature"
+ eerror "could be harmful."
+ die "gcc 4 cannot build qemu"
+ fi
+}
+
+src_unpack() {
+ unpack ${A}
+
+ cd "${S}"
+ epatch "${FILESDIR}/${P}-CVE-2008-0928.patch" #212351
+ # Alter target makefiles to accept CFLAGS set via flag-o.
+ sed -i 's/^\(C\|OP_C\|HELPER_C\)FLAGS=/\1FLAGS+=/' \
+ Makefile Makefile.target tests/Makefile
+ # Ensure mprotect restrictions are relaxed for emulator binaries
+ [[ -x /sbin/paxctl ]] && \
+ sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
+ Makefile.target
+ # Prevent install of kernel module by qemu's makefile
+ sed -i 's/\(.\/install.sh\)/#\1/' Makefile
+ # avoid strip
+ sed -i 's:$(INSTALL) -m 755 -s:$(INSTALL) -m 755:' Makefile Makefile.target
+}
+
+src_compile() {
+ if use x86 ; then
+ # Force -march=pentium-mmx or lower. Fixes bug #212351.
+ local march
+ march=$(echo "${CFLAGS}" | sed 's:^.*-march=\([[:alnum:]-]\+\)\([[:blank:]].*\)\?$:\1:p;d')
+ case ${march} in
+ i386|i486|i586|pentium) ;;
+ *) # Either march is not enough low or not exists at all
+ case ${CHOST} in
+ i486-*-*) march=i486 ;;
+ i586-*-*) march=i586 ;;
+ *) march=pentium-mmx ;;
+ esac ;;
+ esac
+ #Let the application set its cflags
+ unset CFLAGS
+ append-flags -march=${march}
+ else
+ #Let the application set its cflags
+ unset CFLAGS
+ fi
+
+ # Switch off hardened tech
+ filter-flags -fpie -fstack-protector
+
+ myconf="--disable-gcc-check"
+ if use alsa; then
+ myconf="$myconf --enable-alsa"
+ fi
+ if ! use gnutls; then
+ myconf="$myconf --disable-vnc-tls"
+ fi
+ if ! use kqemu; then
+ myconf="$myconf --disable-kqemu"
+ fi
+ if ! use sdl ; then
+ myconf="$myconf --disable-sdl --disable-gfx-check"
+ fi
+ # econf does not work
+ ./configure \
+ --prefix=/usr \
+ --enable-adlib \
+ --cc=$(tc-getCC) \
+ --host-cc=$(tc-getCC) \
+ --disable-linux-user \
+ --enable-system \
+ ${myconf} \
+ || die "could not configure"
+
+ emake OS_CFLAGS="${CFLAGS}" || die "make failed"
+}
+
+src_install() {
+ emake install \
+ prefix="${D}/usr" \
+ bindir="${D}/usr/bin" \
+ datadir="${D}/usr/share/qemu" \
+ docdir="${D}/usr/share/doc/${P}" \
+ mandir="${D}/usr/share/man" || die
+
+ chmod -x "${D}/usr/share/man/*/*"
+}
+
+pkg_postinst() {
+ einfo "You will need the Universal TUN/TAP driver compiled into"
+ einfo "kernel or as a module to use the virtual network device."
+}