Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK)) by mollari.NetBSD.org (Postfix) with ESMTPS id D55307A219 for ; Mon, 7 Nov 2016 19:11:37 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id 495B6855B7; Mon, 7 Nov 2016 19:11:37 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id CE7FD855A0 for ; Mon, 7 Nov 2016 19:11:36 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id yxc-KLhZAQDT for ; Mon, 7 Nov 2016 19:11:36 +0000 (UTC) Received: from cvs.NetBSD.org (unknown [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 0EAD385576 for ; Mon, 7 Nov 2016 19:11:36 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 048A3FBA6; Mon, 7 Nov 2016 19:11:36 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1478545895239210" MIME-Version: 1.0 Date: Mon, 7 Nov 2016 19:11:35 +0000 From: "Benny Siegert" Subject: CVS commit: [pkgsrc-2016Q3] pkgsrc/emulators/qemu To: pkgsrc-changes@NetBSD.org Reply-To: bsiegert@netbsd.org X-Mailer: log_accum Message-Id: <20161107191136.048A3FBA6@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk This is a multi-part message in MIME format. --_----------=_1478545895239210 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: bsiegert Date: Mon Nov 7 19:11:35 UTC 2016 Modified Files: pkgsrc/emulators/qemu [pkgsrc-2016Q3]: Makefile distinfo Added Files: pkgsrc/emulators/qemu/patches [pkgsrc-2016Q3]: patch-CVE-2016-7423 patch-CVE-2016-7907 patch-CVE-2016-7908 patch-CVE-2016-7909 Log Message: Pullup ticket #5146 - requested by spz emulators/qemu: security fix Revisions pulled up: - emulators/qemu/Makefile 1.156 - emulators/qemu/distinfo 1.118 - emulators/qemu/patches/patch-CVE-2016-7423 1.1 - emulators/qemu/patches/patch-CVE-2016-7907 1.1 - emulators/qemu/patches/patch-CVE-2016-7908 1.1 - emulators/qemu/patches/patch-CVE-2016-7909 1.1 --- Module Name: pkgsrc Committed By: spz Date: Sun Oct 30 14:48:01 UTC 2016 Modified Files: pkgsrc/emulators/qemu: Makefile distinfo Added Files: pkgsrc/emulators/qemu/patches: patch-CVE-2016-7423 patch-CVE-2016-7907 patch-CVE-2016-7908 patch-CVE-2016-7909 Log Message: add patches for CVE-2016-7423 and CVE-2016-790[789] from upstream To generate a diff of this commit: cvs rdiff -u -r1.154 -r1.154.2.1 pkgsrc/emulators/qemu/Makefile cvs rdiff -u -r1.117 -r1.117.2.1 pkgsrc/emulators/qemu/distinfo cvs rdiff -u -r0 -r1.1.2.2 pkgsrc/emulators/qemu/patches/patch-CVE-2016-7423 \ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7907 \ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7908 \ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7909 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1478545895239210 Content-Disposition: inline Content-Length: 7513 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/emulators/qemu/Makefile diff -u pkgsrc/emulators/qemu/Makefile:1.154 pkgsrc/emulators/qemu/Makefile:1.154.2.1 --- pkgsrc/emulators/qemu/Makefile:1.154 Sun Sep 4 09:21:04 2016 +++ pkgsrc/emulators/qemu/Makefile Mon Nov 7 19:11:35 2016 @@ -1,9 +1,10 @@ -# $NetBSD: Makefile,v 1.154 2016/09/04 09:21:04 ryoon Exp $ +# $NetBSD: Makefile,v 1.154.2.1 2016/11/07 19:11:35 bsiegert Exp $ DISTNAME= qemu-2.7.0 CATEGORIES= emulators MASTER_SITES= http://wiki.qemu.org/download/ EXTRACT_SUFX= .tar.bz2 +PKGREVISION= 1 MAINTAINER= pkgsrc-users@NetBSD.org HOMEPAGE= http://www.qemu.org/ Index: pkgsrc/emulators/qemu/distinfo diff -u pkgsrc/emulators/qemu/distinfo:1.117 pkgsrc/emulators/qemu/distinfo:1.117.2.1 --- pkgsrc/emulators/qemu/distinfo:1.117 Sun Sep 4 09:21:04 2016 +++ pkgsrc/emulators/qemu/distinfo Mon Nov 7 19:11:35 2016 @@ -1,9 +1,13 @@ -$NetBSD: distinfo,v 1.117 2016/09/04 09:21:04 ryoon Exp $ +$NetBSD: distinfo,v 1.117.2.1 2016/11/07 19:11:35 bsiegert Exp $ SHA1 (qemu-2.7.0.tar.bz2) = 96737d31a2fb74553dacbd0ddaa93014858dc986 RMD160 (qemu-2.7.0.tar.bz2) = cc962261a4f7b05ace8c16027bda770a89322cd3 SHA512 (qemu-2.7.0.tar.bz2) = 654acaa7b3724a288e5d7e2a26ab780d9c9ed9f647fba00a906cbaffbe9d58fd666f2d962514aa2c5b391b4c53811ac3170d2eb51727f090bd19dfe45ca9a9db Size (qemu-2.7.0.tar.bz2) = 26867760 bytes +SHA1 (patch-CVE-2016-7423) = 1e126226adb90bfc335fa4dfbdb0365271ca1db3 +SHA1 (patch-CVE-2016-7907) = 3645de0cc1685966261be1847bad14a354c75326 +SHA1 (patch-CVE-2016-7908) = 09c1a30af90a1b9cb2b381401b760a861ce10765 +SHA1 (patch-CVE-2016-7909) = 26ed8d3bbcb8463d4d2c7e28c76aa75518a8c528 SHA1 (patch-Makefile.objs) = f40deeed5482a24369e898411bb611be418dc3ca SHA1 (patch-configure) = 9eb469dc5be1d7c6b4ee69e8ee61e6ab8d542112 SHA1 (patch-default-configs_pci.mak) = 2162550a68de514c8fe9e255df88f8a0a07ee6c7 Added files: Index: pkgsrc/emulators/qemu/patches/patch-CVE-2016-7423 diff -u /dev/null pkgsrc/emulators/qemu/patches/patch-CVE-2016-7423:1.1.2.2 --- /dev/null Mon Nov 7 19:11:35 2016 +++ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7423 Mon Nov 7 19:11:35 2016 @@ -0,0 +1,25 @@ +$NetBSD: patch-CVE-2016-7423,v 1.1.2.2 2016/11/07 19:11:35 bsiegert Exp $ + +from: +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5 + +scsi: mptsas: use g_new0 to allocate MPTSASRequest object + +When processing IO request in mptsas, it uses g_new to allocate +a 'req' object. If an error occurs before 'req->sreq' is +allocated, It could lead to an OOB write in mptsas_free_request +function. Use g_new0 to avoid it. + +Reported-by: Li Qiang + +--- hw/scsi/mptsas.c.orig 2016-09-02 15:34:20.000000000 +0000 ++++ hw/scsi/mptsas.c +@@ -304,7 +304,7 @@ static int mptsas_process_scsi_io_reques + goto bad; + } + +- req = g_new(MPTSASRequest, 1); ++ req = g_new0(MPTSASRequest, 1); + QTAILQ_INSERT_TAIL(&s->pending, req, next); + req->scsi_io = *scsi_io; + req->dev = s; Index: pkgsrc/emulators/qemu/patches/patch-CVE-2016-7907 diff -u /dev/null pkgsrc/emulators/qemu/patches/patch-CVE-2016-7907:1.1.2.2 --- /dev/null Mon Nov 7 19:11:35 2016 +++ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7907 Mon Nov 7 19:11:35 2016 @@ -0,0 +1,41 @@ +$NetBSD: patch-CVE-2016-7907,v 1.1.2.2 2016/11/07 19:11:35 bsiegert Exp $ + +from: +https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.html + +From: Prasad J Pandit + +i.MX Fast Ethernet Controller uses buffer descriptors to manage +data flow to/fro receive & transmit queues. While transmitting +packets, it could continue to read buffer descriptors if a buffer +descriptor has length of zero and has crafted values in bd.flags. +Set an upper limit to number of buffer descriptors. + +Reported-by: Li Qiang + +--- hw/net/imx_fec.c.orig 2016-09-02 15:34:19.000000000 +0000 ++++ hw/net/imx_fec.c +@@ -220,6 +220,8 @@ static const VMStateDescription vmstate_ + #define PHY_INT_PARFAULT (1 << 2) + #define PHY_INT_AUTONEG_PAGE (1 << 1) + ++#define IMX_MAX_DESC 1024 ++ + static void imx_eth_update(IMXFECState *s); + + /* +@@ -402,12 +404,12 @@ static void imx_eth_update(IMXFECState * + + static void imx_fec_do_tx(IMXFECState *s) + { +- int frame_size = 0; ++ int frame_size = 0, descnt = 0; + uint8_t frame[ENET_MAX_FRAME_SIZE]; + uint8_t *ptr = frame; + uint32_t addr = s->tx_descriptor; + +- while (1) { ++ while (descnt++ < IMX_MAX_DESC) { + IMXFECBufDesc bd; + int len; + Index: pkgsrc/emulators/qemu/patches/patch-CVE-2016-7908 diff -u /dev/null pkgsrc/emulators/qemu/patches/patch-CVE-2016-7908:1.1.2.2 --- /dev/null Mon Nov 7 19:11:35 2016 +++ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7908 Mon Nov 7 19:11:35 2016 @@ -0,0 +1,43 @@ +$NetBSD: patch-CVE-2016-7908,v 1.1.2.2 2016/11/07 19:11:35 bsiegert Exp $ + +from: +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=070c4b92b8cd5390889716677a0b92444d6e087a + +net: mcf: limit buffer descriptor count + +ColdFire Fast Ethernet Controller uses buffer descriptors to manage +data flow to/fro receive & transmit queues. While transmitting +packets, it could continue to read buffer descriptors if a buffer +descriptor has length of zero and has crafted values in bd.flags. +Set upper limit to number of buffer descriptors. + +Reported-by: Li Qiang + +--- hw/net/mcf_fec.c.orig 2016-09-02 15:34:19.000000000 +0000 ++++ hw/net/mcf_fec.c +@@ -23,6 +23,7 @@ do { printf("mcf_fec: " fmt , ## __VA_AR + #define DPRINTF(fmt, ...) do {} while(0) + #endif + ++#define FEC_MAX_DESC 1024 + #define FEC_MAX_FRAME_SIZE 2032 + + typedef struct { +@@ -149,7 +150,7 @@ static void mcf_fec_do_tx(mcf_fec_state + uint32_t addr; + mcf_fec_bd bd; + int frame_size; +- int len; ++ int len, descnt = 0; + uint8_t frame[FEC_MAX_FRAME_SIZE]; + uint8_t *ptr; + +@@ -157,7 +158,7 @@ static void mcf_fec_do_tx(mcf_fec_state + ptr = frame; + frame_size = 0; + addr = s->tx_descriptor; +- while (1) { ++ while (descnt++ < FEC_MAX_DESC) { + mcf_fec_read_bd(&bd, addr); + DPRINTF("tx_bd %x flags %04x len %d data %08x\n", + addr, bd.flags, bd.length, bd.data); Index: pkgsrc/emulators/qemu/patches/patch-CVE-2016-7909 diff -u /dev/null pkgsrc/emulators/qemu/patches/patch-CVE-2016-7909:1.1.2.2 --- /dev/null Mon Nov 7 19:11:35 2016 +++ pkgsrc/emulators/qemu/patches/patch-CVE-2016-7909 Mon Nov 7 19:11:35 2016 @@ -0,0 +1,29 @@ +$NetBSD: patch-CVE-2016-7909,v 1.1.2.2 2016/11/07 19:11:35 bsiegert Exp $ + +from: +https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html + +From: Prasad J Pandit + +The AMD PC-Net II emulator has set of control and status(CSR) +registers. Of these, CSR76 and CSR78 hold receive and transmit +descriptor ring length respectively. This ring length could range +from 1 to 65535. Setting ring length to zero leads to an infinite +loop in pcnet_rdra_addr. Add check to avoid it. + +Reported-by: Li Qiang + +--- hw/net/pcnet.c.orig 2016-09-02 15:34:19.000000000 +0000 ++++ hw/net/pcnet.c +@@ -1429,8 +1429,11 @@ static void pcnet_csr_writew(PCNetState + case 47: /* POLLINT */ + case 72: + case 74: ++ break; + case 76: /* RCVRL */ + case 78: /* XMTRL */ ++ val = (val > 0) ? val : 512; ++ break; + case 112: + if (CSR_STOP(s) || CSR_SPND(s)) + break; --_----------=_1478545895239210--