Updated patch for security bug #212351 to avoid qcow2 image regression. Filtering CFLAGS to allow building with gcc-3.4.

Package-Manager: portage-2.1.4.4

4 files changed, 379 insertions, 2 deletions

diff --git a/app-emulation/qemu-softmmu/ChangeLog b/app-emulation/qemu-softmmu/ChangeLog
index eb4f54f6f74b..d09d3da851fc 100644
--- a/app-emulation/qemu-softmmu/ChangeLog
+++ b/app-emulation/qemu-softmmu/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for app-emulation/qemu-softmmu
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.49 2008/04/20 19:01:08 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.50 2008/05/12 23:59:20 pva Exp $
+
+*qemu-softmmu-0.9.1-r2 (12 May 2008)
+
+  12 May 2008; Peter Volkov <pva@gentoo.org>
+  +files/qemu-softmmu-0.9.1-CVE-2008-0928.patch,
+  +qemu-softmmu-0.9.1-r2.ebuild:
+  Updated patch for security bug #212351 to avoid qcow2 image regression.
+  Filtering CFLAGS to allow building with gcc-3.4.
 
   20 Apr 2008; Luca Barbato <lu_zero@gentoo.org>
   qemu-softmmu-0.9.1-r1.ebuild:
diff --git a/app-emulation/qemu-softmmu/Manifest b/app-emulation/qemu-softmmu/Manifest
index cd380e427916..a4dbabf3b1c5 100644
--- a/app-emulation/qemu-softmmu/Manifest
+++ b/app-emulation/qemu-softmmu/Manifest
@@ -1,11 +1,13 @@
 AUX qemu-softmmu-0.9.0-block-qcow2.patch 346 RMD160 d9c11c082fce158e5fbdaceb5e87a327877de58c SHA1 976bd2727f8bdbad999ea2c23112dcbe550bbf4c SHA256 bfea37a8fc718bcee6f31df02c3095094c58d3ace952a7e7789784d6b3471c5a
 AUX qemu-softmmu-0.9.0-ide-cd.patch 1764 RMD160 5d19bd67c74734c4e66f67dc136adb6f08fa418f SHA1 152fd0403c0644c275ac4aee539139ee5bffd262 SHA256 1f0d9d52e3ead71f0f250902993d1a7d3fb9c88be23870f5559a1596c42bdaf5
+AUX qemu-softmmu-0.9.1-CVE-2008-0928.patch 9346 RMD160 79e4dbf7643d7057da4a74350833c907342fba1e SHA1 2ec9c89e6a995db97aa03cdab490fc0e5cef650c SHA256 ca040bdb401e6cdfe4f009e6874d25853103965370b19756724127b0fd4df559
 AUX qemu-softmmu-0.9.1-block-device-address-range.patch 7904 RMD160 5653db42b048a0f1748b5394b7382fa3f2edc2a8 SHA1 258a10d73348683fbc7659110b0da57e0003cc46 SHA256 39268b7caebe64d11cd538974def842bedccca0894423f1d003574b8f39e9ecf
 DIST qemu-0.9.0.tar.gz 1901741 RMD160 4296542b6da18a6ac93d20787330d3c1c2ac0a19 SHA1 1e57e48a06eb8729913d92601000466eecef06cb SHA256 491facf9335654967ee53d8fb3540a274bfcbdcc225506bd38c4ee8e9ab405c1
 DIST qemu-0.9.1.tar.gz 2804104 RMD160 ee7bdb55a4540df2082d4bde9ebfd2f4e6f201a5 SHA1 630ea20b5989f0df00128de7f7be661c573ed041 SHA256 4756d0b4a4dc7dd88354bc6b37d381e4462dd328d0feef94803e90c0455835a5
 EBUILD qemu-softmmu-0.9.0-r1.ebuild 3175 RMD160 8a7d2bc7dd359671e5350537da075fc169168b60 SHA1 681d7c1f8ff28c30a4e9135e1e54d4075cd8fe7b SHA256 a381f8a2e983e6e6266657adab2cc59605bb3efc416dec4b7f901a51e0666412
 EBUILD qemu-softmmu-0.9.0.ebuild 3129 RMD160 dc0666aa7499db65af3f78d0d94a4253750927d5 SHA1 7493550b324f11ee72aa5ca994cdd207eb383c6f SHA256 ddd4eb920698c27d70a27d20eb1877b37a7824689340821f8cfe16698100942c
 EBUILD qemu-softmmu-0.9.1-r1.ebuild 2904 RMD160 102b8519c20d6df891b9373e0c0f0ca13bafc82d SHA1 b9c737efb10f7bb120956d0ccf9281a3417e3f76 SHA256 ade319575b20682fdcfc0084f6234348e72fac742db179f97c2d55881a1d2a49
+EBUILD qemu-softmmu-0.9.1-r2.ebuild 3449 RMD160 8710a61749937c51bc2bd8e0d089cde0bcc6c4ef SHA1 4b89d7278be7673732b7f9041b42968e0c401a80 SHA256 98c1893c363600d859cb1ba1b6c59d1aa70125d082f1fbb0ed2fae28a39bfab8
 EBUILD qemu-softmmu-0.9.1.ebuild 2832 RMD160 150a50f0010d93200e611af2181cc5df76a91781 SHA1 213f88845793c90dd59e6eff978d839e9d0da3fe SHA256 2c11e38b4b501ef9300e35eeec00236feedad5bcc69decfb839ad52260609f13
-MISC ChangeLog 8546 RMD160 be5695fc027c9fbde2ad7ba1632afafa74f0fdc0 SHA1 832a3dcfa09590393eda6f82b867fec45cc3e6a5 SHA256 80a73923dae85c608008c8538460026bf8422c0a98b80ca12fb698af751ddefb
+MISC ChangeLog 8833 RMD160 a22e7d35fbe0abbdd62070ec8b2145e30e2b7ba1 SHA1 e417ef5dbec7e94919ea8c0ce2916cd2df20a83a SHA256 a36bcf349c22c7c83e84ce44b082d26887dca482d045c3fca34c43ee4b6a53ad
 MISC metadata.xml 223 RMD160 f054e67dff10c87ea1d0b5753124445be6bd4610 SHA1 fcf66d2b271369d296150dde06603d850623ed27 SHA256 64a96c3c9929aec46b50a63ae1fd8c46cef4a8423f448d6f6fff09e20510c98b
diff --git a/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch
new file mode 100644
index 000000000000..ee410d64e713
--- /dev/null
+++ b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-CVE-2008-0928.patch
@@ -0,0 +1,239 @@
+https://bugzilla.redhat.com/show_bug.cgi?id=433560
+
+Revised block device address range patch
+
+The original patch adds checks to the main  bdrv_XXX apis to validate that
+the I/O operation does not exceed the bounds of the disk - ie beyond the
+total_sectors count. This works correctly for bdrv_XXX calls from the IDE
+driver.  With disk formats like QCow though,  bdrv_XXX is re-entrant,
+because the QCow driver uses the block APIs for dealing with its underlying
+file.  The problem is that QCow files are grow-on-demand, so writes will
+*explicitly* be beyond the end of the file. The original patch blocks any
+I/O operation which would cause the QCow file to grow, resulting it more
+or less catasatrophic data loss.
+
+Basically the bounds checking needs to distinguish between checking for
+the logical disk extents, vs the physical disk extents. For raw files
+these are the same so initial tests showed no problems, but for QCow
+format disks they are different & thus we see a problem
+
+What follows is a revised patch which introduces a flag BDRV_O_AUTOGROW
+which can be passed to bdrv_open to indicate that the files can be allowed
+to automatically extend their extents. This flag should only be used by
+internal block drivers such as block-qcow2.c, block-vmdk.c  In my testing
+this has fixed the qcow corruption, and still maintains the goal of Ian's
+original patch which was to prevent the guest VM writing beyond the logical
+disk extents.
+
+diff -rup kvm-60.orig/qemu/block.c kvm-60.new/qemu/block.c
+--- kvm-60.orig/qemu/block.c	2008-02-26 18:44:28.000000000 -0500
++++ kvm-60.new/qemu/block.c	2008-02-26 18:44:52.000000000 -0500
+@@ -124,6 +124,60 @@ void path_combine(char *dest, int dest_s
+     }
+ }
+ 
++static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
++                                  int64_t sector_num, int nb_sectors)
++{
++    return
++        nb_sectors < 0 ||
++        sector_num < 0 ||
++        nb_sectors > bs->total_sectors ||
++        sector_num > bs->total_sectors - nb_sectors;
++}
++
++static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
++                                int64_t offset, int count)
++{
++    int64_t size = bs->total_sectors << SECTOR_BITS;
++    return
++        count < 0 ||
++        size < 0 ||
++        count > size ||
++        offset > size - count;
++}
++
++static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
++                                  int64_t sector_num, int nb_sectors)
++{
++    if (sector_num < 0 ||
++        nb_sectors < 0)
++        return 1;
++
++    if (sector_num > bs->total_sectors - nb_sectors) {
++        if (bs->autogrow)
++            bs->total_sectors = sector_num + nb_sectors;
++        else
++            return 1;
++    }
++    return 0;
++}
++
++static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
++                                int64_t offset, int count)
++{
++    int64_t size = bs->total_sectors << SECTOR_BITS;
++    if (count < 0 ||
++        offset < 0)
++        return 1;
++
++    if (offset > size - count) {
++        if (bs->autogrow)
++            bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
++        else
++            return 1;
++    }
++    return 0;
++}
++
+ 
+ static void bdrv_register(BlockDriver *bdrv)
+ {
+@@ -332,6 +386,10 @@ int bdrv_open2(BlockDriverState *bs, con
+     bs->read_only = 0;
+     bs->is_temporary = 0;
+     bs->encrypted = 0;
++    bs->autogrow = 0;
++
++    if (flags & BDRV_O_AUTOGROW)
++        bs->autogrow = 1;
+ 
+     if (flags & BDRV_O_SNAPSHOT) {
+         BlockDriverState *bs1;
+@@ -376,6 +434,7 @@ int bdrv_open2(BlockDriverState *bs, con
+     }
+     bs->drv = drv;
+     bs->opaque = qemu_mallocz(drv->instance_size);
++    bs->total_sectors = 0; /* driver will set if it does not do getlength */
+     if (bs->opaque == NULL && drv->instance_size > 0)
+         return -1;
+     /* Note: for compatibility, we open disk image files as RDWR, and
+@@ -441,6 +500,7 @@ void bdrv_close(BlockDriverState *bs)
+         bs->drv = NULL;
+ 
+         /* call the change callback */
++        bs->total_sectors = 0;
+         bs->media_changed = 1;
+         if (bs->change_cb)
+             bs->change_cb(bs->change_opaque);
+@@ -506,6 +566,8 @@ int bdrv_read(BlockDriverState *bs, int6
+     if (!drv)
+         return -ENOMEDIUM;
+ 
++    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+             memcpy(buf, bs->boot_sector_data, 512);
+         sector_num++;
+@@ -546,6 +608,8 @@ int bdrv_write(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (bs->read_only)
+         return -EACCES;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);
+     }
+@@ -671,6 +735,8 @@ int bdrv_pread(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pread)
+         return bdrv_pread_em(bs, offset, buf1, count1);
++    if (bdrv_rd_badreq_bytes(bs, offset, count1))
++        return -EDOM;
+     return drv->bdrv_pread(bs, offset, buf1, count1);
+ }
+ 
+@@ -686,6 +752,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pwrite)
+         return bdrv_pwrite_em(bs, offset, buf1, count1);
++    if (bdrv_wr_badreq_bytes(bs, offset, count1))
++        return -EDOM;
+     return drv->bdrv_pwrite(bs, offset, buf1, count1);
+ }
+ 
+@@ -1091,6 +1159,8 @@ int bdrv_write_compressed(BlockDriverSta
+         return -ENOMEDIUM;
+     if (!drv->bdrv_write_compressed)
+         return -ENOTSUP;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+ }
+ 
+@@ -1237,6 +1307,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
+ 
+     if (!drv)
+         return NULL;
++    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++        return NULL;
+ 
+     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+@@ -1268,6 +1340,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
+         return NULL;
+     if (bs->read_only)
+         return NULL;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return NULL;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);
+     }
+diff -rup kvm-60.orig/qemu/block.h kvm-60.new/qemu/block.h
+--- kvm-60.orig/qemu/block.h	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block.h	2008-02-26 18:44:52.000000000 -0500
+@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo {
+                                      it (default for
+                                      bdrv_file_open()) */
+ #define BDRV_O_DIRECT      0x0020
++#define BDRV_O_AUTOGROW    0x0040 /* Allow backing file to extend when writing past end of file */
+ 
+ #ifndef QEMU_IMG
+ void bdrv_info(void);
+diff -rup kvm-60.orig/qemu/block_int.h kvm-60.new/qemu/block_int.h
+--- kvm-60.orig/qemu/block_int.h	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block_int.h	2008-02-26 18:44:52.000000000 -0500
+@@ -97,6 +97,7 @@ struct BlockDriverState {
+     int locked;    /* if true, the media cannot temporarily be ejected */
+     int encrypted; /* if true, the media is encrypted */
+     int sg;        /* if true, the device is a /dev/sg* */
++    int autogrow;  /* if true, the backing store can auto-extend to allocate new extents */
+     /* event callback when inserting/removing */
+     void (*change_cb)(void *opaque);
+     void *change_opaque;
+diff -rup kvm-60.orig/qemu/block-qcow2.c kvm-60.new/qemu/block-qcow2.c
+--- kvm-60.orig/qemu/block-qcow2.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow2.c	2008-02-26 18:44:52.000000000 -0500
+@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b
+     int len, i, shift, ret;
+     QCowHeader header;
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-qcow.c kvm-60.new/qemu/block-qcow.c
+--- kvm-60.orig/qemu/block-qcow.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow.c	2008-02-26 18:44:52.000000000 -0500
+@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b
+     int len, i, shift, ret;
+     QCowHeader header;
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-vmdk.c kvm-60.new/qemu/block-vmdk.c
+--- kvm-60.orig/qemu/block-vmdk.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-vmdk.c	2008-02-26 18:44:52.000000000 -0500
+@@ -375,7 +375,7 @@ static int vmdk_open(BlockDriverState *b
+         flags = BDRV_O_RDONLY;
+     fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename);
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
diff --git a/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild
new file mode 100644
index 000000000000..a457edc755b5
--- /dev/null
+++ b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r2.ebuild,v 1.1 2008/05/12 23:59:20 pva Exp $
+
+inherit eutils flag-o-matic toolchain-funcs
+
+DESCRIPTION="Multi-platform & multi-targets cpu emulator and dynamic translator"
+HOMEPAGE="http://fabrice.bellard.free.fr/qemu/"
+SRC_URI="${HOMEPAGE}${P/-softmmu/}.tar.gz"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="-alpha ~amd64 ~ppc -sparc ~x86"
+IUSE="sdl kqemu gnutls alsa"
+RESTRICT="binchecks test"
+
+DEPEND="virtual/libc
+	sys-libs/zlib
+	sdl? ( media-libs/libsdl )
+	!<=app-emulation/qemu-0.7.0
+	kqemu? ( >=app-emulation/kqemu-1.3.0_pre10 )
+	gnutls? (
+		dev-util/pkgconfig
+		net-libs/gnutls
+	)
+	app-text/texi2html"
+RDEPEND="sys-libs/zlib
+	sdl? ( media-libs/libsdl )
+	gnutls? ( net-libs/gnutls )
+	alsa? ( media-libs/alsa-lib )"
+
+S=${WORKDIR}/${P/-softmmu/}
+
+pkg_setup() {
+	if [ "$(gcc-major-version)" == "4" ]; then
+		eerror "qemu requires gcc-3 in order to build and work correctly"
+		eerror "please compile it switching to gcc-3."
+		eerror "We are aware that qemu can guess a gcc-3 but this feature"
+		eerror "could be harmful."
+		die "gcc 4 cannot build qemu"
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+
+	cd "${S}"
+	epatch "${FILESDIR}/${P}-CVE-2008-0928.patch" #212351
+	# Alter target makefiles to accept CFLAGS set via flag-o.
+	sed -i 's/^\(C\|OP_C\|HELPER_C\)FLAGS=/\1FLAGS+=/' \
+		Makefile Makefile.target tests/Makefile
+	# Ensure mprotect restrictions are relaxed for emulator binaries
+	[[ -x /sbin/paxctl ]] && \
+		sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
+			Makefile.target
+	# Prevent install of kernel module by qemu's makefile
+	sed -i 's/\(.\/install.sh\)/#\1/' Makefile
+	# avoid strip
+	sed -i 's:$(INSTALL) -m 755 -s:$(INSTALL) -m 755:' Makefile Makefile.target
+}
+
+src_compile() {
+	if use x86 ; then
+		# Force -march=pentium-mmx or lower. Fixes bug #212351.
+		local march
+		march=$(echo "${CFLAGS}" | sed 's:^.*-march=\([[:alnum:]-]\+\)\([[:blank:]].*\)\?$:\1:p;d')
+		case ${march} in
+			i386|i486|i586|pentium) ;;
+			*) # Either march is not enough low or not exists at all
+			case ${CHOST} in
+				i486-*-*)	march=i486 ;;
+				i586-*-*)	march=i586 ;;
+				*)			march=pentium-mmx ;;
+			esac ;;
+		esac
+		#Let the application set its cflags
+		unset CFLAGS
+		append-flags -march=${march}
+	else
+		#Let the application set its cflags
+		unset CFLAGS
+	fi
+
+	# Switch off hardened tech
+	filter-flags -fpie -fstack-protector
+
+	myconf="--disable-gcc-check"
+	if use alsa; then
+		myconf="$myconf --enable-alsa"
+	fi
+	if ! use gnutls; then
+		myconf="$myconf --disable-vnc-tls"
+	fi
+	if ! use kqemu; then
+		myconf="$myconf --disable-kqemu"
+	fi
+	if ! use sdl ; then
+		myconf="$myconf --disable-sdl --disable-gfx-check"
+	fi
+	# econf does not work
+	./configure \
+		--prefix=/usr \
+		--enable-adlib \
+		--cc=$(tc-getCC) \
+		--host-cc=$(tc-getCC) \
+		--disable-linux-user \
+		--enable-system \
+		${myconf} \
+		|| die "could not configure"
+
+	emake OS_CFLAGS="${CFLAGS}" || die "make failed"
+}
+
+src_install() {
+	emake install \
+		prefix="${D}/usr" \
+		bindir="${D}/usr/bin" \
+		datadir="${D}/usr/share/qemu" \
+		docdir="${D}/usr/share/doc/${P}" \
+		mandir="${D}/usr/share/man" || die
+
+	chmod -x "${D}/usr/share/man/*/*"
+}
+
+pkg_postinst() {
+	einfo "You will need the Universal TUN/TAP driver compiled into"
+	einfo "kernel or as a module to use the virtual network device."
+}