head 1.2; access; symbols pkgsrc-2016Q4:1.1.0.10 pkgsrc-2016Q4-base:1.1 pkgsrc-2016Q3:1.1.0.8 pkgsrc-2016Q3-base:1.1 pkgsrc-2016Q2:1.1.0.6 pkgsrc-2016Q2-base:1.1 pkgsrc-2016Q1:1.1.0.4 pkgsrc-2016Q1-base:1.1 pkgsrc-2015Q4:1.1.0.2; locks; strict; comment @# @; 1.2 date 2016.12.29.19.13.03; author wiz; state dead; branches; next 1.1; commitid kFYPk8EnajcmFUzz; 1.1 date 2016.01.07.17.55.55; author bouyer; state Exp; branches 1.1.2.1; next ; commitid nI5CmqYKUfq6I1Qy; 1.1.2.1 date 2016.01.07.17.55.55; author bsiegert; state dead; branches; next 1.1.2.2; commitid wxtXbEOcW341qyQy; 1.1.2.2 date 2016.01.11.20.26.12; author bsiegert; state Exp; branches; next ; commitid wxtXbEOcW341qyQy; desc @@ 1.2 log @Remove xenkernel and tools versions 3, 33, and 41. As discussed on pkgsrc-users. @ text @$NetBSD: patch-CVE-2015-8550,v 1.1 2016/01/07 17:55:55 bouyer Exp $ patch for CVE-2015-8550 aka XSA-155 from http://xenbits.xenproject.org/xsa/xsa155-xen-0001-xen-Add-RING_COPY_REQUEST.patch http://xenbits.xenproject.org/xsa/xsa155-xen-0002-blktap2-Use-RING_COPY_REQUEST.patch http://xenbits.xenproject.org/xsa/xsa155-qemut-qdisk-double-access.patch http://xenbits.xenproject.org/xsa/xsa155-qemut-xenfb.patch --- ../xen/include/public/io/ring.h.orig +++ ../xen/include/public/io/ring.h @@@@ -212,6 +212,20 @@@@ typedef struct __name##_back_ring __name##_back_ring_t #define RING_GET_REQUEST(_r, _idx) \ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req)) +/* + * Get a local copy of a request. + * + * Use this in preference to RING_GET_REQUEST() so all processing is + * done on a local copy that cannot be modified by the other end. + * + * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this + * to be ineffective where _req is a struct which consists of only bitfields. + */ +#define RING_COPY_REQUEST(_r, _idx, _req) do { \ + /* Use volatile to force the copy into _req. */ \ + *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \ +} while (0) + #define RING_GET_RESPONSE(_r, _idx) \ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) --- blktap2/drivers/block-log.c.orig +++ blktap2/drivers/block-log.c @@@@ -494,11 +494,12 @@@@ static int ctl_kick(struct tdlog_state* s, int fd) reqstart = s->bring.req_cons; reqend = s->sring->req_prod; + xen_mb(); BDPRINTF("ctl: ring kicked (start = %u, end = %u)", reqstart, reqend); while (reqstart != reqend) { /* XXX actually submit these! */ - memcpy(&req, RING_GET_REQUEST(&s->bring, reqstart), sizeof(req)); + RING_COPY_REQUEST(&s->bring, reqstart, &req); BDPRINTF("ctl: read request %"PRIu64":%u", req.sector, req.count); s->bring.req_cons = ++reqstart; --- blktap2/drivers/tapdisk-vbd.c.orig +++ blktap2/drivers/tapdisk-vbd.c @@@@ -1555,7 +1555,7 @@@@ tapdisk_vbd_pull_ring_requests(td_vbd_t *vbd) int idx; RING_IDX rp, rc; td_ring_t *ring; - blkif_request_t *req; + blkif_request_t req; td_vbd_request_t *vreq; ring = &vbd->ring; @@@@ -1566,16 +1566,16 @@@@ tapdisk_vbd_pull_ring_requests(td_vbd_t *vbd) xen_rmb(); for (rc = ring->fe_ring.req_cons; rc != rp; rc++) { - req = RING_GET_REQUEST(&ring->fe_ring, rc); + RING_COPY_REQUEST(&ring->fe_ring, rc, &req); ++ring->fe_ring.req_cons; - idx = req->id; + idx = req.id; vreq = &vbd->request_list[idx]; ASSERT(list_empty(&vreq->next)); ASSERT(vreq->secs_pending == 0); - memcpy(&vreq->req, req, sizeof(blkif_request_t)); + memcpy(&vreq->req, &req, sizeof(blkif_request_t)); vbd->received++; vreq->vbd = vbd; --- ioemu-qemu-xen/hw/xen_blkif.h.orig +++ ioemu-qemu-xen/hw/xen_blkif.h @@@@ -79,8 +79,10 @@@@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } @@@@ -94,8 +96,10 @@@@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } --- ioemu-qemu-xen/hw/xenfb.c +++ ioemu-qemu-xen/hw/xenfb.c @@@@ -827,18 +827,20 @@@@ static void xenfb_invalidate(void *opaque) static void xenfb_handle_events(struct XenFB *xenfb) { - uint32_t prod, cons; + uint32_t prod, cons, out_cons; struct xenfb_page *page = xenfb->c.page; prod = page->out_prod; - if (prod == page->out_cons) + out_cons = page->out_cons; + if (prod == out_cons) return; xen_rmb(); /* ensure we see ring contents up to prod */ - for (cons = page->out_cons; cons != prod; cons++) { + for (cons = out_cons; cons != prod; cons++) { union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons); + uint8_t type = event->type; int x, y, w, h; - switch (event->type) { + switch (type) { case XENFB_TYPE_UPDATE: if (xenfb->up_count == UP_QUEUE) xenfb->up_fullscreen = 1; @ 1.1 log @Apply patches from Xen repository, fixing: CVE-2015-8339 and CVE-2015-8340 aka XSA-159 XSA-166 CVE-2015-8550 aka XSA-155 CVE-2015-8554 aka XSA-164 Bump pkgrevision @ text @d1 1 a1 1 $NetBSD: patch-CVE-2015-2756,v 1.1 2015/04/19 13:13:21 spz Exp $ @ 1.1.2.1 log @file patch-CVE-2015-8550 was added on branch pkgsrc-2015Q4 on 2016-01-11 20:26:12 +0000 @ text @d1 134 @ 1.1.2.2 log @Pullup ticket #4887 - requested by bouyer sysutils/xenkernel41: security fix sysutils/xentools41: security fix Revisions pulled up: - sysutils/xenkernel41/Makefile 1.48 - sysutils/xenkernel41/distinfo 1.41 - sysutils/xenkernel41/patches/patch-CVE-2015-8339 1.1 - sysutils/xenkernel41/patches/patch-XSA-166 1.1 - sysutils/xentools41/Makefile 1.59 - sysutils/xentools41/distinfo 1.41 - sysutils/xentools41/patches/patch-CVE-2015-8550 1.1 - sysutils/xentools41/patches/patch-CVE-2015-8554 1.1 --- Module Name: pkgsrc Committed By: bouyer Date: Thu Jan 7 17:55:55 UTC 2016 Modified Files: pkgsrc/sysutils/xenkernel41: Makefile distinfo pkgsrc/sysutils/xentools41: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel41/patches: patch-CVE-2015-8339 patch-XSA-166 pkgsrc/sysutils/xentools41/patches: patch-CVE-2015-8550 patch-CVE-2015-8554 Log Message: Apply patches from Xen repository, fixing: CVE-2015-8339 and CVE-2015-8340 aka XSA-159 XSA-166 CVE-2015-8550 aka XSA-155 CVE-2015-8554 aka XSA-164 Bump pkgrevision @ text @a0 134 $NetBSD$ patch for CVE-2015-8550 aka XSA-155 from http://xenbits.xenproject.org/xsa/xsa155-xen-0001-xen-Add-RING_COPY_REQUEST.patch http://xenbits.xenproject.org/xsa/xsa155-xen-0002-blktap2-Use-RING_COPY_REQUEST.patch http://xenbits.xenproject.org/xsa/xsa155-qemut-qdisk-double-access.patch http://xenbits.xenproject.org/xsa/xsa155-qemut-xenfb.patch --- ../xen/include/public/io/ring.h.orig +++ ../xen/include/public/io/ring.h @@@@ -212,6 +212,20 @@@@ typedef struct __name##_back_ring __name##_back_ring_t #define RING_GET_REQUEST(_r, _idx) \ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req)) +/* + * Get a local copy of a request. + * + * Use this in preference to RING_GET_REQUEST() so all processing is + * done on a local copy that cannot be modified by the other end. + * + * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this + * to be ineffective where _req is a struct which consists of only bitfields. + */ +#define RING_COPY_REQUEST(_r, _idx, _req) do { \ + /* Use volatile to force the copy into _req. */ \ + *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \ +} while (0) + #define RING_GET_RESPONSE(_r, _idx) \ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) --- blktap2/drivers/block-log.c.orig +++ blktap2/drivers/block-log.c @@@@ -494,11 +494,12 @@@@ static int ctl_kick(struct tdlog_state* s, int fd) reqstart = s->bring.req_cons; reqend = s->sring->req_prod; + xen_mb(); BDPRINTF("ctl: ring kicked (start = %u, end = %u)", reqstart, reqend); while (reqstart != reqend) { /* XXX actually submit these! */ - memcpy(&req, RING_GET_REQUEST(&s->bring, reqstart), sizeof(req)); + RING_COPY_REQUEST(&s->bring, reqstart, &req); BDPRINTF("ctl: read request %"PRIu64":%u", req.sector, req.count); s->bring.req_cons = ++reqstart; --- blktap2/drivers/tapdisk-vbd.c.orig +++ blktap2/drivers/tapdisk-vbd.c @@@@ -1555,7 +1555,7 @@@@ tapdisk_vbd_pull_ring_requests(td_vbd_t *vbd) int idx; RING_IDX rp, rc; td_ring_t *ring; - blkif_request_t *req; + blkif_request_t req; td_vbd_request_t *vreq; ring = &vbd->ring; @@@@ -1566,16 +1566,16 @@@@ tapdisk_vbd_pull_ring_requests(td_vbd_t *vbd) xen_rmb(); for (rc = ring->fe_ring.req_cons; rc != rp; rc++) { - req = RING_GET_REQUEST(&ring->fe_ring, rc); + RING_COPY_REQUEST(&ring->fe_ring, rc, &req); ++ring->fe_ring.req_cons; - idx = req->id; + idx = req.id; vreq = &vbd->request_list[idx]; ASSERT(list_empty(&vreq->next)); ASSERT(vreq->secs_pending == 0); - memcpy(&vreq->req, req, sizeof(blkif_request_t)); + memcpy(&vreq->req, &req, sizeof(blkif_request_t)); vbd->received++; vreq->vbd = vbd; --- ioemu-qemu-xen/hw/xen_blkif.h.orig +++ ioemu-qemu-xen/hw/xen_blkif.h @@@@ -79,8 +79,10 @@@@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } @@@@ -94,8 +96,10 @@@@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } --- ioemu-qemu-xen/hw/xenfb.c +++ ioemu-qemu-xen/hw/xenfb.c @@@@ -827,18 +827,20 @@@@ static void xenfb_invalidate(void *opaque) static void xenfb_handle_events(struct XenFB *xenfb) { - uint32_t prod, cons; + uint32_t prod, cons, out_cons; struct xenfb_page *page = xenfb->c.page; prod = page->out_prod; - if (prod == page->out_cons) + out_cons = page->out_cons; + if (prod == out_cons) return; xen_rmb(); /* ensure we see ring contents up to prod */ - for (cons = page->out_cons; cons != prod; cons++) { + for (cons = out_cons; cons != prod; cons++) { union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons); + uint8_t type = event->type; int x, y, w, h; - switch (event->type) { + switch (type) { case XENFB_TYPE_UPDATE: if (xenfb->up_count == UP_QUEUE) xenfb->up_fullscreen = 1; @