[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
01/01: gnu: qemu: Fix CVE-2017-5525, CVE-2017-5526.
|
From: |
Efraim Flashner |
|
Subject: |
01/01: gnu: qemu: Fix CVE-2017-5525, CVE-2017-5526. |
|
Date: |
Wed, 18 Jan 2017 21:34:08 +0000 (UTC) |
efraim pushed a commit to branch master
in repository guix.
commit 9ca19727678b4c86ed700b31c2c8c951ef170c7e
Author: Efraim Flashner <address@hidden>
Date: Wed Jan 18 23:21:46 2017 +0200
gnu: qemu: Fix CVE-2017-5525, CVE-2017-5526.
* gnu/packages/qemu.scm (qemu)[source]: Add patches.
* gnu/packages/patches/qemu-CVE-2017-5525.patch,
gnu/packages/patches/qemu-CVE-2017-5526.patch: New files.
* gnu/local.mk (dist_patch_DATA): Register them.
---
gnu/local.mk | 2 +
gnu/packages/patches/qemu-CVE-2017-5525.patch | 55 +++++++++++++++++++++++
gnu/packages/patches/qemu-CVE-2017-5526.patch | 58 +++++++++++++++++++++++++
gnu/packages/qemu.scm | 6 ++-
4 files changed, 119 insertions(+), 2 deletions(-)
diff --git a/gnu/local.mk b/gnu/local.mk
index 24dcd03..7903188 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -852,6 +852,8 @@ dist_patch_DATA =
\
%D%/packages/patches/python-pycrypto-CVE-2013-7459.patch \
%D%/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \
%D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch \
+ %D%/packages/patches/qemu-CVE-2017-5525.patch \
+ %D%/packages/patches/qemu-CVE-2017-5526.patch \
%D%/packages/patches/qt4-ldflags.patch \
%D%/packages/patches/quickswitch-fix-dmenu-check.patch \
%D%/packages/patches/rapicorn-isnan.patch \
diff --git a/gnu/packages/patches/qemu-CVE-2017-5525.patch
b/gnu/packages/patches/qemu-CVE-2017-5525.patch
new file mode 100644
index 0000000..d0c0c82
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-5525.patch
@@ -0,0 +1,55 @@
+From 12351a91da97b414eec8cdb09f1d9f41e535a401 Mon Sep 17 00:00:00 2001
+From: Li Qiang <address@hidden>
+Date: Wed, 14 Dec 2016 18:30:21 -0800
+Subject: [PATCH] audio: ac97: add exit function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+http://git.qemu.org/?p=qemu.git;a=patch;h=12351a91da97b414eec8cdb09f1d9f41e535a401
+this patch is from qemu-git
+
+Currently the ac97 device emulation doesn't have a exit function,
+hot unplug this device will leak some memory. Add a exit function to
+avoid this.
+
+Signed-off-by: Li Qiang <address@hidden>
+Reviewed-by: Marc-André Lureau <address@hidden>
+Message-id: address@hidden
+Signed-off-by: Gerd Hoffmann <address@hidden>
+---
+ hw/audio/ac97.c | 11 +++++++++++
+ 1 files changed, 11 insertions(+), 0 deletions(-)
+
+diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
+index cbd959e..c306575 100644
+--- a/hw/audio/ac97.c
++++ b/hw/audio/ac97.c
+@@ -1387,6 +1387,16 @@ static void ac97_realize(PCIDevice *dev, Error **errp)
+ ac97_on_reset (&s->dev.qdev);
+ }
+
++static void ac97_exit(PCIDevice *dev)
++{
++ AC97LinkState *s = DO_UPCAST(AC97LinkState, dev, dev);
++
++ AUD_close_in(&s->card, s->voice_pi);
++ AUD_close_out(&s->card, s->voice_po);
++ AUD_close_in(&s->card, s->voice_mc);
++ AUD_remove_card(&s->card);
++}
++
+ static int ac97_init (PCIBus *bus)
+ {
+ pci_create_simple (bus, -1, "AC97");
+@@ -1404,6 +1414,7 @@ static void ac97_class_init (ObjectClass *klass, void
*data)
+ PCIDeviceClass *k = PCI_DEVICE_CLASS (klass);
+
+ k->realize = ac97_realize;
++ k->exit = ac97_exit;
+ k->vendor_id = PCI_VENDOR_ID_INTEL;
+ k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5;
+ k->revision = 0x01;
+--
+1.7.0.4
+
diff --git a/gnu/packages/patches/qemu-CVE-2017-5526.patch
b/gnu/packages/patches/qemu-CVE-2017-5526.patch
new file mode 100644
index 0000000..5a6d796
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-5526.patch
@@ -0,0 +1,58 @@
+From 069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da Mon Sep 17 00:00:00 2001
+From: Li Qiang <address@hidden>
+Date: Wed, 14 Dec 2016 18:32:22 -0800
+Subject: [PATCH] audio: es1370: add exit function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+http://git.qemu.org/?p=qemu.git;a=patch;h=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
+this patch is from qemu-git.
+
+Currently the es1370 device emulation doesn't have a exit function,
+hot unplug this device will leak some memory. Add a exit function to
+avoid this.
+
+Signed-off-by: Li Qiang <address@hidden>
+Reviewed-by: Marc-André Lureau <address@hidden>
+Message-id: address@hidden
+Signed-off-by: Gerd Hoffmann <address@hidden>
+---
+ hw/audio/es1370.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
+index 8449b5f..883ec69 100644
+--- a/hw/audio/es1370.c
++++ b/hw/audio/es1370.c
+@@ -1041,6 +1041,19 @@ static void es1370_realize(PCIDevice *dev, Error **errp)
+ es1370_reset (s);
+ }
+
++static void es1370_exit(PCIDevice *dev)
++{
++ ES1370State *s = ES1370(dev);
++ int i;
++
++ for (i = 0; i < 2; ++i) {
++ AUD_close_out(&s->card, s->dac_voice[i]);
++ }
++
++ AUD_close_in(&s->card, s->adc_voice);
++ AUD_remove_card(&s->card);
++}
++
+ static int es1370_init (PCIBus *bus)
+ {
+ pci_create_simple (bus, -1, TYPE_ES1370);
+@@ -1053,6 +1066,7 @@ static void es1370_class_init (ObjectClass *klass, void
*data)
+ PCIDeviceClass *k = PCI_DEVICE_CLASS (klass);
+
+ k->realize = es1370_realize;
++ k->exit = es1370_exit;
+ k->vendor_id = PCI_VENDOR_ID_ENSONIQ;
+ k->device_id = PCI_DEVICE_ID_ENSONIQ_ES1370;
+ k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+--
+1.7.0.4
+
diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm
index 61c15ae..693864f 100644
--- a/gnu/packages/qemu.scm
+++ b/gnu/packages/qemu.scm
@@ -1,7 +1,7 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2013, 2014, 2015, 2016 Ludovic Courtès <address@hidden>
;;; Copyright © 2015, 2016, 2017 Mark H Weaver <address@hidden>
-;;; Copyright © 2016 Efraim Flashner <address@hidden>
+;;; Copyright © 2016, 2017 Efraim Flashner <address@hidden>
;;; Copyright © 2016 Ricardo Wurmus <address@hidden>
;;;
;;; This file is part of GNU Guix.
@@ -76,7 +76,9 @@
version ".tar.bz2"))
(sha256
(base32
- "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs"))))
+ "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs"))
+ (patches (search-patches "qemu-CVE-2017-5525.patch"
+ "qemu-CVE-2017-5526.patch"))))
(build-system gnu-build-system)
(arguments
'(;; Running tests in parallel can occasionally lead to failures, like: