commit: 0ad99be8a35aff4afc249dd3b596b2eed6b5c884 Author: John Helmert III <ajak <AT> gentoo <DOT> org> AuthorDate: Tue Dec 21 23:29:36 2021 +0000 Commit: John Helmert III <ajak <AT> gentoo <DOT> org> CommitDate: Tue Dec 21 23:42:17 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ad99be8
app-emulation/qemu: fix unix socket path copy This adds a patch of upstream commit 118d527f2e4baec5fe8060b22a6212468b8e4d3f. It is included in 6.2.0, but fixes a 6.1.0 regression, so committing straight to stable. Signed-off-by: John Helmert III <ajak <AT> gentoo.org> .../files/qemu-6.1.0-fix-unix-socket-copy.patch | 76 ++++++++++++++++++++++ .../{qemu-6.1.0-r2.ebuild => qemu-6.1.0-r3.ebuild} | 1 + 2 files changed, 77 insertions(+) diff --git a/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch new file mode 100644 index 000000000000..7701b26b4f9a --- /dev/null +++ b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch @@ -0,0 +1,76 @@ +commit 118d527f2e4baec5fe8060b22a6212468b8e4d3f +Author: Michael Tokarev <m...@tls.msk.ru> +Date: Wed Sep 1 16:16:24 2021 +0300 + + qemu-sockets: fix unix socket path copy (again) + + Commit 4cfd970ec188558daa6214f26203fe553fb1e01f added an + assert which ensures the path within an address of a unix + socket returned from the kernel is at least one byte and + does not exceed sun_path buffer. Both of this constraints + are wrong: + + A unix socket can be unnamed, in this case the path is + completely empty (not even \0) + + And some implementations (notable linux) can add extra + trailing byte (\0) _after_ the sun_path buffer if we + passed buffer larger than it (and we do). + + So remove the assertion (since it causes real-life breakage) + but at the same time fix the usage of sun_path. Namely, + we should not access sun_path[0] if kernel did not return + it at all (this is the case for unnamed sockets), + and use the returned salen when copyig actual path as an + upper constraint for the amount of bytes to copy - this + will ensure we wont exceed the information provided by + the kernel, regardless whenever there is a trailing \0 + or not. This also helps with unnamed sockets. + + Note the case of abstract socket, the sun_path is actually + a blob and can contain \0 characters, - it should not be + passed to g_strndup and the like, it should be accessed by + memcpy-like functions. + + Fixes: 4cfd970ec188558daa6214f26203fe553fb1e01f + Fixes: http://bugs.debian.org/993145 + Signed-off-by: Michael Tokarev <m...@tls.msk.ru> + Reviewed-by: Daniel P. Berrangé <berra...@redhat.com> + Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> + CC: qemu-sta...@nongnu.org + +diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c +index f2f3676d1f..c5043999e9 100644 +--- a/util/qemu-sockets.c ++++ b/util/qemu-sockets.c +@@ -1345,25 +1345,22 @@ socket_sockaddr_to_address_unix(struct sockaddr_storage *sa, + SocketAddress *addr; + struct sockaddr_un *su = (struct sockaddr_un *)sa; + +- assert(salen >= sizeof(su->sun_family) + 1 && +- salen <= sizeof(struct sockaddr_un)); +- + addr = g_new0(SocketAddress, 1); + addr->type = SOCKET_ADDRESS_TYPE_UNIX; ++ salen -= offsetof(struct sockaddr_un, sun_path); + #ifdef CONFIG_LINUX +- if (!su->sun_path[0]) { ++ if (salen > 0 && !su->sun_path[0]) { + /* Linux abstract socket */ +- addr->u.q_unix.path = g_strndup(su->sun_path + 1, +- salen - sizeof(su->sun_family) - 1); ++ addr->u.q_unix.path = g_strndup(su->sun_path + 1, salen - 1); + addr->u.q_unix.has_abstract = true; + addr->u.q_unix.abstract = true; + addr->u.q_unix.has_tight = true; +- addr->u.q_unix.tight = salen < sizeof(*su); ++ addr->u.q_unix.tight = salen < sizeof(su->sun_path); + return addr; + } + #endif + +- addr->u.q_unix.path = g_strndup(su->sun_path, sizeof(su->sun_path)); ++ addr->u.q_unix.path = g_strndup(su->sun_path, salen); + return addr; + } + #endif /* WIN32 */ diff --git a/app-emulation/qemu/qemu-6.1.0-r2.ebuild b/app-emulation/qemu/qemu-6.1.0-r3.ebuild similarity index 99% rename from app-emulation/qemu/qemu-6.1.0-r2.ebuild rename to app-emulation/qemu/qemu-6.1.0-r3.ebuild index b91f85e5d967..8d2ca068f00d 100644 --- a/app-emulation/qemu/qemu-6.1.0-r2.ebuild +++ b/app-emulation/qemu/qemu-6.1.0-r3.ebuild @@ -277,6 +277,7 @@ PATCHES=( "${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch "${FILESDIR}"/${PN}-6.0.0-make.patch "${FILESDIR}"/${PN}-6.1.0-strings.patch + "${FILESDIR}"/${P}-fix-unix-socket-copy.patch "${FILESDIR}"/${P}-automagic-libbpf.patch "${FILESDIR}"/${P}-data-corruption.patch )