commit: 0ad99be8a35aff4afc249dd3b596b2eed6b5c884
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 21 23:29:36 2021 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Tue Dec 21 23:42:17 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ad99be8
app-emulation/qemu: fix unix socket path copy
This adds a patch of upstream commit
118d527f2e4baec5fe8060b22a6212468b8e4d3f. It is included in 6.2.0, but
fixes a 6.1.0 regression, so committing straight to stable.
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
.../files/qemu-6.1.0-fix-unix-socket-copy.patch | 76 ++++++++++++++++++++++
.../{qemu-6.1.0-r2.ebuild => qemu-6.1.0-r3.ebuild} | 1 +
2 files changed, 77 insertions(+)
diff --git a/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch
b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch
new file mode 100644
index 000000000000..7701b26b4f9a
--- /dev/null
+++ b/app-emulation/qemu/files/qemu-6.1.0-fix-unix-socket-copy.patch
@@ -0,0 +1,76 @@
+commit 118d527f2e4baec5fe8060b22a6212468b8e4d3f
+Author: Michael Tokarev <m...@tls.msk.ru>
+Date: Wed Sep 1 16:16:24 2021 +0300
+
+ qemu-sockets: fix unix socket path copy (again)
+
+ Commit 4cfd970ec188558daa6214f26203fe553fb1e01f added an
+ assert which ensures the path within an address of a unix
+ socket returned from the kernel is at least one byte and
+ does not exceed sun_path buffer. Both of this constraints
+ are wrong:
+
+ A unix socket can be unnamed, in this case the path is
+ completely empty (not even \0)
+
+ And some implementations (notable linux) can add extra
+ trailing byte (\0) _after_ the sun_path buffer if we
+ passed buffer larger than it (and we do).
+
+ So remove the assertion (since it causes real-life breakage)
+ but at the same time fix the usage of sun_path. Namely,
+ we should not access sun_path[0] if kernel did not return
+ it at all (this is the case for unnamed sockets),
+ and use the returned salen when copyig actual path as an
+ upper constraint for the amount of bytes to copy - this
+ will ensure we wont exceed the information provided by
+ the kernel, regardless whenever there is a trailing \0
+ or not. This also helps with unnamed sockets.
+
+ Note the case of abstract socket, the sun_path is actually
+ a blob and can contain \0 characters, - it should not be
+ passed to g_strndup and the like, it should be accessed by
+ memcpy-like functions.
+
+ Fixes: 4cfd970ec188558daa6214f26203fe553fb1e01f
+ Fixes: http://bugs.debian.org/993145
+ Signed-off-by: Michael Tokarev <m...@tls.msk.ru>
+ Reviewed-by: Daniel P. Berrangé <berra...@redhat.com>
+ Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
+ CC: qemu-sta...@nongnu.org
+
+diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
+index f2f3676d1f..c5043999e9 100644
+--- a/util/qemu-sockets.c
++++ b/util/qemu-sockets.c
+@@ -1345,25 +1345,22 @@ socket_sockaddr_to_address_unix(struct
sockaddr_storage *sa,
+ SocketAddress *addr;
+ struct sockaddr_un *su = (struct sockaddr_un *)sa;
+
+- assert(salen >= sizeof(su->sun_family) + 1 &&
+- salen <= sizeof(struct sockaddr_un));
+-
+ addr = g_new0(SocketAddress, 1);
+ addr->type = SOCKET_ADDRESS_TYPE_UNIX;
++ salen -= offsetof(struct sockaddr_un, sun_path);
+ #ifdef CONFIG_LINUX
+- if (!su->sun_path[0]) {
++ if (salen > 0 && !su->sun_path[0]) {
+ /* Linux abstract socket */
+- addr->u.q_unix.path = g_strndup(su->sun_path + 1,
+- salen - sizeof(su->sun_family) - 1);
++ addr->u.q_unix.path = g_strndup(su->sun_path + 1, salen - 1);
+ addr->u.q_unix.has_abstract = true;
+ addr->u.q_unix.abstract = true;
+ addr->u.q_unix.has_tight = true;
+- addr->u.q_unix.tight = salen < sizeof(*su);
++ addr->u.q_unix.tight = salen < sizeof(su->sun_path);
+ return addr;
+ }
+ #endif
+
+- addr->u.q_unix.path = g_strndup(su->sun_path, sizeof(su->sun_path));
++ addr->u.q_unix.path = g_strndup(su->sun_path, salen);
+ return addr;
+ }
+ #endif /* WIN32 */
diff --git a/app-emulation/qemu/qemu-6.1.0-r2.ebuild
b/app-emulation/qemu/qemu-6.1.0-r3.ebuild
similarity index 99%
rename from app-emulation/qemu/qemu-6.1.0-r2.ebuild
rename to app-emulation/qemu/qemu-6.1.0-r3.ebuild
index b91f85e5d967..8d2ca068f00d 100644
--- a/app-emulation/qemu/qemu-6.1.0-r2.ebuild
+++ b/app-emulation/qemu/qemu-6.1.0-r3.ebuild
@@ -277,6 +277,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
"${FILESDIR}"/${PN}-6.0.0-make.patch
"${FILESDIR}"/${PN}-6.1.0-strings.patch
+ "${FILESDIR}"/${P}-fix-unix-socket-copy.patch
"${FILESDIR}"/${P}-automagic-libbpf.patch
"${FILESDIR}"/${P}-data-corruption.patch
)
