Roger Pau Monne: 1 xen-for-2.4: XSA-41 remaining patches 3 files changed, 86 insertions(+), 1 deletions(-)
Copy & paste the following snippet into your terminal to import this patchset into git:
curl -s https://lists.alpinelinux.org/~alpine/devel/patches/392/mbox | git am -3Learn more about email & git
Some patches where not included in the original XSA, this are the remaining ones (so far). To be applied to 2.4 --- main/xen/APKBUILD | 6 +++++- main/xen/xsa41b.patch | 42 ++++++++++++++++++++++++++++++++++++++++++ main/xen/xsa41c.patch | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 86 insertions(+), 1 deletions(-) create mode 100644 main/xen/xsa41b.patch create mode 100644 main/xen/xsa41c.patch diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD index dbeee60..fddaaf5 100644 --- a/main/xen/APKBUILD +++ b/main/xen/APKBUILD @@ -3,7 +3,7 @@ # Maintainer: William Pitcock <nenolod@dereferenced.org> pkgname=xen pkgver=4.1.4 -pkgrel=2 +pkgrel=3 pkgdesc="Xen hypervisor" url="http://www.xen.org/" arch="x86 x86_64" @@ -24,6 +24,8 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g busybox-sed.patch xsa33-4.1.patch xsa41.patch + xsa41b.patch + xsa41c.patch xenstored.initd xenstored.confd @@ -125,6 +127,8 @@ fa06495a175571f4aa3b6cb88937953e librt.patch 1bea3543ddc712330527b62fd9ff6520 busybox-sed.patch 25ba4efc5eee29daa12855fbadce84f8 xsa33-4.1.patch ce56f00762139cd611dfc3332b7571cf xsa41.patch +8b8cc26190793cb9119a123f7734c175 xsa41b.patch +385e72bdfbc8240839192b2a506c87df xsa41c.patch 6e5739dad7e2bd1b625e55ddc6c782b7 xenstored.initd b017ccdd5e1c27bbf1513e3569d4ff07 xenstored.confd ed262f15fb880badb53575539468646c xenconsoled.initd diff --git a/main/xen/xsa41b.patch b/main/xen/xsa41b.patch new file mode 100644 index 0000000..3bc5cf9 --- /dev/null +++ b/main/xen/xsa41b.patch @@ -0,0 +1,42 @@ +From 70454385eeee6f0b3f7a9eddca9f7340b5060824 Mon Sep 17 00:00:00 2001 +From: Michael Contreras <michael@inetric.com> +Date: Thu, 17 Jan 2013 11:49:37 +0000 +Subject: [PATCH] e1000: Discard oversized packets based on SBP|LPE + +Discard packets longer than 16384 when !SBP to match the hardware behavior. + +upstream-commit-id: 2c0331f4f7d241995452b99afaf0aab00493334a +security-tags: XSA-41, CVE-2012-6075 +This is the second of two security fixes for XSA-41. + +Signed-off-by: Michael Contreras <michael@inetric.com> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> +--- +diff --git a/tools/ioemu-qemu-xen/hw/e1000.c b/tools/ioemu-qemu-xen/hw/e1000.c +index 37d207e..a5e67a8 100644 +--- a/tools/ioemu-qemu-xen/hw/e1000.c ++++ b/tools/ioemu-qemu-xen/hw/e1000.c +@@ -61,6 +61,8 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); + + /* this is the size past which hardware will drop packets when setting LPE=0 */ + #define MAXIMUM_ETHERNET_VLAN_SIZE 1522 ++/* this is the size past which hardware will drop packets when setting LPE=1 */ ++#define MAXIMUM_ETHERNET_LPE_SIZE 16384 + + /* + * HW models: +@@ -697,8 +699,9 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size) + } + + /* Discard oversized packets if !LPE and !SBP. */ +- if (size > MAXIMUM_ETHERNET_VLAN_SIZE +- && !(s->mac_reg[RCTL] & E1000_RCTL_LPE) ++ if ((size > MAXIMUM_ETHERNET_LPE_SIZE || ++ (size > MAXIMUM_ETHERNET_VLAN_SIZE ++ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE))) + && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { + return size; + } +-- +1.7.2.5 + diff --git a/main/xen/xsa41c.patch b/main/xen/xsa41c.patch new file mode 100644 index 0000000..14ee2b2 --- /dev/null +++ b/main/xen/xsa41c.patch @@ -0,0 +1,39 @@ +From 2a1354d655d816feaad7dbdb8364f40a208439c1 Mon Sep 17 00:00:00 2001 +From: Ian Jackson <ian.jackson@eu.citrix.com> +Date: Thu, 17 Jan 2013 15:52:16 +0000 +Subject: [PATCH] e1000: fix compile warning introduced by security fix, and debugging + +e33f918c19e393900b95a2bb6b10668dfe96a8f2, the fix for XSA-41, +and its cherry picks in 4.2 and 4.1 introduced this compiler warning: + hw/e1000.c:641: warning: 'return' with a value, in function returning void + +In upstream qemu (where this change came from), e1000_receive returns +a value used by queueing machinery to decide whether to try +resubmitting the packet later. Returning "size" means that the packet +has been dealt with and should not be retried. + +In this old branch (aka qemu-xen-traditional), this machinery is +absent and e1000_receive returns void. Fix the return statement. + +Also add a debugging statement along the lines of the others in this +function. + +Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> +--- +diff --git a/tools/ioemu-qemu-xen/hw/e1000.c b/tools/ioemu-qemu-xen/hw/e1000.c +index 67d2651..c75bc5e 100644 +--- a/tools/ioemu-qemu-xen/hw/e1000.c ++++ b/tools/ioemu-qemu-xen/hw/e1000.c +@@ -638,7 +638,8 @@ e1000_receive(void *opaque, const uint8_t *buf, int size) + (size > MAXIMUM_ETHERNET_VLAN_SIZE + && !(s->mac_reg[RCTL] & E1000_RCTL_LPE))) + && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { +- return size; ++ DBGOUT(RX, "packet too large for applicable LPE/VLAN size\n"); ++ return; + } + + if (!receive_filter(s, buf, size)) +-- +1.7.2.5 + -- 1.7.7.5 (Apple Git-26) --- Unsubscribe: alpine-devel+unsubscribe@lists.alpinelinux.org Help: alpine-devel+help@lists.alpinelinux.org ---