From 1e34c2d0324cbcebab11799af2abb18f6639a535 Mon Sep 17 00:00:00 2001 From: Andrew Geissler Date: Fri, 29 May 2020 16:02:59 -0500 Subject: poky: subtree update:f468a73523..a35bf0e5d3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adrian Bunk (3): apt: Remove workarounds for host gcc < 5 apt: The C.UTF-8 locale is not portable gcc: Remove mudflap remnants Alexander Kanavin (5): devtool: do not write md5sums into upgraded recipes testresults.json: add duration of the tests as well bitbake.conf: propagate 'opengl' DISTRO_FEATURE to native/nativesdk from target libsdl2: enable opengl option for native/nativesdk, subject to 'opengl' in DISTRO_FEATURES qemu: enable virglrenderer and glx options subject to 'opengl' DISTRO_FEATURE Anuj Mittal (3): mtools: upgrade 4.0.23 -> 4.0.24 gsettings-desktop-schemas: upgrade 3.36.0 -> 3.36.1 libsoup-2.4: upgrade 2.68.4 -> 2.70.0 Aníbal Limón (3): recipes-kernel/linux-firmware: Add wlanmdsp.mbn to qcom-modem package recipes-kernel/linux-firmware: Add adreno-a630 firmware package linux-firmware: Update to 20200122 -> 20200421 Bruce Ashfield (3): linux-yocto/5.4: update to v5.4.38 linux-yocto/5.4: update to v5.4.40 kernel/reproducibility: kernel modules need SOURCE_DATE_EPOCH export Daniel Díaz (1): ltp: Add net-tools as rdependency Denys Dmytriyenko (1): xz: upgrade 5.2.4 -> 5.2.5 Diego (2): image_types: declare support for wic.zst bmap-tools: update development snapshot revision Gregor Zatko (1): sanity.bbclass: Detect and fail if 'inherit' is used in conf file Jacob Kroon (2): squashfs-tools: Backport fix for compiling with gcc 10 bitbake: doc: Clarify how task dependencies relate to RDEPENDS Jan-Simon Moeller (1): file: add bzip2-replacement-native to DEPENDS to fix sstate issue Joe Slater (2): acpica: Upgrade 20200214 -> 20200430 for gcc-10 fixes terminal.py: do not stop searching for auto Joshua Watt (7): pycryptodome: Import from meta-python pyelftools: Import from meta-python python3-pycryptodome(x): Upgrade 3.9.4 -> 3.9.7 python3-pyelftools: Upgrade 0.25 -> 0.26 diffoscope: upgrade 143 -> 144 python3-magic: upgrade 0.4.15 -> 0.4.18 checklayer: Skip layers without a collection Kai Kang (3): gcr: depends on gnupg-native libsecret: add meson option introspection Revert "webkitgtk, pinentry: require gobject-introspection-data in DISTRO_FEATURES when libsecret PACKAGECONFIG is enabled" Khem Raj (20): tune-cortexa55.inc: crc and crypto extentions are default on cortex-a55 tune-cortexa57.inc: Add new tune file gcc: Do not set -march for arm64 for libatomic aarch64: Adjust big.LITTLE tune files to use -mcpu armv8/tunes: Define TUNE_PKGARCH valgrind: Do not use outline-atomics on aarch64 gcc: Drop reverting __getauxval patch qemuarm64.conf: Use cortext-a57 as default tune glibc: Unify wordsize.h for arm and aarch64 glibc: Do not synthesize wordsize.h for arm multilibs multilib_header_wrapper.h: Remove pragma once multilib_header: Fall back to worsize form libc for bpf target multilib_header_wrapper: Drop using __MHWORDSIZE syslinux: Fix build with gcc10 valgrind: Backport upstream patch to fix __getauxval needs re2c: Upgrade to 1.3 libxcrypt: Upgrade to 4.4.16 ltp: Fix format security warnings with gcc10 musl: Update to tip of master cve-check: Run it after do_fetch Konrad Weihmann (1): lib/oe/recipeutils.py: passthrough of FETCHCMD Lee Chee Yang (1): qemu: fix CVE-2020-11869 Li Wang (1): linux-modules.tgz: fix file permissions to root Marek Vasut (1): libubootenv: Depend on zlib Martin Jansa (2): libsecret: inherit features_check webkitgtk, pinentry: require gobject-introspection-data in DISTRO_FEATURES when libsecret PACKAGECONFIG is enabled Michael Ho (6): package_rpm.bbclass: respect package overrides for the main package package.bbclass: add PACKAGE_ADD_METADATA to sstate variables package_ipk.bbclass: add PACKAGE_ADD_METADATA_IPK to sstate variables package_deb.bbclass: add PACKAGE_ADD_METADATA_DEB to sstate variables package_rpm.bbclass: add PACKAGE_ADD_METADATA_RPM to sstate variables ref-manual: add PACKAGE_ADD_METADATA documentation Ming Liu (1): at-spi2-atk: dont inherit features_check Mingli Yu (2): bison: fix the parallel build python3-setuptools: add the missing rdepends Naveen Saini (2): libva: upgrade 2.6.1 -> 2.7.1 libva-utils: upgrade 2.6.0 -> 2.7.1 Otavio Salvador (4): go-mod.bbclass: Add class for `go mod` support glide: Avoid use of 'go mod' support go-dep: Avoid use of 'go mod' support go.bbclass: Add `-trimpath` to default build flags Ovidiu Panait (4): lttng-modules: upgrade to 2.12.0 lttng-ust: upgrade to 2.12.0 lttng-modules: Fix "LTTng: vmalloc_sync_all symbol lookup failed" warnings lttng-tools: upgrade to 2.12.0 Paul Barker (2): archiver.bbclass: Make do_deploy_archives a recursive dependency avahi: Don't advertise example services by default Petr Vorel (1): ltp: Update to 20200515 Quentin Schulz (2): base/insane: Check pkgs lics are subset of recipe lics only once ref-manual: document new unlisted-pkg-lics insane-skip qa check Ricardo Ribalda (1): classes/image_types_wic: Reorder do_flush_pseudodb Richard Purdie (10): ghostscript: Remove leftover file layer.conf: Move to gatesgarth naming meta-poky/meta-yocto-bsp layer.conf: Move to depend on gatesgarth release codename ltp: Add missing dependencies on coreutils, bc, e2fsprogs and gdb resulttool/report: Remove leftover debugging resulttool/log: Add ability to dump ltp logs as well as ptest ltp: Exclude the memcg_stress tests due to timeout problems bitbake: event/ast: Add RecipePostKeyExpansion event multilib/recipes: Use new RecipePostKeyExpansion event poky.conf: Add Fedora 32, remove Ubuntu 19.04 and poky-2.7 Robert P. J. Day (3): common-licenses: add "Unlicense" license file ref-manual: delete long-unused comments in variable glossary bitbake: user manual: properly tag content as Robert Yang (1): archiver.bbclass: Fix duplicated SRC_URIs for do_ar_original Steve Sakoman (2): oeqa/concurrencytest: don't delete build directory for failed tests poky: Add Ubuntu 20.04 as a supported distro Vyacheslav Yurkov (1): bitbake: fetch2/cvs: Fix CVS fetcher clean method Wang Mingyu (6): freetype: upgrade 2.10.1 -> 2.10.2 watchdog: upgrade 5.15 -> 5.16 gnu-efi: upgrade 3.0.11 -> 3.0.12 boost: upgrade 1.72.0 -> 1.73.0 iso-codes: upgrade 4.4 -> 4.5.0 iproute2: upgrade 5.5.0 -> 5.6.0 zhengruoqin (3): make-mod-scripts: Fix dependence error. ruby: upgrade 2.7.0 -> 2.7.1 sysstat: upgrade 12.2.1 -> 12.2.2 Change-Id: I47d6a587b6f57ffd2da338f45cee51dfba471365 Signed-off-by: Andrew Geissler --- .../qemu/qemu-system-native_4.2.0.bb | 4 +- poky/meta/recipes-devtools/qemu/qemu.inc | 1 + .../qemu/qemu/CVE-2020-11869.patch | 97 ++++++++++++++++++++++ poky/meta/recipes-devtools/qemu/qemu_4.2.0.bb | 5 +- 4 files changed, 105 insertions(+), 2 deletions(-) create mode 100644 poky/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch (limited to 'poky/meta/recipes-devtools/qemu') diff --git a/poky/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb b/poky/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb index d83ee59375..7394385d30 100644 --- a/poky/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb +++ b/poky/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb @@ -9,7 +9,9 @@ DEPENDS = "glib-2.0-native zlib-native pixman-native qemu-native bison-native" EXTRA_OECONF_append = " --target-list=${@get_qemu_system_target_list(d)}" -PACKAGECONFIG ??= "fdt alsa kvm" +PACKAGECONFIG ??= "fdt alsa kvm \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer glx', '' ,d)} \ +" # Handle distros such as CentOS 5 32-bit that do not have kvm support PACKAGECONFIG_remove = "${@'kvm' if not os.path.exists('/usr/include/linux/kvm.h') else ''}" diff --git a/poky/meta/recipes-devtools/qemu/qemu.inc b/poky/meta/recipes-devtools/qemu/qemu.inc index 7a1ccf2115..126e7d442c 100644 --- a/poky/meta/recipes-devtools/qemu/qemu.inc +++ b/poky/meta/recipes-devtools/qemu/qemu.inc @@ -37,6 +37,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://CVE-2020-7211.patch \ file://0001-qemu-Do-not-include-file-if-not-exists.patch \ file://CVE-2020-11102.patch \ + file://CVE-2020-11869.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P\d+(\.\d+)+)\.tar" diff --git a/poky/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch b/poky/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch new file mode 100644 index 0000000000..ca7ffed934 --- /dev/null +++ b/poky/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch @@ -0,0 +1,97 @@ +From ac2071c3791b67fc7af78b8ceb320c01ca1b5df7 Mon Sep 17 00:00:00 2001 +From: BALATON Zoltan +Date: Mon, 6 Apr 2020 22:34:26 +0200 +Subject: [PATCH] ati-vga: Fix checks in ati_2d_blt() to avoid crash + +In some corner cases (that never happen during normal operation but a +malicious guest could program wrong values) pixman functions were +called with parameters that result in a crash. Fix this and add more +checks to disallow such cases. + +Reported-by: Ziming Zhang +Signed-off-by: BALATON Zoltan +Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu +Signed-off-by: Gerd Hoffmann + +Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=ac2071c3791b67fc7af78b8ceb320c01ca1b5df7] +CVE: CVE-2020-11869 +Signed-off-by: Lee Chee Yang +--- + hw/display/ati_2d.c | 37 ++++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c +index 42e8231..23a8ae0 100644 +--- a/hw/display/ati_2d.c ++++ b/hw/display/ati_2d.c +@@ -53,12 +53,20 @@ void ati_2d_blt(ATIVGAState *s) + s->vga.vbe_start_addr, surface_data(ds), surface_stride(ds), + surface_bits_per_pixel(ds), + (s->regs.dp_mix & GMC_ROP3_MASK) >> 16); +- int dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? +- s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width); +- int dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? +- s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height); ++ unsigned dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? ++ s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width); ++ unsigned dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? ++ s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height); + int bpp = ati_bpp_from_datatype(s); ++ if (!bpp) { ++ qemu_log_mask(LOG_GUEST_ERROR, "Invalid bpp\n"); ++ return; ++ } + int dst_stride = DEFAULT_CNTL ? s->regs.dst_pitch : s->regs.default_pitch; ++ if (!dst_stride) { ++ qemu_log_mask(LOG_GUEST_ERROR, "Zero dest pitch\n"); ++ return; ++ } + uint8_t *dst_bits = s->vga.vram_ptr + (DEFAULT_CNTL ? + s->regs.dst_offset : s->regs.default_offset); + +@@ -82,12 +90,16 @@ void ati_2d_blt(ATIVGAState *s) + switch (s->regs.dp_mix & GMC_ROP3_MASK) { + case ROP3_SRCCOPY: + { +- int src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? +- s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width); +- int src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? +- s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height); ++ unsigned src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? ++ s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width); ++ unsigned src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? ++ s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height); + int src_stride = DEFAULT_CNTL ? + s->regs.src_pitch : s->regs.default_pitch; ++ if (!src_stride) { ++ qemu_log_mask(LOG_GUEST_ERROR, "Zero source pitch\n"); ++ return; ++ } + uint8_t *src_bits = s->vga.vram_ptr + (DEFAULT_CNTL ? + s->regs.src_offset : s->regs.default_offset); + +@@ -137,8 +149,10 @@ void ati_2d_blt(ATIVGAState *s) + dst_y * surface_stride(ds), + s->regs.dst_height * surface_stride(ds)); + } +- s->regs.dst_x += s->regs.dst_width; +- s->regs.dst_y += s->regs.dst_height; ++ s->regs.dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ? ++ dst_x + s->regs.dst_width : dst_x); ++ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? ++ dst_y + s->regs.dst_height : dst_y); + break; + } + case ROP3_PATCOPY: +@@ -179,7 +193,8 @@ void ati_2d_blt(ATIVGAState *s) + dst_y * surface_stride(ds), + s->regs.dst_height * surface_stride(ds)); + } +- s->regs.dst_y += s->regs.dst_height; ++ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ? ++ dst_y + s->regs.dst_height : dst_y); + break; + } + default: +-- +1.8.3.1 diff --git a/poky/meta/recipes-devtools/qemu/qemu_4.2.0.bb b/poky/meta/recipes-devtools/qemu/qemu_4.2.0.bb index f0c1daabe1..a4018cc448 100644 --- a/poky/meta/recipes-devtools/qemu/qemu_4.2.0.bb +++ b/poky/meta/recipes-devtools/qemu/qemu_4.2.0.bb @@ -21,5 +21,8 @@ do_install_append_class-nativesdk() { PACKAGECONFIG ??= " \ fdt sdl kvm \ ${@bb.utils.filter('DISTRO_FEATURES', 'alsa xen', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer glx', '' ,d)} \ +" +PACKAGECONFIG_class-nativesdk ??= "fdt sdl kvm \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer glx', '' ,d)} \ " -PACKAGECONFIG_class-nativesdk ??= "fdt sdl kvm" -- cgit v1.2.3