summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu
Commit message (Collapse)AuthorAgeFilesLines
* qemu: ignore CVE-2023-1386Peter Marko2025-05-141-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream Repository: https://gitlab.com/qemu-project/qemu.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1386 Type: Security Advisory CVE: CVE-2023-1386 Score: 3.3 Analysis: - According to redhat[1] this CVE has closed as not a bug. Reference: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2223985 (From OE-Core rev: 6a5d9e3821246c39ec57fa483802e1bb74fca724) (From OE-Core rev: f7c8877395d4ec0a91cd5cf54e6c2858495746fb) Signed-off-by: Madhu Marri <madmarri@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (Converted to old CVE_CHECK_IGNORE syntax) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2024-3447Yogita Urade2024-12-092-0/+138
| | | | | | | | | | | | | | | | | | | | A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-3447 Upstream patch: https://gitlab.com/qemu-project/qemu/-/commit/2429cb7a9f460b544f4b07bcf02dbdedfc4dcb39 (From OE-Core rev: 01d7ac9244364b7f89cd2f99fff11c2417bcad03) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2024-3446Divya Chellam2024-12-097-0/+948
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest to crash the QEMU process on the host, resulting in a d enial of service or allow arbitrary code execution within the context of the QEMU process on the host. CVE-2024-3446-0004, CVE-2024-3446-0005, CVE-2024-3446-0006 are CVE fix and CVE-2024-3446-0001, CVE-2024-3446-0002, CVE-2024-3446-0003 are dependent commits to fix the CVE. References: https://nvd.nist.gov/vuln/detail/CVE-2024-3446 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/9c86c97f12c060bf7484dd931f38634e166a81f0 https://gitlab.com/qemu-project/qemu/-/commit/f63192b0544af5d3e4d5edfd85ab520fcf671377 https://gitlab.com/qemu-project/qemu/-/commit/ec0504b989ca61e03636384d3602b7bf07ffe4da https://gitlab.com/qemu-project/qemu/-/commit/ba28e0ff4d95b56dc334aac2730ab3651ffc3132 https://gitlab.com/qemu-project/qemu/-/commit/b4295bff25f7b50de1d9cc94a9c6effd40056bca https://gitlab.com/qemu-project/qemu/-/commit/f4729ec39ad97a42ceaa7b5697f84f440ea6e5dc (From OE-Core rev: db7e3a56656db0bc61ec2e35ccc149e9b90a389b) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: patch CVE-2024-6505Peter Marko2024-12-092-0/+41
| | | | | | | | | | | | | Backport patch [3] as linked from [1] via [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760 [3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb (From OE-Core rev: 7e725e126689cc44055e27a05efafb7b52e89192) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore CVE-2022-36648Peter Marko2024-12-091-0/+5
| | | | | | | | | The CVE has disputed flag in NVD DB. (From OE-Core rev: bd01091c33c1de6ae7e1605301e3f73350ee7e7e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3019Yogita Urade2024-11-023-8/+723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. CVE-2023-3019-0002 is the CVE fix and CVE-2023-3019-0001 is dependent CVE fix. fix indent issue in qemu.inc file. CVE-2023-3019 patch required Mem ReenttranceyGuard structure definition, it's defined in commit: https://github.com/qemu/qemu/commit/a2e1753b8054344f32cf94f31c6399a58794a380 but the patch is causing errors: Failed: qemux86 does not shutdown within timeout(120) so backported only required structure definition. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3019 Upstream patches: https://github.com/qemu/qemu/commit/7d0fefdf81f5973334c344f6b8e1896c309dff66 https://github.com/qemu/qemu/commit/3c0463a650008aec7de29cf84540652730510921 (From OE-Core rev: 3782e1b21882ffc5e4cc466418e066179470241e) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix for CVE-2024-4467Vijay Anusuri2024-09-166-0/+1204
| | | | | | | | | | | | | | | | | | | A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-4467 Upstream commits: https://gitlab.com/qemu-project/qemu/-/commit/bd385a5298d7062668e804d73944d52aec9549f1 https://gitlab.com/qemu-project/qemu/-/commit/2eb42a728d27a43fdcad5f37d3f65706ce6deba5 https://gitlab.com/qemu-project/qemu/-/commit/7e1110664ecbc4826f3c978ccb06b6c1bce823e6 https://gitlab.com/qemu-project/qemu/-/commit/83930780325b144a5908c45b3957b9b6457b3831 https://gitlab.com/qemu-project/qemu/-/commit/7ead946998610657d38d1a505d5f25300d4ca613 (From OE-Core rev: c23ad8c89c3dd5b6004677cd0b534e22a293134d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2024-7409Hitendra Prajapati2024-09-075-0/+625
| | | | | | | | | | | | | | | | | | | | A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-7409 Upstream Patches: https://github.com/qemu/qemu/commit/fb1c2aaa981e0a2fa6362c9985f1296b74f055ac https://github.com/qemu/qemu/commit/c8a76dbd90c2f48df89b75bef74917f90a59b623 https://gitlab.com/qemu-project/qemu/-/commit/b9b72cb3ce15b693148bd09cef7e50110566d8a0 https://gitlab.com/qemu-project/qemu/-/commit/3e7ef738c8462c45043a1d39f702a0990406a3b3 (From OE-Core rev: d84ab04dc66cb83638f96fcd2f4c67e67489c410) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix for CVE-2023-6683Vijay Anusuri2024-04-052-0/+93
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.com/qemu-project/qemu/-/commit/405484b29f6548c7b86549b0f961b906337aa68a Reference: https://security-tracker.debian.org/tracker/CVE-2023-6683 (From OE-Core rev: f099f9ff95c42444cbfa63630a6f160fd98997ed) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix CVE-2023-42467Poonam Jadhav2024-03-074-0/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. scsi-disk: allow MODE SELECT block descriptor to set the block size Link: https://github.com/qemu/qemu/commit/356c4c441ec01910314c5867c680bef80d1dd373 The MODE SELECT command can contain an optional block descriptor that can be used to set the device block size. If the block descriptor is present then update the block size on the SCSI device accordingly. This allows CDROMs to be used with A/UX which requires a CDROM drive which is capable of switching from a 2048 byte sector size to a 512 byte sector size. 2. scsi-disk: ensure block size is non-zero and changes limited to bits 8-15 Link: https://github.com/qemu/qemu/commit/55794c904df723109b228da28b5db778e0df3110 The existing code assumes that the block size can be generated from p[1] << 8 in multiple places which ignores the top and bottom 8 bits. If the block size is allowed to be set to an arbitrary value then this causes a mismatch between the value written by the guest in the block descriptor and the value subsequently read back using READ CAPACITY causing the guest to generate requests that can crash QEMU. For now restrict block size changes to bits 8-15 and also ignore requests to set the block size to 0 which causes the SCSI emulation to crash in at least one place with a divide by zero error. 3. Disallow block sizes smaller than 512 [CVE-2023-42467] Link: https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c We are doing things like nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes with a division by 0 exception. Thus disallow block sizes of 256 bytes to avoid this situation. (From OE-Core rev: e9af3d328db8a32c22bb0798fa8dbb749e3f607b) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix CVE-2023-6693Vivek Kumbhar2024-03-072-0/+75
| | | | | | | | | Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/2220e8189fb94068dbad333228659fbac819abb0] (From OE-Core rev: e993720fc31dbf94bed138b76ce33cbcd61ab9a5) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix for CVE-2024-24474Vijay Anusuri2024-03-072-0/+45
| | | | | | | | | | Upstream-Status: Backport [https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52] (From OE-Core rev: 71600de72c602e6d1ae2c3b13af6c59440affdb6) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix CVE-2023-5088Sourav Pramanik2023-12-222-0/+113
| | | | | | | | | | | | | | | | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This change is to fix CVE-2023-5088. Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e (From OE-Core rev: aa84c668bfe2436d36f49a422c775119e2412c8b) Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com> Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu 6.2.0: Fix CVE-2023-1544Niranjan Pradhan2023-11-282-0/+71
| | | | | | | | | | | | | | | Upstream Repository: https://gitlab.com/qemu-project/qemu.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1544 Type: Security Fix CVE: CVE-2023-1544 Score: 6.3 Patch: https://gitlab.com/qemu-project/qemu/-/commit/85fc35afa93c (From OE-Core rev: d019fcc99c542d49be6e1615a5c75f88f8ff5a52) Signed-off-by: Niranjan Pradhan <nirpradh@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore RHEL specific CVE-2023-2680Lee Chee Yang2023-10-251-0/+4
| | | | | | | (From OE-Core rev: a1256b8fa415002eee78427cc292b866570ee267) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2021-3638Yogita Urade2023-09-182-0/+89
| | | | | | | | | | | | | | QEMU: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write. Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3638 https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html (From OE-Core rev: ebbdbb68a7804accd5430dd05f7899599ddbacd8) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Qemu: Resolve undefined reference issue in CVE-2023-2861Siddharth2023-08-301-29/+37
| | | | | | | | | | | | | | The commit [https://github.com/openembedded/openembedded-core/commit/9bd4ddeb4b5efc65b0514d50d6991211271924c1] backports fix for CVE-2023-2861 for version 6.2.0. The 'qemu_fstat' in `do_create_others' is not defined which leads to the undefined symbol error on certain architectures. Also, the commit message says "(Mjt: drop adding qemu_fstat wrapper for 7.2 where wrappers aren't used)". So either the wrapper has to be dropped or it has to be defined. Hence, backported the main patch rather than the cherry picked one. (From OE-Core rev: 983d19dfdad361f8b3275b404f1ac0b9befc9f6c) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3180Archana Polampalli2023-08-192-0/+51
| | | | | | | | | | | | | | | | | | | A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. References: https://nvd.nist.gov/vuln/detail/CVE-2023-3180 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/49f1e02bac166821c712534aaa775f50e1afe17f (From OE-Core rev: de421cab92c49ba0f068eae9d6b458a0368fcd03) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3354 VNC: improper I/O watch removal in TLS handshake can ↵Vivek Kumbhar2023-08-192-0/+88
| | | | | | | | | lead to remote unauthenticated denial of service (From OE-Core rev: 42859fe600e5dddba3c51fa8d1e680721b73e5dc) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2020-14394Yogita Urade2023-08-192-0/+80
| | | | | | | | | | | | QEMU: infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c Reference: https://gitlab.com/qemu-project/qemu/-/issues/646 (From OE-Core rev: 057f4f77ac2e83f99c916dceb4cbbcc8de448ad4) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-2861Archana Polampalli2023-08-072-0/+173
| | | | | | | | | | | | | | | 9pfs: prevent opening special files References: https://nvd.nist.gov/vuln/detail/CVE-2023-2861 Upstream patches: https://github.com/qemu/qemu/commit/10fad73a2bf1c76c8aa9d6322755e5f877d83ce5 (From OE-Core rev: 9bd4ddeb4b5efc65b0514d50d6991211271924c1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3255Archana Polampalli2023-08-072-0/+65
| | | | | | | | | | | | | | | VNC: infinite loop in inflate_buffer() leads to denial of service References: https://nvd.nist.gov/vuln/detail/CVE-2023-3255 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/d921fea338c1059a27ce7b75309d7a2e485f710b (From OE-Core rev: 52711b1392ed0c5cbe4ddf70a94b21be2f4e6e58) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3301Archana Polampalli2023-08-072-0/+61
| | | | | | | | | | | | | | | | qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port, then qemu core dump occurs after shutdown guest References: https://nvd.nist.gov/vuln/detail/CVE-2023-3301 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 (From OE-Core rev: f549ff6db018f66a80fc65987675e8bb6afcd002) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: backport Debian patch to fix CVE-2023-0330Vijay Anusuri2023-07-262-0/+76
| | | | | | | | | | | | | import patch from ubuntu to fix CVE-2023-0330 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75] (From OE-Core rev: aae5bf06ad3c67386544f9da55aa21fbf32c3418) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Whitelist CVE-2023-0664Virendra Thakur2023-05-031-0/+5
| | | | | | | | | | | This CVE is related to Windows. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0664 (From OE-Core rev: c812189760292ae39f7c10cfbde8f11130cce085) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "qemu: fix CVE-2021-3507"pawan2023-04-113-209/+0
| | | | | | | | | | | | | | | | | This reverts commit 66575e31b76894e217350350307b30d3684ba4fa. Revert CVE-2021-3507 for qemu as it is not applicable for qemu6.2 Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3507 Conflicts: meta/recipes-devtools/qemu/qemu.inc (From OE-Core rev: b7d96c1e94f79044f86de5cdf4a0eaa61d4ee0b8) Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix compile errorKai Kang2023-02-243-0/+276
| | | | | | | | | | | | | | | | | | | Backport 2 patches and rebase 0001-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch to fix compile error: ../qemu-6.2.0/hw/display/qxl.c: In function 'qxl_phys2virt': ../qemu-6.2.0/hw/display/qxl.c:1477:67: error: 'size' undeclared (first use in this function); did you mean 'gsize'? 1477 | if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { | ^~~~ | gsize ../qemu-6.2.0/hw/display/qxl.c:1477:67: note: each undeclared identifier is reported only once for each function it appears in (From OE-Core rev: b3f42317c1932253e7e6b2fd7a263bdbd6c2f69a) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2022-4144Bhabu Bindu2023-01-262-0/+100
| | | | | | | | | | | | Add patch to fix CVE-2022-4144 Link: https://security-tracker.debian.org/tracker/CVE-2022-4144 (From OE-Core rev: 4cb3874abf4fdeb04337a48a14c765ba9b2269d4) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu-helper-native: Correctly pass program name as argv[0]Joshua Watt2022-12-011-11/+4
| | | | | | | | | | | | | | | The previous version of this wasn't correctly passing the program name as argv[0], and was also over-complicated anyway because argv[] is guaranteed to be terminated with a NULL pointer, so it can be passed directly to the execv'd process without needing to be copied. (From OE-Core rev: c8b7a0570903fc7916530c2fcffaee3b61f27301) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6edf38add3c20c44efe0588e2815bb280d22e0c4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu-helper-native: Re-write bridge helper as C programJoshua Watt2022-12-013-28/+44
| | | | | | | | | | | | | | | | | | | | | | | The bridge helper program is invoked directly from QEMU when it needs to attach to a network bridge. As such, it is subject to the environment of QEMU itself. Specifically, if bridging is enabled with direct rendering acceleration, QEMU is run with an LD_PRELOAD that attempts to preload several uninative libraries; however /bin/sh doesn't use the uninative loader which means it can fail to start with an error like: /bin/sh: symbol lookup error: sysroots-uninative/x86_64-linux/lib/librt.so.1: undefined symbol: __libc_unwind_link_get, version GLIBC_PRIVATE Converting the helper program to a C program resolves this problem because it will now use the uninative loader so the preload doesn't cause errors. (From OE-Core rev: 428a0be91eafb961f0fe92d2abccde5352c54c54) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f698e98f2f09952b34488b8cf9e73e82bd7aea07) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: add io_uring PACKAGECONFIGRoss Burton2022-11-201-0/+1
| | | | | | | | | | | | | io_uring is enabled or disabled depending on whether liburing is available, so add a PACKAGECONFIG to make this explicit, disabled by default. (From OE-Core rev: 3243b069db7629d15e4b8c25b4133f824d18520c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit daee79639c39ac6278855b35e0ddf71e52dd13f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* QEMU: CVE-2022-3165 VNC: integer underflow in vnc_client_cut_text_ext leads ↵Hitendra Prajapati2022-11-202-1/+62
| | | | | | | | | | | | to CPU exhaustion Upstream-Status: Backport from https://gitlab.com/qemu-project/qemu/-/commit/d307040b18 (From OE-Core rev: c7eb6da6fa68caf2fb0becbbebeea5e8ea2c9c56) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu-native: Add PACKAGECONFIG option for jackJeremy Puhlman2022-11-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | With libjack-devel or jack-audio-connection-kit-devel, qemu-native detects the library/header and tries to build with it. Since its missing from the sysroot, it fails to build. -O2 -fPIE -D_REENTRANT -Wno-undef -MD -MQ libcommon.fa.p/audio_jackaudio.c.o -MF libcommon.fa.p/audio_jackaudio.c.o.d -o libcommon.fa.p/audio_jackaudio.c.o -c ../qemu-6.2.0/audio/jackaudio.c | ../qemu-6.2.0/audio/jackaudio.c:34:10: fatal error: jack/jack.h: No such file or directory | 34 | #include <jack/jack.h> | | ^~~~~~~~~~~~~ | compilation terminated. (From OE-Core rev: 05eb77bd1e9e1ba59032cbb49953cab8015e37a3) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 27260be388f7f9f324ff405e7d8e254925b4ae90) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Backport patches from upstream to support float128 on qemu-ppc64Xiangyu Chen2022-10-2022-0/+2400
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Background: Due to current qemu 6.2 doesn't support float128, this cause some POSIX APIs(e.g. double difftime()..) return a wrong value, this issue can be reproduced by open_posix_testsuit difftime case[1]. The qemu upstream has already supported ppc64 float128, but need to update to qemu 7.0 or later. We backport the commits[2] from upstream to support that in qemu-ppc64 6.2.0. [1] difftime test case: https://github.com/linux-test-project/ltp/tree/master/testcases/open_posix_testsuite/conformance/interfaces/difftime [2] commits link: LINK: https://git.qemu.org/?p=qemu.git;a=commit;h=149a48f6e6ccedfa01307d45884aa480f5bf77c5 https://git.qemu.org/?p=qemu.git;a=commit;h=ba11446c40903b9d97fb75a078d43fee6444d3b6 https://git.qemu.org/?p=qemu.git;a=commit;h=bead3c9b0ff8efd652afb27923d8ab4458b3bbd9 https://git.qemu.org/?p=qemu.git;a=commit;h=10cc964030fca459591d9353571f3b1b4e1b5aec https://git.qemu.org/?p=qemu.git;a=commit;h=e706d4455b8d54252b11fc504c56df060151cb89 https://git.qemu.org/?p=qemu.git;a=commit;h=941298ecd7e3103d3789d2dd87dd0f119e81c69e https://git.qemu.org/?p=qemu.git;a=commit;h=4edf55698fc2ea30903657c63ed95db0d5548943 https://git.qemu.org/?p=qemu.git;a=commit;h=c07f82416cb7973c64d1e21c09957182b4b033dc https://git.qemu.org/?p=qemu.git;a=commit;h=e4052bb773cc829a27786d68caa22f28cff19d39 https://git.qemu.org/?p=qemu.git;a=commit;h=ffdaff8e9c698061f57a6b1827570562c5a1c909 https://git.qemu.org/?p=qemu.git;a=commit;h=201fc774e0e1cc76ec23b595968004a7b14fb6e8 https://git.qemu.org/?p=qemu.git;a=commit;h=c5df1898a147c232f0502cda5dac8df6074070fc https://git.qemu.org/?p=qemu.git;a=commit;h=38d4914c5065e14f0969161274793ded448f067f https://git.qemu.org/?p=qemu.git;a=commit;h=caf6f9b568479bea6f6d97798be670f21641a006 https://git.qemu.org/?p=qemu.git;a=commit;h=25ee608d79c1890c0f4e8c495ec8629d5712de45 https://git.qemu.org/?p=qemu.git;a=commit;h=19f0862dd8fa6510b2f5b3aff4859363602cd0cf https://git.qemu.org/?p=qemu.git;a=commit;h=5f1470b091007f24035d6d33149df49a6dd61682 https://git.qemu.org/?p=qemu.git;a=commit;h=17868d81e0074905b2c1e414af6618570e8059eb https://git.qemu.org/?p=qemu.git;a=commit;h=9193eaa901c54dbff4a91ea0b12a99e0135dbca1 https://git.qemu.org/?p=qemu.git;a=commit;h=e4318ab2e423c4caf9a88a4e99b5e234096b81a9 https://git.qemu.org/?p=qemu.git;a=commit;h=3bb1aed246d7b59ceee625a82628f7369d492a8f (From OE-Core rev: 5ed94b1d155a7d5597358a93c65dfe98ac07ea15) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2022-2962Ross Burton2022-10-202-0/+65
| | | | | | | | | | | | | | | | | Backport the fix for CVE-2022-2962. (From OE-Core rev: 943d28a3395455fd475cb6c84247d106adf5fca3) (From OE-Core rev: 8ad129d079ea53ca66a91ec9fe36bb95f2648112) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ddc4258012e0d3fa946c319b601b0e73db7ac5e6) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2021-3611Bhabu Bindu2022-10-2025-0/+4532
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per the ubuntu community [https://ubuntu.com/security/CVE-2021-3611] To fix CVE-2021-3611 we need to backport the below support patches as well Link: https://git.qemu.org/?p=qemu.git;a=commit;h=41d5e8da3d5e0a143a9fb397c9f34707ec544997 https://git.qemu.org/?p=qemu.git;a=commit;h=7ccb391ccd594b3f33de8deb293ff8d47bb4e219 https://git.qemu.org/?p=qemu.git;a=commit;h=7a36e42d9114474278ce30ba36945cc62292eb60 https://git.qemu.org/?p=qemu.git;a=commit;h=4afd0f2f220ec3dc8518b8de0d66cbf8d2fd1be7 https://git.qemu.org/?p=qemu.git;a=commit;h=23faf5694ff8054b847e9733297727be4a641132 https://git.qemu.org/?p=qemu.git;a=commit;h=ba06fe8add5b788956a7317246c6280dfc157040 https://git.qemu.org/?p=qemu.git;a=commit;h=a1d4b0a3051b3079c8db607f519bc0fcb30e17ec https://git.qemu.org/?p=qemu.git;a=commit;h=c0ee1527358474c75067993d1bb233ad3a4ee081 https://git.qemu.org/?p=qemu.git;a=commit;h=5e468a36dcdd8fd5eb04282842b72967a29875e4 https://git.qemu.org/?p=qemu.git;a=commit;h=e2d784b67dc724a9b0854b49255ba0ee8ca46543 https://git.qemu.org/?p=qemu.git;a=commit;h=959384e74e1b508acc3af6e806b3d7b87335fc2a https://git.qemu.org/?p=qemu.git;a=commit;h=392e48af3468d7f8e49db33fdc9e28b5f99276ce https://git.qemu.org/?p=qemu.git;a=commit;h=1e5a3f8b2a976054da96cbbb9de6cbac7c2efb79 https://git.qemu.org/?p=qemu.git;a=commit;h=292e13142d277c15bdd68331abc607e46628b7e1 https://git.qemu.org/?p=qemu.git;a=commit;h=2280c27afc65bb2af95dd44a88e3b7117bfe240a https://git.qemu.org/?p=qemu.git;a=commit;h=34cdea1db600540a5261dc474e986f28b637c8e6 https://git.qemu.org/?p=qemu.git;a=commit;h=24aed6bcb6b6d266149591f955c2460c28759eb4 https://git.qemu.org/?p=qemu.git;a=commit;h=cd1db8df7431edd2210ed0123e2e09b9b6d1e621 https://git.qemu.org/?p=qemu.git;a=commit;h=a423a1b523296f8798a5851aaaba64dd166c0a74 https://git.qemu.org/?p=qemu.git;a=commit;h=398f9a84ac7132e38caf7b066273734b3bf619ff https://git.qemu.org/?p=qemu.git;a=commit;h=6bebb270731758fae3114b7d24c2b12b7c325cc5 https://git.qemu.org/?p=qemu.git;a=commit;h=4a63054bce23982b99f4d3c65528e47e614086b2 Add patches to fix CVE-2021-3611 Link: https://git.qemu.org/?p=qemu.git;a=patch;h=be5a8cf347d0c47ee3e933dde075526fd8bd5c40 https://git.qemu.org/?p=qemu.git;a=patch;h=79fa99831debc9782087e834382c577215f2f511 (From OE-Core rev: 388ce95cdf17b829663764061e686bcb3a56d096) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2021-3750 for qemuVirendra Thakur2022-10-204-0/+283
| | | | | | | | | | Add patch to fix CVE-2021-3750 (From OE-Core rev: e9e945a1d22b06d10ac07345b7cebcf232a809bb) Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2022-0216Sakib Sajal2022-08-233-0/+96
| | | | | | | | | | Backport relevant patches to fix CVE-2022-0216. (From OE-Core rev: f2ebd772edd9508af9b557b184d7716a7004f46d) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2022-0358Sakib Sajal2022-08-232-0/+107
| | | | | | | | | | Backport patch to fix CVE-2022-0358. (From OE-Core rev: 99c4b60bc0266d131307e689ad3651497b3bca29) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-4158Sakib Sajal2022-08-232-0/+47
| | | | | | | | | | Backport patch to fix CVE-2021-4158. (From OE-Core rev: a171d1fa795ea41ef073f1ed34894d0c43989e6a) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-3929Sakib Sajal2022-08-232-0/+71
| | | | | | | | | | Backport patch to fix CVE-2021-3929. (From OE-Core rev: 3be3101ab1be2be58b6f27a28ca8e1ade3aff853) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-3507Sakib Sajal2022-08-233-0/+209
| | | | | | | | | | Backport relevant patches to fix CVE-2021-3507. (From OE-Core rev: 8ad9e87ac78d5dab816e489c3e5581bbdc0d297c) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: CVE-2022-35414 can perform an uninitialized read on the translate_fail ↵Hitendra Prajapati2022-08-042-0/+54
| | | | | | | | | | | | | | | | | | path, leading to an io_readx or io_writex crash Source: https://github.com/qemu/qemu MR: 119830 Type: Security Fix Disposition: Backport from https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c ChangeID: 41d6646e06319e629da574b9b2e8a3a197a73441 Description: CVE-2022-35414 qemu: can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. (From OE-Core rev: 5f236e744b5b528bdf8d95c9580c273f63c04452) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Add PACKAGECONFIG for brlapiRichard Purdie2022-07-251-0/+1
| | | | | | | | | (From OE-Core rev: 5a892e2202c70939944bc99ce192a4e4462ba2c8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 482471a617e5f682416b7ec1a920dfaeac65f1a3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix slirp determinism issueRichard Purdie2022-07-253-3/+4
| | | | | | | | | | | | | | | | | Add a PACKAGECONFIG option for slirp, defaulting to internal. This avoids the presence of libslirp on the host causing qemu to link against that instead breaking reproducibility and usability of the binary on hosts where the library isn't present. We need to add it to PACKAGECONFIG by default since users do expect slirp to be enabled in the wider community. (From OE-Core rev: 9637a46258a596ccb0a7ddc350b33a5fc6c7872e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5a9a64132bf5ecac9d611d29751226a466c4a2c1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Avoid accidental libvdeplug linkageSteve Sakoman2022-07-161-0/+1
| | | | | | | | | | Avoid accidentally linking to the vde library from the host by adding a PACKAGECONFIG for the option. (From OE-Core rev: 83ab9f51f45b73ff595fbb8d519eee4f4d48e308) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Avoid accidental librdmacm linkageRichard Purdie2022-07-161-0/+1
| | | | | | | | | | | | | Avoid accidentally linking to the rdma library from the host by adding a PACKAGECONFIG for the option. This was found on new Fedora 36 autobuilder workers. (From OE-Core rev: 84390c353d8fee55ae0eeb6a698e45d350f8141b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2a0f3cb225e4d5471155abbcd05d09bd6bf1620f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: add PACKAGECONFIG for capstoneSteve Sakoman2022-07-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Autobuilder workers were non-deterministically enabling capstone depending on whether the worker had libcapstone installed. Add PACKAGECONFIG for capstone with default off, since qemu does not require capstone support. Qemu version in dunfell has capstone in the source tree as a submodule and has configure options to enable it using that source code or using the system libcapstone. Qemu versions in master and kirkstone have removed the capstone submodule and configure options, but added libcapstone autodetection to meson. In all cases using PACKAGECONFIG will allow a deterministic build. (From OE-Core rev: 171fa2d7092db896ba0816074a435a883447fdb8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 052ef1f14d1e6a5ee34f742f65e51b20b416f79f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: backport patch for CVE-2021-4207Davide Gardenal2022-05-202-0/+44
| | | | | | | | | | | | | CVE: CVE-2021-4207 Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895 (From OE-Core rev: 4150733448aee4c27340565a4f79c86d160b2b08) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: backport patch for CVE-2021-4206Davide Gardenal2022-05-202-0/+90
| | | | | | | | | | | | | CVE: CVE-2021-4206 Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=fa892e9abb728e76afcf27323ab29c57fb0fe7aa (From OE-Core rev: 0e684c12a762534261fcd7849fdcda0bb8031c0b) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 15:14:56 +0000