[indi-apogee/f20] EVR bump to build with libindi 0.9.9
by Sergio Pascual
commit dd7934d086ce56a9ff99e928be1381490a7121c7
Author: Sergio Pascual <sergiopr(a)fis.ucm.es>
Date: Mon Dec 1 00:56:14 2014 +0100
EVR bump to build with libindi 0.9.9
indi-apogee.spec | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
---
diff --git a/indi-apogee.spec b/indi-apogee.spec
index 021c96d..c7a3e7d 100644
--- a/indi-apogee.spec
+++ b/indi-apogee.spec
@@ -1,6 +1,6 @@
Name: indi-apogee
Version: 1.0
-Release: 14%{?dist}
+Release: 14%{?dist}.1
Summary: The INDI driver for Apogee Alta (U & E) line of CCDs
Group: Development/Libraries
@@ -39,6 +39,9 @@ make install DESTDIR=%{buildroot}
%{_datadir}/indi/*
%changelog
+* Sun Nov 30 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> - 1.0-14.1
+- EVR bump to build with libindi 0.9.9
+
* Sun Nov 30 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> - 1.0-14
- EVR bump to build with libindi 0.9.9
8Â years, 10Â months
[indi-apogee/f20] EVR bump to build with libindi 0.9.9
by Sergio Pascual
commit c591565d459563e1d1f9047507b32def4593c16d
Author: Sergio Pascual <sergiopr(a)fis.ucm.es>
Date: Mon Dec 1 00:32:49 2014 +0100
EVR bump to build with libindi 0.9.9
indi-apogee.spec | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
---
diff --git a/indi-apogee.spec b/indi-apogee.spec
index cf7db50..021c96d 100644
--- a/indi-apogee.spec
+++ b/indi-apogee.spec
@@ -1,6 +1,6 @@
Name: indi-apogee
Version: 1.0
-Release: 13%{?dist}
+Release: 14%{?dist}
Summary: The INDI driver for Apogee Alta (U & E) line of CCDs
Group: Development/Libraries
@@ -39,6 +39,9 @@ make install DESTDIR=%{buildroot}
%{_datadir}/indi/*
%changelog
+* Sun Nov 30 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> - 1.0-14
+- EVR bump to build with libindi 0.9.9
+
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.0-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
8Â years, 10Â months
[qemu/f20] Fix SLES11 migration issue (bz #1109427) CVE-2014-7840: insufficient parameter validation during ram
by Cole Robinson
commit 56715e285b6128fe0a9fbf9a38ce445d908d0119
Author: Cole Robinson <crobinso(a)redhat.com>
Date: Sun Nov 30 18:12:22 2014 -0500
Fix SLES11 migration issue (bz #1109427)
CVE-2014-7840: insufficient parameter validation during ram load (bz #1163080)
...sure-time-in-migration-never-goes-backwar.patch | 98 ++++++++++++++++++++
...sure-proper-env-tsc-value-for-kvmclock_cu.patch | 42 +++++++++
...tion-fix-parameter-validation-on-ram-load.patch | 56 +++++++++++
qemu.spec | 19 ++++-
4 files changed, 214 insertions(+), 1 deletions(-)
---
diff --git a/0419-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch b/0419-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch
new file mode 100644
index 0000000..5d1739a
--- /dev/null
+++ b/0419-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch
@@ -0,0 +1,98 @@
+From: Alexander Graf <agraf(a)suse.de>
+Date: Fri, 5 Sep 2014 10:52:45 -0300
+Subject: [PATCH] kvmclock: Ensure time in migration never goes backward
+
+When we migrate we ask the kernel about its current belief on what the guest
+time would be. However, I've seen cases where the kvmclock guest structure
+indicates a time more recent than the kvm returned time.
+
+To make sure we never go backwards, calculate what the guest would have seen as time at the point of migration and use that value instead of the kernel returned one when it's more recent.
+This bases the view of the kvmclock after migration on the
+same foundation in host as well as guest.
+
+Signed-off-by: Alexander Graf <agraf(a)suse.de>
+Cc: qemu-stable(a)nongnu.org
+Reviewed-by: Marcelo Tosatti <mtosatti(a)redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
+(cherry picked from commit 9a48bcd1b82494671c111109b0eefdb882581499)
+---
+ hw/i386/kvm/clock.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
+index e89e2f7..2fea4eb 100644
+--- a/hw/i386/kvm/clock.c
++++ b/hw/i386/kvm/clock.c
+@@ -14,6 +14,7 @@
+ */
+
+ #include "qemu-common.h"
++#include "qemu/host-utils.h"
+ #include "sysemu/sysemu.h"
+ #include "sysemu/kvm.h"
+ #include "hw/sysbus.h"
+@@ -34,6 +35,48 @@ typedef struct KVMClockState {
+ bool clock_valid;
+ } KVMClockState;
+
++struct pvclock_vcpu_time_info {
++ uint32_t version;
++ uint32_t pad0;
++ uint64_t tsc_timestamp;
++ uint64_t system_time;
++ uint32_t tsc_to_system_mul;
++ int8_t tsc_shift;
++ uint8_t flags;
++ uint8_t pad[2];
++} __attribute__((__packed__)); /* 32 bytes */
++
++static uint64_t kvmclock_current_nsec(KVMClockState *s)
++{
++ CPUState *cpu = first_cpu;
++ CPUX86State *env = cpu->env_ptr;
++ hwaddr kvmclock_struct_pa = env->system_time_msr & ~1ULL;
++ uint64_t migration_tsc = env->tsc;
++ struct pvclock_vcpu_time_info time;
++ uint64_t delta;
++ uint64_t nsec_lo;
++ uint64_t nsec_hi;
++ uint64_t nsec;
++
++ if (!(env->system_time_msr & 1ULL)) {
++ /* KVM clock not active */
++ return 0;
++ }
++
++ cpu_physical_memory_read(kvmclock_struct_pa, &time, sizeof(time));
++
++ assert(time.tsc_timestamp <= migration_tsc);
++ delta = migration_tsc - time.tsc_timestamp;
++ if (time.tsc_shift < 0) {
++ delta >>= -time.tsc_shift;
++ } else {
++ delta <<= time.tsc_shift;
++ }
++
++ mulu64(&nsec_lo, &nsec_hi, delta, time.tsc_to_system_mul);
++ nsec = (nsec_lo >> 32) | (nsec_hi << 32);
++ return nsec + time.system_time;
++}
+
+ static void kvmclock_vm_state_change(void *opaque, int running,
+ RunState state)
+@@ -45,9 +88,15 @@ static void kvmclock_vm_state_change(void *opaque, int running,
+
+ if (running) {
+ struct kvm_clock_data data;
++ uint64_t time_at_migration = kvmclock_current_nsec(s);
+
+ s->clock_valid = false;
+
++ /* We can't rely on the migrated clock value, just discard it */
++ if (time_at_migration) {
++ s->clock = time_at_migration;
++ }
++
+ data.clock = s->clock;
+ data.flags = 0;
+ ret = kvm_vm_ioctl(kvm_state, KVM_SET_CLOCK, &data);
diff --git a/0420-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch b/0420-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch
new file mode 100644
index 0000000..e939e46
--- /dev/null
+++ b/0420-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch
@@ -0,0 +1,42 @@
+From: Marcelo Tosatti <mtosatti(a)redhat.com>
+Date: Fri, 5 Sep 2014 10:52:47 -0300
+Subject: [PATCH] kvmclock: Ensure proper env->tsc value for
+ kvmclock_current_nsec calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Ensure proper env->tsc value for kvmclock_current_nsec calculation.
+
+Reported-by: Marcin Gibuła <m.gibula(a)beyond.pl>
+Analyzed-by: Marcin Gibuła <m.gibula(a)beyond.pl>
+Cc: qemu-stable(a)nongnu.org
+Signed-off-by: Marcelo Tosatti <mtosatti(a)redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
+(cherry picked from commit 317b0a6d8ba44e9bf8f9c3dbd776c4536843d82c)
+---
+ hw/i386/kvm/clock.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
+index 2fea4eb..eaf3f0a 100644
+--- a/hw/i386/kvm/clock.c
++++ b/hw/i386/kvm/clock.c
+@@ -17,6 +17,7 @@
+ #include "qemu/host-utils.h"
+ #include "sysemu/sysemu.h"
+ #include "sysemu/kvm.h"
++#include "sysemu/cpus.h"
+ #include "hw/sysbus.h"
+ #include "hw/kvm/clock.h"
+
+@@ -124,6 +125,9 @@ static void kvmclock_vm_state_change(void *opaque, int running,
+ if (s->clock_valid) {
+ return;
+ }
++
++ cpu_synchronize_all_states();
++ cpu_clean_all_dirty();
+ ret = kvm_vm_ioctl(kvm_state, KVM_GET_CLOCK, &data);
+ if (ret < 0) {
+ fprintf(stderr, "KVM_GET_CLOCK failed: %s\n", strerror(ret));
diff --git a/0421-migration-fix-parameter-validation-on-ram-load.patch b/0421-migration-fix-parameter-validation-on-ram-load.patch
new file mode 100644
index 0000000..758eabb
--- /dev/null
+++ b/0421-migration-fix-parameter-validation-on-ram-load.patch
@@ -0,0 +1,56 @@
+From: "Michael S. Tsirkin" <mst(a)redhat.com>
+Date: Wed, 12 Nov 2014 11:44:39 +0200
+Subject: [PATCH] migration: fix parameter validation on ram load
+
+During migration, the values read from migration stream during ram load
+are not validated. Especially offset in host_from_stream_offset() and
+also the length of the writes in the callers of said function.
+
+To fix this, we need to make sure that the [offset, offset + length]
+range fits into one of the allocated memory regions.
+
+Validating addr < len should be sufficient since data seems to always be
+managed in TARGET_PAGE_SIZE chunks.
+
+Fixes: CVE-2014-7840
+
+Note: follow-up patches add extra checks on each block->host access.
+
+Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini(a)redhat.com>
+Reviewed-by: Dr. David Alan Gilbert <dgilbert(a)redhat.com>
+Signed-off-by: Amit Shah <amit.shah(a)redhat.com>
+(cherry picked from commit 0be839a2701369f669532ea5884c15bead1c6e08)
+
+Conflicts:
+ arch_init.c
+---
+ arch_init.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch_init.c b/arch_init.c
+index 23151b3..b6f7958 100644
+--- a/arch_init.c
++++ b/arch_init.c
+@@ -816,8 +816,8 @@ static inline void *host_from_stream_offset(QEMUFile *f,
+ uint8_t len;
+
+ if (flags & RAM_SAVE_FLAG_CONTINUE) {
+- if (!block) {
+- fprintf(stderr, "Ack, bad migration stream!\n");
++ if (!block || block->length <= offset) {
++ fprintf(stderr, "Ack, bad migration stream!");
+ return NULL;
+ }
+
+@@ -829,8 +829,9 @@ static inline void *host_from_stream_offset(QEMUFile *f,
+ id[len] = 0;
+
+ QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+- if (!strncmp(id, block->idstr, sizeof(id)))
++ if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) {
+ return memory_region_get_ram_ptr(block->mr) + offset;
++ }
+ }
+
+ fprintf(stderr, "Can't find block %s!\n", id);
diff --git a/qemu.spec b/qemu.spec
index abb9c3b..10dedc4 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -139,7 +139,7 @@
Summary: QEMU is a FAST! processor emulator
Name: qemu
Version: 1.6.2
-Release: 10%{?dist}
+Release: 11%{?dist}
Epoch: 2
License: GPLv2+ and LGPLv2+ and BSD
Group: Development/Tools
@@ -369,6 +369,12 @@ Patch0415: 0415-vmware-vga-add-vmsvga_verify_rect.patch
Patch0416: 0416-vmware-vga-use-vmsvga_verify_rect-in-vmsvga_update_r.patch
Patch0417: 0417-vmware-vga-use-vmsvga_verify_rect-in-vmsvga_copy_rec.patch
Patch0418: 0418-vmware-vga-use-vmsvga_verify_rect-in-vmsvga_fill_rec.patch
+# Fix SLES11 migration issue (bz #1109427)
+Patch0419: 0419-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch
+Patch0420: 0420-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch
+# CVE-2014-7840: insufficient parameter validation during ram load (bz
+# #1163080)
+Patch0421: 0421-migration-fix-parameter-validation-on-ram-load.patch
BuildRequires: SDL-devel
BuildRequires: zlib-devel
@@ -1070,6 +1076,12 @@ CAC emulation development files.
%patch0416 -p1
%patch0417 -p1
%patch0418 -p1
+# Fix SLES11 migration issue (bz #1109427)
+%patch0419 -p1
+%patch0420 -p1
+# CVE-2014-7840: insufficient parameter validation during ram load (bz
+# #1163080)
+%patch0421 -p1
%build
@@ -1777,6 +1789,11 @@ getent passwd qemu >/dev/null || \
%endif
%changelog
+* Sun Nov 30 2014 Cole Robinson <crobinso(a)redhat.com> - 2:1.6.2-11
+- Fix SLES11 migration issue (bz #1109427)
+- CVE-2014-7840: insufficient parameter validation during ram load (bz
+ #1163080)
+
* Wed Oct 29 2014 Cole Robinson <crobinso(a)redhat.com> - 2:1.6.2-10
- CVE-2014-7815 vnc: insufficient bits_per_pixel from the client sanitization
(bz #1157647, bz #1157641)
8Â years, 10Â months
[libindi/f20: 11/11] New upstream source (0.9.9)
by Sergio Pascual
commit a14d4da7bc4cbb3cea0914f99afa8147efe64cda
Author: Sergio Pascual <sergiopr(a)fis.ucm.es>
Date: Mon Dec 1 00:09:27 2014 +0100
New upstream source (0.9.9)
- Removed patches ported upstream
- Update required by kstars 2.2.0 (bz rh #1168104)
libindi.spec | 27 ++-------------------------
1 files changed, 2 insertions(+), 25 deletions(-)
---
diff --git a/libindi.spec b/libindi.spec
index 5ac845f..eb1006d 100644
--- a/libindi.spec
+++ b/libindi.spec
@@ -70,31 +70,8 @@ make install DESTDIR=%{buildroot}
%changelog
* Mon Oct 06 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> 0.9.9-1
- New upstream source (0.9.9)
-- Removed patched ported upstream
-
-* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 0.9.8.1-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Mon Jul 28 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 0.9.8.1-6
-- rebuild (libnova)
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 0.9.8.1-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Mon May 12 2014 Marcin Juszkiewicz <mjuszkiewicz(a)redhat.com> 0.9.8.1-4
-- Add AArch64 definitions where needed.
-
-* Fri May 09 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> 0.9.8.1-3
-- Plugin directory has to be arch-dependent
-
-* Sun Apr 27 2014 Christian Dersch <chrisdersch(a)gmail.com> 0.9.8.1-2
-- Fix wrong upstream version
-
-* Thu Apr 24 2014 Sergio Pascual <sergiopr(a)fedoraproject.org> 0.9.8.1-1
-- New upstream source (0.9.8.1)
-
-* Tue Dec 03 2013 Sergio Pascual <sergiopr(a)fedoraproject.org> 0.9.7-1
-- New upstream source (0.9.7)
+- Removed patches ported upstream
+- Update required by kstars 2.2.0 (bz rh #1168104)
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 0.9.6-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
8Â years, 10Â months
[qemu] Add sources
by Cole Robinson
commit bd7b20725bf131513b8dad8223bc6a15e292a893
Author: Cole Robinson <crobinso(a)redhat.com>
Date: Sun Nov 30 17:45:14 2014 -0500
Add sources
sources | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/sources b/sources
index eff7bc0..89b1ace 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-2da53c1c44ee769f9827f68e2412c9c5 qemu-2.2.0-rc1.tar.bz2
+ec1fb40cda4be1cb8cc183a25dce7965 qemu-2.2.0-rc3.tar.bz2
8Â years, 10Â months
[qemu] Update to qemu-2.2.0-rc3
by Cole Robinson
commit 1be48f0df6e21b7cceae8900f105e243868bff7c
Author: Cole Robinson <crobinso(a)redhat.com>
Date: Sun Nov 30 17:19:56 2014 -0500
Update to qemu-2.2.0-rc3
qemu.spec | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
---
diff --git a/qemu.spec b/qemu.spec
index 792c069..e7d010f 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -153,7 +153,7 @@
Summary: QEMU is a FAST! processor emulator
Name: qemu
Version: 2.2.0
-Release: 0.1.rc1%{?dist}
+Release: 0.2.rc3%{?dist}
Epoch: 2
License: GPLv2+ and LGPLv2+ and BSD
Group: Development/Tools
@@ -168,7 +168,7 @@ ExclusiveArch: %{kvm_archs}
%define _smp_mflags %{nil}
%endif
-Source0: http://wiki.qemu-project.org/download/%{name}-%{version}-rc1.tar.bz2
+Source0: http://wiki.qemu-project.org/download/%{name}-%{version}-rc3.tar.bz2
Source1: qemu.binfmt
@@ -731,7 +731,7 @@ CAC emulation development files.
%prep
-%setup -q -n qemu-2.2.0-rc1
+%setup -q -n qemu-2.2.0-rc3
%build
%if %{with kvmonly}
@@ -1500,6 +1500,9 @@ getent passwd qemu >/dev/null || \
%endif
%changelog
+* Sun Nov 30 2014 Cole Robinson <crobinso(a)redhat.com> - 2:2.2.0-0.2.rc3
+- Update to qemu-2.2.0-rc3
+
* Sat Nov 15 2014 Cole Robinson <crobinso(a)redhat.com> - 2:2.2.0-0.1.rc1
- Update to qemu-2.2.0-rc1
8Â years, 10Â months