QEMU is a FAST! processor emulator
CentOS Sources
2017-08-08 c6e34968ca28a92690675bff4e0d0718484dd153
import qemu-kvm-1.5.3-141.el7_4.1
1 files added
1 files modified
77 ■■■■■ changed files
SOURCES/kvm-qemu-nbd-Ignore-SIGPIPE.patch 67 ●●●●● patch | view | raw | blame | history
SPECS/qemu-kvm.spec 10 ●●●●● patch | view | raw | blame | history
SOURCES/kvm-qemu-nbd-Ignore-SIGPIPE.patch
New file
@@ -0,0 +1,67 @@
From bf7e8348d0594026abf9b17356a935b31bf07274 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 10 Jul 2017 17:52:18 +0200
Subject: [PATCH] qemu-nbd: Ignore SIGPIPE
RH-Author: Eric Blake <eblake@redhat.com>
Message-id: <20170710175218.13682-1-eblake@redhat.com>
Patchwork-id: 75718
O-Subject: [RHEL-7.4.z qemu-kvm PATCH] qemu-nbd: Ignore SIGPIPE
Bugzilla: 1468107
RH-Acked-by: John Snow <jsnow@redhat.com>
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
From: Max Reitz <mreitz@redhat.com>
qemu proper has done so for 13 years
(8a7ddc38a60648257dc0645ab4a05b33d6040063), qemu-img and qemu-io have
done so for four years (526eda14a68d5b3596be715505289b541288ef2a).
Ignoring this signal is especially important in qemu-nbd because
otherwise a client can easily take down the qemu-nbd server by dropping
the connection when the server wants to send something, for example:
$ qemu-nbd -x foo -f raw -t null-co:// &
[1] 12726
$ qemu-io -c quit nbd://localhost/bar
can't open device nbd://localhost/bar: No export with name 'bar' available
[1]  + 12726 broken pipe  qemu-nbd -x foo -f raw -t null-co://
In this case, the client sends an NBD_OPT_ABORT and closes the
connection (because it is not required to wait for a reply), but the
server replies with an NBD_REP_ACK (because it is required to reply).
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20170611123714.31292-1-mreitz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 041e32b8d9d076980b4e35317c0339e57ab888f1)
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
Conflicts:
    qemu-nbd.c - context
Fixes CVE-2017-10664
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 5 +++++
 1 file changed, 5 insertions(+)
diff --git a/qemu-nbd.c b/qemu-nbd.c
index e0f4517..fc768eb 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -363,6 +363,11 @@ int main(int argc, char **argv)
     memset(&sa_sigterm, 0, sizeof(sa_sigterm));
     sa_sigterm.sa_handler = termsig_handler;
     sigaction(SIGTERM, &sa_sigterm, NULL);
+
+#ifdef CONFIG_POSIX
+    signal(SIGPIPE, SIG_IGN);
+#endif
+
     qemu_init_exec_dir(argv[0]);
     while ((ch = getopt_long(argc, argv, sopt, lopt, &opt_ind)) != -1) {
--
1.8.3.1
SPECS/qemu-kvm.spec
@@ -76,7 +76,7 @@
Summary: QEMU is a machine emulator and virtualizer
Name: %{pkgname}%{?pkgsuffix}
Version: 1.5.3
Release: 141%{?dist}
Release: 141%{?dist}.1
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
Epoch: 10
License: GPLv2+ and LGPLv2+ and BSD
@@ -3594,6 +3594,8 @@
Patch1769: kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch
# For bz#1451614 - CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4]
Patch1770: kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch
# For bz#1468107 - CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z]
Patch1771: kvm-qemu-nbd-Ignore-SIGPIPE.patch
BuildRequires: zlib-devel
@@ -5542,6 +5544,7 @@
%patch1768 -p1
%patch1769 -p1
%patch1770 -p1
%patch1771 -p1
%build
buildarch="%{kvm_target}-softmmu"
@@ -5987,6 +5990,11 @@
%{_mandir}/man8/qemu-nbd.8*
%changelog
* Tue Jul 11 2017 Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
- kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
- Resolves: bz#1468107
  (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])
* Tue Jun 13 2017 Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
- kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
- kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]