From owner-svn-ports-branches@freebsd.org Tue Aug 2 02:16:30 2016 Return-Path: Delivered-To: svn-ports-branches@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9C78BBAB0BF; Tue, 2 Aug 2016 02:16:30 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6AB1E16C0; Tue, 2 Aug 2016 02:16:30 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u722GTWt004516; Tue, 2 Aug 2016 02:16:29 GMT (envelope-from junovitch@FreeBSD.org) Received: (from junovitch@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u722GSTE004509; Tue, 2 Aug 2016 02:16:28 GMT (envelope-from junovitch@FreeBSD.org) Message-Id: <201608020216.u722GSTE004509@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: junovitch set sender to junovitch@FreeBSD.org using -f From: Jason Unovitch Date: Tue, 2 Aug 2016 02:16:28 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r419464 - in branches/2016Q3: emulators/xen-kernel emulators/xen-kernel/files misc/seabios sysutils/xen-tools sysutils/xen-tools/files X-SVN-Group: ports-branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-branches@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for all the branches of the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2016 02:16:30 -0000 Author: junovitch Date: Tue Aug 2 02:16:28 2016 New Revision: 419464 URL: https://svnweb.freebsd.org/changeset/ports/419464 Log: MFH: r418136 r418138 r419430 seabios: update to 1.9.3 xen-tools: bump PORTREVISION after SeaBIOS update xen: apply XSA-{182/183/184} PR: 211482 Sponsored by: Citrix Systems R&D Approved by: ports-secteam (with hat) Security: CVE-2016-5403 Security: CVE-2016-6259 Security: CVE-2016-6258 Security: https://vuxml.FreeBSD.org/freebsd/06574c62-5854-11e6-b334-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/04cf89e3-5854-11e6-b334-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/032aa524-5854-11e6-b334-002590263bf5.html Added: branches/2016Q3/emulators/xen-kernel/files/xsa182-unstable.patch - copied unchanged from r419430, head/emulators/xen-kernel/files/xsa182-unstable.patch branches/2016Q3/emulators/xen-kernel/files/xsa183-unstable.patch - copied unchanged from r419430, head/emulators/xen-kernel/files/xsa183-unstable.patch branches/2016Q3/sysutils/xen-tools/files/xsa184-qemuu-master.patch - copied unchanged from r419430, head/sysutils/xen-tools/files/xsa184-qemuu-master.patch Modified: branches/2016Q3/emulators/xen-kernel/Makefile branches/2016Q3/misc/seabios/Makefile branches/2016Q3/misc/seabios/distinfo branches/2016Q3/sysutils/xen-tools/Makefile Directory Properties: branches/2016Q3/ (props changed) Modified: branches/2016Q3/emulators/xen-kernel/Makefile ============================================================================== --- branches/2016Q3/emulators/xen-kernel/Makefile Tue Aug 2 02:07:56 2016 (r419463) +++ branches/2016Q3/emulators/xen-kernel/Makefile Tue Aug 2 02:16:28 2016 (r419464) @@ -3,7 +3,7 @@ PORTNAME= xen PKGNAMESUFFIX= -kernel PORTVERSION= 4.7.0 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= emulators MASTER_SITES= http://bits.xensource.com/oss-xen/release/${PORTVERSION}/ @@ -39,7 +39,9 @@ PLIST_FILES= /boot/xen \ /boot/xen.4th EXTRA_PATCHES= ${FILESDIR}/0001-xen-logdirty-prevent-preemption-if-finished.patch:-p1 \ ${FILESDIR}/0002-xen-rework-paging_log_dirty_op-to-work-with-hvm-gues.patch:-p1 \ - ${FILESDIR}/kconf_arch.patch:-p1 + ${FILESDIR}/kconf_arch.patch:-p1 \ + ${FILESDIR}/xsa182-unstable.patch:-p1 \ + ${FILESDIR}/xsa183-unstable.patch:-p1 .include Copied: branches/2016Q3/emulators/xen-kernel/files/xsa182-unstable.patch (from r419430, head/emulators/xen-kernel/files/xsa182-unstable.patch) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2016Q3/emulators/xen-kernel/files/xsa182-unstable.patch Tue Aug 2 02:16:28 2016 (r419464, copy of r419430, head/emulators/xen-kernel/files/xsa182-unstable.patch) @@ -0,0 +1,102 @@ +From 00593655e231ed5ea20704120037026e33b83fbb Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Mon, 11 Jul 2016 14:32:03 +0100 +Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath + +All changes in writeability and cacheability must go through full +re-validation. + +Rework the logic as a whitelist, to make it clearer to follow. + +This is XSA-182 + +Reported-by: Jérémie Boutoille +Signed-off-by: Andrew Cooper +Reviewed-by: Tim Deegan +--- + xen/arch/x86/mm.c | 28 ++++++++++++++++------------ + xen/include/asm-x86/page.h | 1 + + 2 files changed, 17 insertions(+), 12 deletions(-) + +diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c +index dbcf6cb..56ca19f 100644 +--- a/xen/arch/x86/mm.c ++++ b/xen/arch/x86/mm.c +@@ -1852,6 +1852,14 @@ static inline int update_intpte(intpte_t *p, + _t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \ + (_m), (_v), (_ad)) + ++/* ++ * PTE flags that a guest may change without re-validating the PTE. ++ * All other bits affect translation, caching, or Xen's safety. ++ */ ++#define FASTPATH_FLAG_WHITELIST \ ++ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \ ++ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER) ++ + /* Update the L1 entry at pl1e to new value nl1e. */ + static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e, + unsigned long gl1mfn, int preserve_ad, +@@ -1891,9 +1899,8 @@ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e, + nl1e = l1e_from_pfn(page_to_mfn(page), l1e_get_flags(nl1e)); + } + +- /* Fast path for identical mapping, r/w, presence, and cachability. */ +- if ( !l1e_has_changed(ol1e, nl1e, +- PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l1e(nl1e, pt_dom); + rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu, +@@ -1970,11 +1977,8 @@ static int mod_l2_entry(l2_pgentry_t *pl2e, + return -EINVAL; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l2e_has_changed(ol2e, nl2e, +- unlikely(opt_allow_superpage) +- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT +- : _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l2e(nl2e, d); + if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) ) +@@ -2039,8 +2043,8 @@ static int mod_l3_entry(l3_pgentry_t *pl3e, + return -EINVAL; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l3e(nl3e, d); + rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad); +@@ -2103,8 +2107,8 @@ static int mod_l4_entry(l4_pgentry_t *pl4e, + return -EINVAL; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l4e(nl4e, d); + rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad); +diff --git a/xen/include/asm-x86/page.h b/xen/include/asm-x86/page.h +index 224852a..4ae387f 100644 +--- a/xen/include/asm-x86/page.h ++++ b/xen/include/asm-x86/page.h +@@ -313,6 +313,7 @@ void efi_update_l4_pgtable(unsigned int l4idx, l4_pgentry_t); + #define _PAGE_AVAIL2 _AC(0x800,U) + #define _PAGE_AVAIL _AC(0xE00,U) + #define _PAGE_PSE_PAT _AC(0x1000,U) ++#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12) + #define _PAGE_NX (cpu_has_nx ? _PAGE_NX_BIT : 0) + /* non-architectural flags */ + #define _PAGE_PAGED 0x2000U +-- +2.1.4 + Copied: branches/2016Q3/emulators/xen-kernel/files/xsa183-unstable.patch (from r419430, head/emulators/xen-kernel/files/xsa183-unstable.patch) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2016Q3/emulators/xen-kernel/files/xsa183-unstable.patch Tue Aug 2 02:16:28 2016 (r419464, copy of r419430, head/emulators/xen-kernel/files/xsa183-unstable.patch) @@ -0,0 +1,75 @@ +From 2fd4f34058fb5f87fbd80978dbd2cb458aff565d Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Wed, 15 Jun 2016 18:32:14 +0100 +Subject: [PATCH] x86/entry: Avoid SMAP violation in + compat_create_bounce_frame() + +A 32bit guest kernel might be running on user mappings. +compat_create_bounce_frame() must whitelist its guest accesses to avoid +risking a SMAP violation. + +For both variants of create_bounce_frame(), re-blacklist user accesses if +execution exits via an exception table redirection. + +This is XSA-183 / CVE-2016-6259 + +Signed-off-by: Andrew Cooper +Reviewed-by: George Dunlap +Reviewed-by: Jan Beulich +--- +v2: + * Include CLAC on the exit paths from compat_create_bounce_frame which occur + from faults attempting to load %fs + * Reposition ASM_STAC to avoid breaking the macro-op fusion of test/jz +--- + xen/arch/x86/x86_64/compat/entry.S | 3 +++ + xen/arch/x86/x86_64/entry.S | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S +index 7f02afd..e80c53c 100644 +--- a/xen/arch/x86/x86_64/compat/entry.S ++++ b/xen/arch/x86/x86_64/compat/entry.S +@@ -318,6 +318,7 @@ ENTRY(compat_int80_direct_trap) + compat_create_bounce_frame: + ASSERT_INTERRUPTS_ENABLED + mov %fs,%edi ++ ASM_STAC + testb $2,UREGS_cs+8(%rsp) + jz 1f + /* Push new frame at registered guest-OS stack base. */ +@@ -364,6 +365,7 @@ compat_create_bounce_frame: + movl TRAPBOUNCE_error_code(%rdx),%eax + .Lft8: movl %eax,%fs:(%rsi) # ERROR CODE + 1: ++ ASM_CLAC + /* Rewrite our stack frame and return to guest-OS mode. */ + /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */ + andl $~(X86_EFLAGS_VM|X86_EFLAGS_RF|\ +@@ -403,6 +405,7 @@ compat_crash_page_fault_4: + addl $4,%esi + compat_crash_page_fault: + .Lft14: mov %edi,%fs ++ ASM_CLAC + movl %esi,%edi + call show_page_walk + jmp dom_crash_sync_extable +diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S +index ad8c64c..f7178cd 100644 +--- a/xen/arch/x86/x86_64/entry.S ++++ b/xen/arch/x86/x86_64/entry.S +@@ -420,9 +420,11 @@ domain_crash_page_fault_16: + domain_crash_page_fault_8: + addq $8,%rsi + domain_crash_page_fault: ++ ASM_CLAC + movq %rsi,%rdi + call show_page_walk + ENTRY(dom_crash_sync_extable) ++ ASM_CLAC + # Get out of the guest-save area of the stack. + GET_STACK_END(ax) + leaq STACK_CPUINFO_FIELD(guest_cpu_user_regs)(%rax),%rsp +-- +2.1.4 + Modified: branches/2016Q3/misc/seabios/Makefile ============================================================================== --- branches/2016Q3/misc/seabios/Makefile Tue Aug 2 02:07:56 2016 (r419463) +++ branches/2016Q3/misc/seabios/Makefile Tue Aug 2 02:16:28 2016 (r419464) @@ -1,7 +1,7 @@ # $FreeBSD$ PORTNAME= seabios -PORTVERSION= 1.9.2 +PORTVERSION= 1.9.3 CATEGORIES= misc MASTER_SITES= http://code.coreboot.org/p/seabios/downloads/get/ Modified: branches/2016Q3/misc/seabios/distinfo ============================================================================== --- branches/2016Q3/misc/seabios/distinfo Tue Aug 2 02:07:56 2016 (r419463) +++ branches/2016Q3/misc/seabios/distinfo Tue Aug 2 02:16:28 2016 (r419464) @@ -1,2 +1,3 @@ -SHA256 (seabios-1.9.2.tar.gz) = f01d459b0e50996fdfa021eea5010776c26f739adba73957af519233165ebbe5 -SIZE (seabios-1.9.2.tar.gz) = 570726 +TIMESTAMP = 1467646492 +SHA256 (seabios-1.9.3.tar.gz) = 1ae85dc049cdee1ca953612e9ab4cec3941a4a4e744b7036624c308781b0678d +SIZE (seabios-1.9.3.tar.gz) = 571224 Modified: branches/2016Q3/sysutils/xen-tools/Makefile ============================================================================== --- branches/2016Q3/sysutils/xen-tools/Makefile Tue Aug 2 02:07:56 2016 (r419463) +++ branches/2016Q3/sysutils/xen-tools/Makefile Tue Aug 2 02:16:28 2016 (r419464) @@ -3,7 +3,7 @@ PORTNAME= xen PKGNAMESUFFIX= -tools PORTVERSION= 4.7.0 -PORTREVISION= 2 +PORTREVISION= 4 CATEGORIES= sysutils emulators MASTER_SITES= http://bits.xensource.com/oss-xen/release/${PORTVERSION}/ Copied: branches/2016Q3/sysutils/xen-tools/files/xsa184-qemuu-master.patch (from r419430, head/sysutils/xen-tools/files/xsa184-qemuu-master.patch) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2016Q3/sysutils/xen-tools/files/xsa184-qemuu-master.patch Tue Aug 2 02:16:28 2016 (r419464, copy of r419430, head/sysutils/xen-tools/files/xsa184-qemuu-master.patch) @@ -0,0 +1,43 @@ +From e469db25d6b2e5c71cd15451889226641c53a5cd Mon Sep 17 00:00:00 2001 +From: P J P +Date: Mon, 25 Jul 2016 17:37:18 +0530 +Subject: [PATCH] virtio: error out if guest exceeds virtqueue size + +A broken or malicious guest can submit more requests than the virtqueue +size permits. + +The guest can submit requests without bothering to wait for completion +and is therefore not bound by virtqueue size. This requires reusing +vring descriptors in more than one request, which is incorrect but +possible. Processing a request allocates a VirtQueueElement and +therefore causes unbounded memory allocation controlled by the guest. + +Exit with an error if the guest provides more requests than the +virtqueue size permits. This bounds memory allocation and makes the +buggy guest visible to the user. + +Reported-by: Zhenhao Hong +Signed-off-by: Stefan Hajnoczi +--- + hw/virtio/virtio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index d24f775..f8ac0fb 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -483,6 +483,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQueueElement *elem) + + max = vq->vring.num; + ++ if (vq->inuse >= max) { ++ error_report("Virtqueue size exceeded"); ++ exit(1); ++ } ++ + i = head = virtqueue_get_head(vq, vq->last_avail_idx++); + if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) { + vring_set_avail_event(vq, vq->last_avail_idx); +-- +2.1.4 +