Pullup ticket #6423 - requested by bouyer

sysutils/xentools413: security patch

Revisions pulled up:
- sysutils/xentools413/Makefile                                 1.16
- sysutils/xentools413/distinfo                                 1.8
- sysutils/xentools413/patches/patch-XSA355                     1.1
- sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c 1.1

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	bouyer
   Date:		Wed Feb  3 22:30:22 UTC 2021

   Modified Files:
   	pkgsrc/sysutils/xentools413: Makefile distinfo
   Added Files:
   	pkgsrc/sysutils/xentools413/patches: patch-XSA355
   	    patch-tools_xenstore_xenstored_core.c

   Log Message:
   Add upstream patch for Xen Security Advisory 355
   Also, fix xenstored looping keeping the CPU 100% busy and leaking
   file descriptors.


   To generate a diff of this commit:
   cvs rdiff -u -r1.15 -r1.16 pkgsrc/sysutils/xentools413/Makefile
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/sysutils/xentools413/distinfo
   cvs rdiff -u -r0 -r1.1 pkgsrc/sysutils/xentools413/patches/patch-XSA355 \
       pkgsrc/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c

4 files changed, 59 insertions, 3 deletions

diff --git a/sysutils/xentools413/Makefile b/sysutils/xentools413/Makefile
index 578cbb1b532..1fe7e508ff9 100644
--- a/sysutils/xentools413/Makefile
+++ b/sysutils/xentools413/Makefile
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile,v 1.14 2020/12/16 17:17:08 bouyer Exp $
+# $NetBSD: Makefile,v 1.14.2.1 2021/02/18 05:21:21 spz Exp $
 #
 VERSION=	4.13.2
 
 DIST_SUBDIR=		xen413
 DISTNAME=		xen-${VERSION}
 PKGNAME=		xentools413-${VERSION}
-PKGREVISION=		2
+PKGREVISION=		3
 #PKGREVISION=		0
 CATEGORIES=		sysutils
 MASTER_SITES=		https://downloads.xenproject.org/release/xen/${VERSION}/
diff --git a/sysutils/xentools413/distinfo b/sysutils/xentools413/distinfo
index ee258f11544..254abbc1d20 100644
--- a/sysutils/xentools413/distinfo
+++ b/sysutils/xentools413/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.6.2.1 2021/01/16 16:35:04 spz Exp $
+$NetBSD: distinfo,v 1.6.2.2 2021/02/18 05:21:21 spz Exp $
 
 SHA1 (xen413/ipxe-1dd56dbd11082fb622c2ed21cfaced4f47d798a6.tar.gz) = b78d21457bc07b4c4d3e770109c169ddafdacdf5
 RMD160 (xen413/ipxe-1dd56dbd11082fb622c2ed21cfaced4f47d798a6.tar.gz) = 846dbcc0f56e87fca8c87b00ca2ed031471d4246
@@ -24,6 +24,7 @@ SHA1 (patch-XSA325) = 59c7fba006588db4accee1068072612777620ac3
 SHA1 (patch-XSA330) = dd745d8ae212f139ed32fcf8c99618fc42642d9e
 SHA1 (patch-XSA352) = 7c4479c029d9bbbf6578ee148cb926bb2d849789
 SHA1 (patch-XSA353) = 6983aa18399dcf0ac1471ffdf7c27c1bc041f49c
+SHA1 (patch-XSA355) = 73ca5dff042a4a54b06af36e6ace7d09673c05f0
 SHA1 (patch-docs_man_xl-disk-configuration.5.pod) = 9261cc5035dba3414e32955da80707baab042476
 SHA1 (patch-docs_man_xl.1.pod.in) = ac3525478471a43fd30fa40c7e89d4b5cb164038
 SHA1 (patch-docs_man_xl.cfg.5.pod.in) = 5970961552f29c4536a884161a208a27a20dccf4
@@ -98,6 +99,7 @@ SHA1 (patch-tools_xenpaging_xenpaging.c) = 0a154b97f1f452a5f80f7c9a835a1f216f12f
 SHA1 (patch-tools_xenpmd_xenpmd.c) = 851ce7a295e2f41ffcd966850d8003c82670c751
 SHA1 (patch-tools_xenstat_libxenstat_src_xenstat_netbsd.c) = e0f52d2a6ce9c92780209ed5b6f6f2ad1c175221
 SHA1 (patch-tools_xenstore_xc.c) = cf49b65cba064667e13bb041d1f0099c76ab6a40
+SHA1 (patch-tools_xenstore_xenstored_core.c) = f3d3011cb945772f298404b3505ca032a8bc06ea
 SHA1 (patch-tools_xenstore_xs_lib.c) = e3a8f6e3b149c3ab0f4ec8dcfa455983f94e6c16
 SHA1 (patch-tools_xentrace_xentrace.c) = f964c7555f454358a39f28a2e75db8ee100a4243
 SHA1 (patch-tools_xl_Makefile) = dd4fa8cc66c74eea8b022cd6129aa2831776f2a8
diff --git a/sysutils/xentools413/patches/patch-XSA355 b/sysutils/xentools413/patches/patch-XSA355
new file mode 100644
index 00000000000..c629ada1f4a
--- /dev/null
+++ b/sysutils/xentools413/patches/patch-XSA355
@@ -0,0 +1,25 @@
+$NetBSD: patch-XSA355,v 1.1.2.2 2021/02/18 05:21:21 spz Exp $
+
+From: Jan Beulich <jbeulich@suse.com>
+Subject: memory: fix off-by-one in XSA-346 change
+
+The comparison against ARRAY_SIZE() needs to be >= in order to avoid
+overrunning the pages[] array.
+
+This is XSA-355.
+
+Fixes: 5777a3742d88 ("IOMMU: hold page ref until after deferred TLB flush")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+
+--- xen/common/memory.c.orig
++++ xen/common/memory.c
+@@ -854,7 +854,7 @@ int xenmem_add_to_physmap(struct domain
+             ++extra.ppage;
+ 
+         /* Check for continuation if it's not the last iteration. */
+-        if ( (++done > ARRAY_SIZE(pages) && extra.ppage) ||
++        if ( (++done >= ARRAY_SIZE(pages) && extra.ppage) ||
+              (xatp->size > done && hypercall_preempt_check()) )
+         {
+             rc = start + done;
diff --git a/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c b/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c
new file mode 100644
index 00000000000..f1c329c3079
--- /dev/null
+++ b/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c
@@ -0,0 +1,29 @@
+$NetBSD: patch-tools_xenstore_xenstored_core.c,v 1.1.2.2 2021/02/18 05:21:21 spz Exp $
+
+On error, don't keep socket connection in ignored state but close them.
+When the remote end of a socket is closed, xenstored will flag it as an
+error and switch the connection to ignored. But on some OSes (e.g.
+NetBSD), poll(2) will return only POLLIN in this case, so sockets in ignored
+state will stay open forever in xenstored (and it will loop with CPU 100%
+busy).
+
+Signed-off-by: Manuel Bouyer <bouyer@netbsd.org>
+Fixes: d2fa370d3ef9cbe22d7256c608671cdcdf6e0083
+---
+ tools/xenstore/xenstored_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
+index 1ab6f162cb..0fea598352 100644
+--- tools/xenstore/xenstored_core.c.orig
++++ tools/xenstore/xenstored_core.c
+@@ -1440,6 +1440,9 @@ static void ignore_connection(struct connection *conn)
+ 
+ 	talloc_free(conn->in);
+ 	conn->in = NULL;
++	/* if this is a socket connection, drop it now */
++	if (conn->fd >= 0)
++		talloc_free(conn);
+ }
+ 
+ static const char *sockmsg_string(enum xsd_sockmsg_type type)