summaryrefslogtreecommitdiff
path: root/sysutils
diff options
context:
space:
mode:
Diffstat (limited to 'sysutils')
-rw-r--r--sysutils/xenkernel41/Makefile4
-rw-r--r--sysutils/xenkernel41/distinfo5
-rw-r--r--sysutils/xenkernel41/patches/patch-CVE-2015-783545
-rw-r--r--sysutils/xenkernel41/patches/patch-CVE-2015-796935
-rw-r--r--sysutils/xenkernel41/patches/patch-CVE-2015-797135
5 files changed, 121 insertions, 3 deletions
diff --git a/sysutils/xenkernel41/Makefile b/sysutils/xenkernel41/Makefile
index 540398090cf..94313d788d1 100644
--- a/sysutils/xenkernel41/Makefile
+++ b/sysutils/xenkernel41/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.45 2015/04/19 13:13:20 spz Exp $
+# $NetBSD: Makefile,v 1.46 2015/10/29 20:29:56 bouyer Exp $
VERSION= 4.1.6.1
DISTNAME= xen-${VERSION}
PKGNAME= xenkernel41-${VERSION}
-PKGREVISION= 16
+PKGREVISION= 17
CATEGORIES= sysutils
MASTER_SITES= http://bits.xensource.com/oss-xen/release/${VERSION}/
diff --git a/sysutils/xenkernel41/distinfo b/sysutils/xenkernel41/distinfo
index a39bcd86d69..eb23cf2b1a2 100644
--- a/sysutils/xenkernel41/distinfo
+++ b/sysutils/xenkernel41/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.37 2015/09/14 13:36:29 joerg Exp $
+$NetBSD: distinfo,v 1.38 2015/10/29 20:29:56 bouyer Exp $
SHA1 (xen-4.1.6.1.tar.gz) = e5f15feb0821578817a65ede16110c6eac01abd0
RMD160 (xen-4.1.6.1.tar.gz) = bff11421fc44a26f2cc3156713267abcb36d7a19
@@ -30,6 +30,9 @@ SHA1 (patch-CVE-2015-2045) = e1874bbde0cce7db4ee9260440f5280d404027d7
SHA1 (patch-CVE-2015-2151) = aed92f50d162febc3074f7edecaf6ca418d0b42c
SHA1 (patch-CVE-2015-2752) = 37f44989a3b3c69dea8e9de9fc34ffd5c2e8b087
SHA1 (patch-CVE-2015-2756) = b3b133d42229ecc8c308644b17e5317cd77f9a98
+SHA1 (patch-CVE-2015-7835) = d66fe84abfb921bf435c1ed9b077012937d0c71e
+SHA1 (patch-CVE-2015-7969) = 4eb96025afae4be547f74b9e71a7d8a3a37fc60b
+SHA1 (patch-CVE-2015-7971) = 0d0d36ad99f313afb96111a832eb65ddeaf8010e
SHA1 (patch-Config.mk) = a43ed1b3304d6383dc093acd128a7f373d0ca266
SHA1 (patch-xen_Makefile) = d1c7e4860221f93d90818f45a77748882486f92b
SHA1 (patch-xen_arch_x86_Rules.mk) = 6b9b4bfa28924f7d3f6c793a389f1a7ac9d228e2
diff --git a/sysutils/xenkernel41/patches/patch-CVE-2015-7835 b/sysutils/xenkernel41/patches/patch-CVE-2015-7835
new file mode 100644
index 00000000000..9b38ab4435e
--- /dev/null
+++ b/sysutils/xenkernel41/patches/patch-CVE-2015-7835
@@ -0,0 +1,45 @@
+$NetBSD: patch-CVE-2015-7835,v 1.1 2015/10/29 20:29:56 bouyer Exp $
+
+Patch for CVE-2015-7835 aka XSA-148 based on
+http://xenbits.xenproject.org/xsa/xsa148-4.4.patch
+
+--- xen/include/asm-x86/x86_32/page.h.orig 2015-10-29 20:35:24.000000000 +0100
++++ xen/include/asm-x86/x86_32/page.h 2015-10-29 20:38:02.000000000 +0100
+@@ -130,7 +130,9 @@
+ #define BASE_DISALLOW_MASK (0xFFFFF198U & ~_PAGE_NX)
+
+ #define L1_DISALLOW_MASK (BASE_DISALLOW_MASK | _PAGE_GNTTAB)
+-#define L2_DISALLOW_MASK (BASE_DISALLOW_MASK & ~_PAGE_PSE)
++#define L2_DISALLOW_MASK (unlikely(opt_allow_superpage) \
++ ? BASE_DISALLOW_MASK & ~_PAGE_PSE \
++ : BASE_DISALLOW_MASK )
+ #define L3_DISALLOW_MASK 0xFFFFF1FEU /* must-be-zero */
+
+ #endif /* __X86_32_PAGE_H__ */
+--- xen/include/asm-x86/x86_64/page.h.orig 2015-10-29 20:35:36.000000000 +0100
++++ xen/include/asm-x86/x86_64/page.h 2015-10-29 20:37:33.000000000 +0100
+@@ -167,7 +167,9 @@
+ #define BASE_DISALLOW_MASK (0xFF800198U & ~_PAGE_NX)
+
+ #define L1_DISALLOW_MASK (BASE_DISALLOW_MASK | _PAGE_GNTTAB)
+-#define L2_DISALLOW_MASK (BASE_DISALLOW_MASK & ~_PAGE_PSE)
++#define L2_DISALLOW_MASK (unlikely(opt_allow_superpage) \
++ ? BASE_DISALLOW_MASK & ~_PAGE_PSE \
++ : BASE_DISALLOW_MASK )
+ #define L3_DISALLOW_MASK (BASE_DISALLOW_MASK)
+ #define L4_DISALLOW_MASK (BASE_DISALLOW_MASK)
+
+--- xen/arch/x86/mm.c.orig 2015-10-29 20:30:55.000000000 +0100
++++ xen/arch/x86/mm.c 2015-10-29 20:32:56.000000000 +0100
+@@ -1898,7 +1898,10 @@
+ }
+
+ /* Fast path for identical mapping and presence. */
+- if ( !l2e_has_changed(ol2e, nl2e, _PAGE_PRESENT) )
++ if ( !l2e_has_changed(ol2e, nl2e,
++ unlikely(opt_allow_superpage)
++ ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
++ : _PAGE_PRESENT) )
+ {
+ adjust_guest_l2e(nl2e, d);
+ rc = UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad);
diff --git a/sysutils/xenkernel41/patches/patch-CVE-2015-7969 b/sysutils/xenkernel41/patches/patch-CVE-2015-7969
new file mode 100644
index 00000000000..200c1dd57c3
--- /dev/null
+++ b/sysutils/xenkernel41/patches/patch-CVE-2015-7969
@@ -0,0 +1,35 @@
+$NetBSD: patch-CVE-2015-7969,v 1.1 2015/10/29 20:29:56 bouyer Exp $
+
+Patch for CVE-2015-7869 aka XSA-149 + XSA-151 based on
+http://xenbits.xenproject.org/xsa/xsa149.patch
+http://xenbits.xenproject.org/xsa/xsa151.patch
+
+--- xen/common/domain.c.orig 2013-09-10 08:42:18.000000000 +0200
++++ xen/common/domain.c 2015-10-29 20:44:06.000000000 +0100
+@@ -671,6 +671,7 @@
+ xfree(d->pirq_to_evtchn);
+
+ xsm_free_security_domain(d);
++ xfree(d->vcpu);
+ free_domain_struct(d);
+
+ send_guest_global_virq(dom0, VIRQ_DOM_EXC);
+
+--- xen/common/xenoprof.c.orig
++++ xen/common/xenoprof.c
+@@ -239,6 +239,7 @@ static int alloc_xenoprof_struct(
+ d->xenoprof->rawbuf = alloc_xenheap_pages(get_order_from_pages(npages), 0);
+ if ( d->xenoprof->rawbuf == NULL )
+ {
++ xfree(d->xenoprof->vcpu);
+ xfree(d->xenoprof);
+ d->xenoprof = NULL;
+ return -ENOMEM;
+@@ -286,6 +287,7 @@ void free_xenoprof_pages(struct domain *
+ free_xenheap_pages(x->rawbuf, order);
+ }
+
++ xfree(x->vcpu);
+ xfree(x);
+ d->xenoprof = NULL;
+ }
diff --git a/sysutils/xenkernel41/patches/patch-CVE-2015-7971 b/sysutils/xenkernel41/patches/patch-CVE-2015-7971
new file mode 100644
index 00000000000..d104a07fd6c
--- /dev/null
+++ b/sysutils/xenkernel41/patches/patch-CVE-2015-7971
@@ -0,0 +1,35 @@
+$NetBSD: patch-CVE-2015-7971,v 1.1 2015/10/29 20:29:56 bouyer Exp $
+
+Patch for CVE-2015-7971 aka XSA-152, based on
+http://xenbits.xenproject.org/xsa/xsa152.patch
+
+--- xen/common/xenoprof.c.orig
++++ xen/common/xenoprof.c
+@@ -676,15 +676,13 @@ ret_t do_xenoprof_op(int op, XEN_GUEST_H
+
+ if ( (op < 0) || (op > XENOPROF_last_op) )
+ {
+- printk("xenoprof: invalid operation %d for domain %d\n",
+- op, current->domain->domain_id);
++ gdprintk(XENLOG_DEBUG, "invalid operation %d\n", op);
+ return -EINVAL;
+ }
+
+ if ( !NONPRIV_OP(op) && (current->domain != xenoprof_primary_profiler) )
+ {
+- printk("xenoprof: dom %d denied privileged operation %d\n",
+- current->domain->domain_id, op);
++ gdprintk(XENLOG_DEBUG, "denied privileged operation %d\n", op);
+ return -EPERM;
+ }
+
+@@ -907,8 +905,7 @@ ret_t do_xenoprof_op(int op, XEN_GUEST_H
+ spin_unlock(&xenoprof_lock);
+
+ if ( ret < 0 )
+- printk("xenoprof: operation %d failed for dom %d (status : %d)\n",
+- op, current->domain->domain_id, ret);
++ gdprintk(XENLOG_DEBUG, "operation %d failed: %d\n", op, ret);
+
+ return ret;
+ }
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-25 18:24:40 +0000