Package: release.debian.org Severity: normal User: release.debian....@packages.debian.org Usertags: unblock
Please unblock package qemu I've made quite big changes right before the freeze (previous package, 1:2.8+dfsg-1, uploaded on Dec-28), and these changes are now in testing. However, once they hit testing, I received huge number of complaints urging to revert these changes back. The changes are to enable recent 3d features in qemu guests (virgl) and a more featureful display frontend (gtk3 instead of sdl1). This, while a good thing to have, pulls in a large portion of various X11, drm and other graphics stuff. Upgrading to this new qemu on a headless server brings up 67 more packages, including dconf-service and other desktop-related packages. So in the newly uploaded version I reverted back these changes, returning to old good sdl1 which were well-tested and has been the only display frontend for qemu guests in Debian since the day one. Basically, we're back at status quo. This change is small (just a few lines in d/control for build dependencies), but the impact is quite large. Also, this release reverts another change, a fix for bug #829243 which broke upgrades from kernels << 4.0 (so broke upgrades from jessie, #843032 - this is a serious bug). And it also fixes a few security issues (with CVEs assigned) using patches pulled from upstream. The debdiff is below. Thank you! /mjt unblock qemu/1:2.8+dfsg-2 diff -Nru qemu-2.8+dfsg/debian/binfmt-update-in qemu-2.8+dfsg/debian/binfmt-update-in --- qemu-2.8+dfsg/debian/binfmt-update-in 2016-10-26 21:16:27.000000000 +0300 +++ qemu-2.8+dfsg/debian/binfmt-update-in 2017-01-23 14:06:09.000000000 +0300 @@ -28,14 +28,10 @@ m68k_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' microblaze_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\xba\xab' microblaze_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' - mips_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' - mips_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' - mipsel_magic='\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' - mipsel_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' - mipsn32_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' - mipsn32_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' - mipsn32el_magic='\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' - mipsn32el_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' + mips_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08' + mips_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' + mipsel_magic='\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00' + mipsel_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff' mips64_magic='\x7f\x45\x4c\x46\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08' mips64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' mips64el_magic='\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00' diff -Nru qemu-2.8+dfsg/debian/changelog qemu-2.8+dfsg/debian/changelog --- qemu-2.8+dfsg/debian/changelog 2016-12-28 15:31:37.000000000 +0300 +++ qemu-2.8+dfsg/debian/changelog 2017-01-23 14:06:54.000000000 +0300 @@ -1,3 +1,28 @@ +qemu (1:2.8+dfsg-2) unstable; urgency=medium + + * Revert "update binfmt registration for mipsn32" + Reopens: #829243 + Closes: #843032 + Will re-enable it for stretch+1, since for now upgrades + from jessie are broken (jessie comes with 3.16 kernel), + and there's no easy fix for this + * Revert "enable virtio gpu (virglrenderer) and opengl support" + Revert "switch from sdl1 to gtk3" + Revert other gtk2/drm/vte/virgl-related changes + Reopens: #813658, #839695 + The change were too close to stretch release and too large, + bringing too much graphics stuff for headless servers, + will re-think this for stretch+1. + sdl1 back: Closes: #851509 + virtio-3d bugs: Closes: #849798, #852119 + * mention closing of #769983 (multi-threaded linux-user) by 2.7 + * mention closing of #842455, CVE-2016-9101 by 2.8 + * audio-ac97-add-exit-function-CVE-2017-5525.patch (Closes: #852021) + * audio-es1370-add-exit-function-CVE-2017-5526.patch (Closes: #851910) + * watchdog-6300esb-add-exit-function-CVE-2016-10155.patch (Closes: #852232) + + -- Michael Tokarev <m...@tls.msk.ru> Mon, 23 Jan 2017 14:06:54 +0300 + qemu (1:2.8+dfsg-1) unstable; urgency=medium * new upstream release @@ -26,6 +51,7 @@ Closes: #847496, CVE-2016-9913 CVE-2016-9914 CVE-2016-9915 CVE-2016-9916 Closes: #847960, CVE-2016-9921 CVE-2016-9922 Closes: #847957, CVE-2016-9923 + Closes: #842455, CVE-2016-9101 (git2634ab7fe29b3f75d0865b719caf8f310d634aae) Closes: #819755, #833162 Hopefully closes: #844361 * remove unicore32 linux-user target, removed upstream @@ -72,6 +98,7 @@ * New upstream release, 2.7 (Closes: #748043, #839292) Closes: #838850, CVE-2016-7161 Closes: #473240 (qcow encryption support has been removed) + Closes: #769983 (multi-threaded linux-user) * removed patches which went upstream, refreshed use-data-path.patch * renamed remaining patches to include CVE#s and added Bug-Debian headers * added Depends on lsb-base to qemu-guest-agent (Closes: #840740) diff -Nru qemu-2.8+dfsg/debian/control qemu-2.8+dfsg/debian/control --- qemu-2.8+dfsg/debian/control 2016-12-28 15:08:25.000000000 +0300 +++ qemu-2.8+dfsg/debian/control 2017-01-23 13:34:27.000000000 +0300 @@ -18,8 +18,8 @@ acpica-tools, # --enable-linux-aio linux-* libaio-dev [linux-any], -# --audio-drv-list=pa,alsa,oss linux-* -# --audio-drv-list=pa,oss kfreebsd-* +# --audio-drv-list=pa,alsa,sdl,oss linux-* +# --audio-drv-list=pa,oss,sdl kfreebsd-* libasound2-dev [linux-any], # for virtfs # --enable-attr @@ -39,16 +39,12 @@ libfdt-dev, # --enable-gnutls gnutls-dev, -# gtk display (see also sdl display) -# --enable-gtk --with-gtkabi=3.0 --enable-vte - libgtk-3-dev, libvte-2.91-dev, -# opengl for sdl2 and gtk3 -# --enable-opengl -# libegl1-mesa-dev is here b/c libepoxy-dev includes header from it - libdrm-dev, libgbm-dev, libepoxy-dev, libx11-dev, libegl1-mesa-dev, -# virglrenderer: virtio gpu support for guest -# --enable-virglrenderer - libvirglrenderer-dev, +# gtk ui is almost the same as sdl but adds bloat +# --disable-gtk +## --with-gtkabi=2.0 +# libgtk2.0-dev, libvte-dev (>> 0.18.0~), +# vte is used together with gtk +# --disable-vte # libiscsi is debian-only since ubuntu/libiscsi is in universe # --enable-libiscsi libiscsi-dev (>> 1.9.0~), @@ -70,10 +66,9 @@ glusterfs-common, # --enable-vnc-sasl libsasl2-dev, -# sdl display (see also gtk display) # note: libsdl2-dev is in universe on ubuntu -# --disable-sdl --with-sdlabi=1.2 -# libsdl1.2-dev (>> 1.2.1), +# --enable-sdl --with-sdlabi=1.2 + libsdl1.2-dev (>> 1.2.1), # --enable-seccomp linux-amd64|linux-i386 libseccomp-dev (>> 2.1.0) [linux-amd64 linux-i386], # --enable-spice linux-amd64|linux-i386 @@ -89,6 +84,8 @@ # vde is debian-only since ubuntu/vde2 is in universe # --enable-vde libvdeplug-dev, +# needed for sdl + libx11-dev, # --enable-xen linux-amd64|linux-i386 libxen-dev [linux-amd64 linux-i386], # XXX need to check minimum linux-headers requiriment diff -Nru qemu-2.8+dfsg/debian/control-in qemu-2.8+dfsg/debian/control-in --- qemu-2.8+dfsg/debian/control-in 2016-12-28 15:08:13.000000000 +0300 +++ qemu-2.8+dfsg/debian/control-in 2017-01-23 13:04:57.000000000 +0300 @@ -20,8 +20,8 @@ acpica-tools, # --enable-linux-aio linux-* libaio-dev [linux-any], -# --audio-drv-list=pa,alsa,oss linux-* -# --audio-drv-list=pa,oss kfreebsd-* +# --audio-drv-list=pa,alsa,sdl,oss linux-* +# --audio-drv-list=pa,oss,sdl kfreebsd-* libasound2-dev [linux-any], # for virtfs # --enable-attr @@ -41,16 +41,12 @@ libfdt-dev, # --enable-gnutls gnutls-dev, -# gtk display (see also sdl display) -# --enable-gtk --with-gtkabi=3.0 --enable-vte - libgtk-3-dev, libvte-2.91-dev, -# opengl for sdl2 and gtk3 -# --enable-opengl -# libegl1-mesa-dev is here b/c libepoxy-dev includes header from it - libdrm-dev, libgbm-dev, libepoxy-dev, libx11-dev, libegl1-mesa-dev, -# virglrenderer: virtio gpu support for guest -# --enable-virglrenderer - libvirglrenderer-dev, +# gtk ui is almost the same as sdl but adds bloat +# --disable-gtk +## --with-gtkabi=2.0 +# libgtk2.0-dev, libvte-dev (>> 0.18.0~), +# vte is used together with gtk +# --disable-vte # libiscsi is debian-only since ubuntu/libiscsi is in universe :debian:# --enable-libiscsi :debian: libiscsi-dev (>> 1.9.0~), @@ -72,10 +68,9 @@ glusterfs-common, # --enable-vnc-sasl libsasl2-dev, -# sdl display (see also gtk display) # note: libsdl2-dev is in universe on ubuntu -# --disable-sdl --with-sdlabi=1.2 -# libsdl1.2-dev (>> 1.2.1), +# --enable-sdl --with-sdlabi=1.2 + libsdl1.2-dev (>> 1.2.1), # --enable-seccomp linux-amd64|linux-i386 libseccomp-dev (>> 2.1.0) [linux-amd64 linux-i386], # --enable-spice linux-amd64|linux-i386 @@ -91,6 +86,8 @@ # vde is debian-only since ubuntu/vde2 is in universe :debian:# --enable-vde :debian: libvdeplug-dev, +# needed for sdl + libx11-dev, # --enable-xen linux-amd64|linux-i386 libxen-dev [linux-amd64 linux-i386], # XXX need to check minimum linux-headers requiriment diff -Nru qemu-2.8+dfsg/debian/patches/audio-ac97-add-exit-function-CVE-2017-5525.patch qemu-2.8+dfsg/debian/patches/audio-ac97-add-exit-function-CVE-2017-5525.patch --- qemu-2.8+dfsg/debian/patches/audio-ac97-add-exit-function-CVE-2017-5525.patch 1970-01-01 03:00:00.000000000 +0300 +++ qemu-2.8+dfsg/debian/patches/audio-ac97-add-exit-function-CVE-2017-5525.patch 2017-01-23 13:02:09.000000000 +0300 @@ -0,0 +1,53 @@ +From: Li Qiang <liqiang...@360.cn> +Date: Wed, 14 Dec 2016 18:30:21 -0800 +Subject: audio: ac97: add exit function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Commit-Id: 12351a91da97b414eec8cdb09f1d9f41e535a401 +Bug-Debian: https://bugs.debian.org/852021 + +Currently the ac97 device emulation doesn't have a exit function, +hot unplug this device will leak some memory. Add a exit function to +avoid this. + +Signed-off-by: Li Qiang <liqiang...@360.cn> +Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> +Message-id: 58520052.4825ed0a.27a71.6...@mx.google.com +Signed-off-by: Gerd Hoffmann <kra...@redhat.com> +--- + hw/audio/ac97.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c +index cbd959e..c306575 100644 +--- a/hw/audio/ac97.c ++++ b/hw/audio/ac97.c +@@ -1387,6 +1387,16 @@ static void ac97_realize(PCIDevice *dev, Error **errp) + ac97_on_reset (&s->dev.qdev); + } + ++static void ac97_exit(PCIDevice *dev) ++{ ++ AC97LinkState *s = DO_UPCAST(AC97LinkState, dev, dev); ++ ++ AUD_close_in(&s->card, s->voice_pi); ++ AUD_close_out(&s->card, s->voice_po); ++ AUD_close_in(&s->card, s->voice_mc); ++ AUD_remove_card(&s->card); ++} ++ + static int ac97_init (PCIBus *bus) + { + pci_create_simple (bus, -1, "AC97"); +@@ -1404,6 +1414,7 @@ static void ac97_class_init (ObjectClass *klass, void *data) + PCIDeviceClass *k = PCI_DEVICE_CLASS (klass); + + k->realize = ac97_realize; ++ k->exit = ac97_exit; + k->vendor_id = PCI_VENDOR_ID_INTEL; + k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5; + k->revision = 0x01; +-- +2.1.4 + diff -Nru qemu-2.8+dfsg/debian/patches/audio-es1370-add-exit-function-CVE-2017-5526.patch qemu-2.8+dfsg/debian/patches/audio-es1370-add-exit-function-CVE-2017-5526.patch --- qemu-2.8+dfsg/debian/patches/audio-es1370-add-exit-function-CVE-2017-5526.patch 1970-01-01 03:00:00.000000000 +0300 +++ qemu-2.8+dfsg/debian/patches/audio-es1370-add-exit-function-CVE-2017-5526.patch 2017-01-23 13:02:34.000000000 +0300 @@ -0,0 +1,56 @@ +From: Li Qiang <liqiang...@360.cn> +Date: Wed, 14 Dec 2016 18:32:22 -0800 +Subject: audio: es1370: add exit function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Commit-Id: 069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da +Bug-Debian: https://bugs.debian.org/851910 + +Currently the es1370 device emulation doesn't have a exit function, +hot unplug this device will leak some memory. Add a exit function to +avoid this. + +Signed-off-by: Li Qiang <liqiang...@360.cn> +Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> +Message-id: 585200c9.a968ca0a.1ab80.4...@mx.google.com +Signed-off-by: Gerd Hoffmann <kra...@redhat.com> +--- + hw/audio/es1370.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c +index 8449b5f..883ec69 100644 +--- a/hw/audio/es1370.c ++++ b/hw/audio/es1370.c +@@ -1041,6 +1041,19 @@ static void es1370_realize(PCIDevice *dev, Error **errp) + es1370_reset (s); + } + ++static void es1370_exit(PCIDevice *dev) ++{ ++ ES1370State *s = ES1370(dev); ++ int i; ++ ++ for (i = 0; i < 2; ++i) { ++ AUD_close_out(&s->card, s->dac_voice[i]); ++ } ++ ++ AUD_close_in(&s->card, s->adc_voice); ++ AUD_remove_card(&s->card); ++} ++ + static int es1370_init (PCIBus *bus) + { + pci_create_simple (bus, -1, TYPE_ES1370); +@@ -1053,6 +1066,7 @@ static void es1370_class_init (ObjectClass *klass, void *data) + PCIDeviceClass *k = PCI_DEVICE_CLASS (klass); + + k->realize = es1370_realize; ++ k->exit = es1370_exit; + k->vendor_id = PCI_VENDOR_ID_ENSONIQ; + k->device_id = PCI_DEVICE_ID_ENSONIQ_ES1370; + k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO; +-- +2.1.4 + diff -Nru qemu-2.8+dfsg/debian/patches/series qemu-2.8+dfsg/debian/patches/series --- qemu-2.8+dfsg/debian/patches/series 2016-12-27 08:53:13.000000000 +0300 +++ qemu-2.8+dfsg/debian/patches/series 2017-01-23 13:07:31.000000000 +0300 @@ -3,3 +3,6 @@ use-data-path.patch linux-user-fix-s390x-safe-syscall-for-z900.patch doc-don-t-mention-memory-it-is-m.patch +audio-ac97-add-exit-function-CVE-2017-5525.patch +audio-es1370-add-exit-function-CVE-2017-5526.patch +watchdog-6300esb-add-exit-function-CVE-2016-10155.patch diff -Nru qemu-2.8+dfsg/debian/patches/watchdog-6300esb-add-exit-function-CVE-2016-10155.patch qemu-2.8+dfsg/debian/patches/watchdog-6300esb-add-exit-function-CVE-2016-10155.patch --- qemu-2.8+dfsg/debian/patches/watchdog-6300esb-add-exit-function-CVE-2016-10155.patch 1970-01-01 03:00:00.000000000 +0300 +++ qemu-2.8+dfsg/debian/patches/watchdog-6300esb-add-exit-function-CVE-2016-10155.patch 2017-01-23 13:07:31.000000000 +0300 @@ -0,0 +1,47 @@ +From: Li Qiang <liqiang...@360.cn> +Date: Mon, 28 Nov 2016 17:49:04 -0800 +Subject: watchdog: 6300esb: add exit function +Commit-Id: eb7a20a3616085d46aa6b4b4224e15587ec67e6e +Bug-Debian: https://bugs.debian.org/852232 + +When the Intel 6300ESB watchdog is hot unplug. The timer allocated +in realize isn't freed thus leaking memory leak. This patch avoid +this through adding the exit function. + +Signed-off-by: Li Qiang <liqiang...@360.cn> +Message-Id: <583cde9c.3223ed0a.7f0c2.8...@mx.google.com> +Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> +--- + hw/watchdog/wdt_i6300esb.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c +index a83d951..49b3cd1 100644 +--- a/hw/watchdog/wdt_i6300esb.c ++++ b/hw/watchdog/wdt_i6300esb.c +@@ -428,6 +428,14 @@ static void i6300esb_realize(PCIDevice *dev, Error **errp) + /* qemu_register_coalesced_mmio (addr, 0x10); ? */ + } + ++static void i6300esb_exit(PCIDevice *dev) ++{ ++ I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev); ++ ++ timer_del(d->timer); ++ timer_free(d->timer); ++} ++ + static WatchdogTimerModel model = { + .wdt_name = "i6300esb", + .wdt_description = "Intel 6300ESB", +@@ -441,6 +449,7 @@ static void i6300esb_class_init(ObjectClass *klass, void *data) + k->config_read = i6300esb_config_read; + k->config_write = i6300esb_config_write; + k->realize = i6300esb_realize; ++ k->exit = i6300esb_exit; + k->vendor_id = PCI_VENDOR_ID_INTEL; + k->device_id = PCI_DEVICE_ID_INTEL_ESB_9; + k->class_id = PCI_CLASS_SYSTEM_OTHER; +-- +2.1.4 + diff -Nru qemu-2.8+dfsg/debian/qemu-system-common.install qemu-2.8+dfsg/debian/qemu-system-common.install --- qemu-2.8+dfsg/debian/qemu-system-common.install 2016-12-28 15:05:43.000000000 +0300 +++ qemu-2.8+dfsg/debian/qemu-system-common.install 2017-01-23 13:04:57.000000000 +0300 @@ -1,7 +1,6 @@ debian/qemu-ifdown etc/ debian/tmp/usr/share/man/man1/qemu-system.1 debian/tmp/usr/share/qemu/keymaps -debian/tmp/usr/share/locale debian/tmp/usr/share/qemu/trace-events-all pc-bios/qemu-icon.bmp usr/share/qemu pc-bios/qemu_logo_no_text.svg usr/share/qemu diff -Nru qemu-2.8+dfsg/debian/rules qemu-2.8+dfsg/debian/rules --- qemu-2.8+dfsg/debian/rules 2016-12-28 15:06:24.000000000 +0300 +++ qemu-2.8+dfsg/debian/rules 2017-01-23 13:03:14.000000000 +0300 @@ -120,8 +120,7 @@ dh_testdir # system and utils build - # XXhack alert: opengl libs includes libdrm which is not needed - $(MAKE) -C qemu-build V=${V} OPENGL_LIBS="-lepoxy -lgbm -lX11" + $(MAKE) -C qemu-build V=${V} ifeq (${enable_system},enable) dtc -o qemu-build/pc-bios/bamboo.dtb pc-bios/bamboo.dts endif