Re: [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

Re: [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

[Steve Sakoman]

On Sat, Aug 26, 2023 at 10:08 PM Weihmann, Konrad (Avnet Embedded)
<Konrad.Weihmann@avnet.eu> wrote:
>
> Hi all,
>
>
>
> this mentioned patch is needed to fix the currently broken Yocto 4.0.12 release.
>
> This there a plan to issue a hotfix tag release, or will this be part of the next 4.0.13 in roughly 6 weeks?

The above referenced patch is in my current test queue. If all goes
well in testing it should be pushed to the poky kirkstone branch
mid-week.

> I’m also wondering how the original patch could have not failed at least two times on the auto-builder (patch and release level).
> That might need to be investigated.

The fix patch mentions that the issue leads to "undefined symbol error
on certain architectures", but doesn't identify which architectures
specifically.

Siddarth, Archana: Do you know which architectures display the issue?

Once we know this, I can comment on why local and autobuilder testing
didn't catch this.  At this point all I can say is that none of the
architectures tested on my local machine or the autobuilder displayed
this issue.

Steve

> Regards
>
> Konrad
>
>
>
> We continuously commit to comply with the applicable data protection laws and ensure fair and transparent processing of your personal data.
> Please read our privacy statement including an information notice and data protection policy for detailed information on our website.

Re: [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

[Siddharth]

[-- Attachment #1: Type: text/plain, Size: 2538 bytes --]

Hi Steve,

Please find the detailed error log:
{{{
| [629/6213] Compiling C object libqemuutil.a.p/stubs_win32-kbd-hook.c.o
| [630/6213] Compiling C object libqemuutil.a.p/stubs_replay-tools.c.o
| [631/6213] Compiling C object fsdev/virtfs-proxy-helper.p/9p-marshal.c.o
| [632/6213] Compiling C object libqemuutil.a.p/stubs_xen-hw-stub.c.o
| [633/6213] Compiling C object fsdev/virtfs-proxy-helper.p/9p-iov-marshal.c.o
| [634/6213] Linking static target libqemuutil.a
| [635/6213] Compiling C object tests/qtest/libqos/libqos.fa.p/qos_external.c.o
| [636/6213] Compiling C object tests/qtest/libqos/libqos.fa.p/fw_cfg.c.o
| [637/6213] Compiling C object tests/qtest/libqos/libqos.fa.p/pci.c.o
| [638/6213] Compiling C object tests/qtest/libqos/libqos.fa.p/qgraph.c.o
| [639/6213] Compiling C object fsdev/virtfs-proxy-helper.p/virtfs-proxy-helper.c.o
| In file included from ../qemu-6.2.0/fsdev/virtfs-proxy-helper.c:29:
| /home/siddharth/tmp/work/../qemu/6.2.0-r0/qemu-6.2.0/hw/9pfs/9p-util.h: In function 'close_if_special_file':
| /home/siddharth/tmp/work/../qemu/6.2.0-r0/qemu-6.2.0/hw/9pfs/9p-util.h:46:9: warning: implicit declaration of function 'qemu_fstat' [-Wimplicit-function-declaration]
|    46 |     if (qemu_fstat(fd, &stbuf) < 0) {
|       |         ^~~~~~~~~~
| /home/siddharth/tmp/work/../qemu/6.2.0-r0/qemu-6.2.0/hw/9pfs/9p-util.h:46:9: warning: nested extern declaration of 'qemu_fstat' [-Wnested-externs]
| [640/6213] Compiling C object tests/qtest/libqos/libqos.fa.p/malloc-pc.c.o
| [641/6213] Linking target fsdev/virtfs-proxy-helper
| FAILED: fsdev/virtfs-proxy-helper
}}}

> 
> The fix patch mentions that the issue leads to "undefined symbol error
> on certain architectures", but doesn't identify which architectures specifically.
> 
> 

- I am facing this on x86_64 and riscv architectures. Atleast these are the two which i tried on and got the same error.
- Logically looking at the code, it should ideally fail on any machine it is compiled on regardless of the architecture as the wrapper "qemu_fstat" is not defined anywhere in the code and is called.
- However, since i had not tested on all architectures, i couldn't tell about all the architectures.
- It definately made me confuse more since it had passed autobuilder test, so i explicitly mentioned in certain architectures and not fails everywhere.

- Just building qemu with `PACKAGECONFIG:append = " libusb virtfs" ` is enough to re-produce the error. Atleast that's what i am building it with.

[-- Attachment #2: Type: text/html, Size: 3937 bytes --]

Re: [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

[Siddharth]

[-- Attachment #1: Type: text/plain, Size: 64 bytes --]

Hi Team,

Any updates for this patch?

Regards,
Siddharth

[-- Attachment #2: Type: text/html, Size: 84 bytes --]

Re: [OE-core] [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

[Steve Sakoman]

On Thu, Sep 7, 2023 at 5:51 PM Siddharth via lists.openembedded.org
<sdoshi=mvista.com@lists.openembedded.org> wrote:
>
> Hi Team,
>
> Any updates for this patch?

The patch was accepted and is now in the kirkstone branch:

https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=074ad15e1e34007997e58892daf759c8d6d9abff

Steve

> Regards,
> Siddharth
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#187399): https://lists.openembedded.org/g/openembedded-core/message/187399
> Mute This Topic: https://lists.openembedded.org/mt/100951881/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

Re: [kirkstone][PATCH] Qemu: Resolve undefined reference issue in CVE-2023-2861

[Siddharth]

[-- Attachment #1: Type: text/plain, Size: 123 bytes --]

I guess i missed the patch status. Apologies for that.

Thank-you for updating me on the status.

Regards,
Siddharth

[-- Attachment #2: Type: text/html, Size: 150 bytes --]