diff --git a/pkgs/applications/virtualization/qemu/CVE-2020-27617.patch b/pkgs/applications/virtualization/qemu/CVE-2020-27617.patch deleted file mode 100644 index fa708b298365..000000000000 --- a/pkgs/applications/virtualization/qemu/CVE-2020-27617.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 6d19c0cc6c5a9bba308fc29d7c0edc2dc372c41b Mon Sep 17 00:00:00 2001 -From: Prasad J Pandit -Date: Wed, 21 Oct 2020 11:35:50 +0530 -Subject: [PATCH] net: remove an assert call in eth_get_gso_type - -eth_get_gso_type() routine returns segmentation offload type based on -L3 protocol type. It calls g_assert_not_reached if L3 protocol is -unknown, making the following return statement unreachable. Remove the -g_assert call, it maybe triggered by a guest user. - -Reported-by: Gaoning Pan -Signed-off-by: Prasad J Pandit ---- - net/eth.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/net/eth.c b/net/eth.c -index 0c1d413ee2..eee77071f9 100644 ---- a/net/eth.c -+++ b/net/eth.c -@@ -16,6 +16,7 @@ - */ - - #include "qemu/osdep.h" -+#include "qemu/log.h" - #include "net/eth.h" - #include "net/checksum.h" - #include "net/tap.h" -@@ -71,9 +72,8 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto) - return VIRTIO_NET_HDR_GSO_TCPV6 | ecn_state; - } - } -- -- /* Unsupported offload */ -- g_assert_not_reached(); -+ qemu_log_mask(LOG_GUEST_ERROR, "%s: probably not GSO frame, " -+ "unknown L3 protocol: 0x%04"PRIx16"\n", __func__, l3_proto); - - return VIRTIO_NET_HDR_GSO_NONE | ecn_state; - } --- -2.28.0 - diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix index beb388afa7d5..61ebe2ceec75 100644 --- a/pkgs/applications/virtualization/qemu/default.nix +++ b/pkgs/applications/virtualization/qemu/default.nix @@ -1,14 +1,14 @@ { lib, stdenv, fetchurl, fetchpatch, python, zlib, pkg-config, glib , perl, pixman, vde2, alsaLib, texinfo, flex -, bison, lzo, snappy, libaio, gnutls, nettle, curl -, makeWrapper +, bison, lzo, snappy, libaio, gnutls, nettle, curl, ninja, meson +, makeWrapper, autoPatchelfHook , attr, libcap, libcap_ng , CoreServices, Cocoa, Hypervisor, rez, setfile , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl , seccompSupport ? stdenv.isLinux, libseccomp , alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner , pulseSupport ? !stdenv.isDarwin && !nixosTestRunner, libpulseaudio -, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner, SDL2 +, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner, SDL2, SDL2_image , gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner, gtk3, gettext, vte, wrapGAppsHook , vncSupport ? !nixosTestRunner, libjpeg, libpng , smartcardSupport ? !nixosTestRunner, libcacard @@ -39,7 +39,7 @@ let in stdenv.mkDerivation rec { - version = "5.1.0"; + version = "5.2.0"; pname = "qemu" + lib.optionalString xenSupport "-xen" + lib.optionalString hostCpuOnly "-host-cpu-only" @@ -47,10 +47,10 @@ stdenv.mkDerivation rec { src = fetchurl { url= "https://download.qemu.org/qemu-${version}.tar.xz"; - sha256 = "1rd41wwlvp0vpialjp2czs6i3lsc338xc72l3zkbb7ixjfslw5y9"; + sha256 = "1g0pvx4qbirpcn9mni704y03n3lvkmw2c0rbcwvydyr8ns4xh66b"; }; - nativeBuildInputs = [ python python.pkgs.sphinx pkg-config flex bison ] + nativeBuildInputs = [ python python.pkgs.sphinx pkg-config flex bison meson ninja autoPatchelfHook ] ++ optionals gtkSupport [ wrapGAppsHook ]; buildInputs = [ zlib glib perl pixman @@ -62,7 +62,7 @@ stdenv.mkDerivation rec { ++ optionals seccompSupport [ libseccomp ] ++ optionals numaSupport [ numactl ] ++ optionals pulseSupport [ libpulseaudio ] - ++ optionals sdlSupport [ SDL2 ] + ++ optionals sdlSupport [ SDL2 SDL2_image ] ++ optionals gtkSupport [ gtk3 gettext vte ] ++ optionals vncSupport [ libjpeg libpng ] ++ optionals smartcardSupport [ libcacard ] @@ -77,20 +77,13 @@ stdenv.mkDerivation rec { ++ optionals smbdSupport [ samba ]; enableParallelBuilding = true; + dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build outputs = [ "out" "ga" ]; patches = [ - ./no-etc-install.patch ./fix-qemu-ga.patch ./9p-ignore-noatime.patch - ./CVE-2020-27617.patch - (fetchpatch { - # e1000e: infinite loop scenario in case of null packet descriptor, remove for QEMU >= 5.2.0-rc3 - name = "CVE-2020-28916.patch"; - url = "https://git.qemu.org/?p=qemu.git;a=patch;h=c2cb511634012344e3d0fe49a037a33b12d8a98a"; - sha256 = "1kvm6wl4vry0npiisxsn76h8nf1iv5fmqsyjvb46203f1yyg5pis"; - }) ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch ++ optionals stdenv.hostPlatform.isMusl [ (fetchpatch { @@ -108,27 +101,19 @@ stdenv.mkDerivation rec { }) ]; - # Remove CVE-2020-{29129,29130} for QEMU >5.1.0 - postPatch = '' - (cd slirp && patch -p1 < ${fetchpatch { - name = "CVE-2020-29129_CVE-2020-29130.patch"; - url = "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f.patch"; - sha256 = "01vbjqgnc0kp881l5p6b31cyyirhwhavm6x36hlgkymswvl3wh9w"; - }}) - ''; - hardeningDisable = [ "stackprotector" ]; preConfigure = '' unset CPP # intereferes with dependency calculation + # this script isn't marked as executable b/c it's indirectly used by meson. Needed to patch its shebang + chmod +x ./scripts/shaderinclude.pl + patchShebangs . '' + optionalString stdenv.hostPlatform.isMusl '' NIX_CFLAGS_COMPILE+=" -D_LINUX_SYSINFO_H" ''; configureFlags = [ "--audio-drv-list=${audio}" - "--sysconfdir=/etc" - "--localstatedir=/var" "--enable-docs" "--enable-tools" "--enable-guest-agent" @@ -169,6 +154,7 @@ stdenv.mkDerivation rec { wrapGApp $f done ''; + preBuild = "cd build"; # Add a ‘qemu-kvm’ wrapper for compatibility/convenience. postInstall = '' diff --git a/pkgs/applications/virtualization/qemu/no-etc-install.patch b/pkgs/applications/virtualization/qemu/no-etc-install.patch deleted file mode 100644 index 5bab930d06a5..000000000000 --- a/pkgs/applications/virtualization/qemu/no-etc-install.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/Makefile b/Makefile ---- a/Makefile -+++ b/Makefile -@@ -867,7 +867,7 @@ install-includedir: - $(INSTALL_DIR) "$(DESTDIR)$(includedir)" - - install: all $(if $(BUILD_DOCS),install-doc) \ -- install-datadir install-localstatedir install-includedir \ -+ install-datadir install-includedir \ - $(if $(INSTALL_BLOBS),$(edk2-decompressed)) \ - recurse-install - ifneq ($(TOOLS),)