[Bug 1940029] Re: Default of fcf-protection should only be enabled where it can work
Launchpad Bug Tracker
1940029 at bugs.launchpad.net
Sat Sep 4 02:26:54 UTC 2021
This bug was fixed in the package qemu - 1:6.0+dfsg-2expubuntu1
---------------
qemu (1:6.0+dfsg-2expubuntu1) impish; urgency=medium
* Merge with Debian experimental, remaining changes:
- qemu-kvm to systemd unit
- d/qemu-kvm-init: script for QEMU KVM preparation modules, ksm,
hugepages and architecture specifics
- d/qemu-system-common.qemu-kvm.service: systemd unit to call
qemu-kvm-init
- d/qemu-system-common.install: install helper script
- d/qemu-system-common.qemu-kvm.default: defaults for
/etc/default/qemu-kvm
- d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
- Distribution specific machine type
(LP: 1304107 1621042 1776189 1761372 1761372 1776189)
- d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
types containing release versioned machine attributes
- d/qemu-system-x86.NEWS Info on fixed machine type defintions
for host-phys-bits=true
- Add an info about -hpb machine type in debian/qemu-system-x86.NEWS
- ubuntu-q35 alias added to auto-select the most recent q35 ubuntu type
- Enable nesting by default
- d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
in qemu64 on amd
[ No more strictly needed, but required for backward compatibility ]
- improved dependencies
- Make qemu-system-common depend on qemu-block-extra
- Make qemu-utils depend on qemu-block-extra
- tolerate ipxe size change on migrations to >=18.04 (LP: 1713490)
- d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
reference 256k path
- d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
handle incoming migrations from former releases.
- d/qemu-system-x86.README.Debian: add info about updated nesting changes
- d/control*, d/rules: disable xen by default, but provide universe
package qemu-system-x86-xen as alternative
[includes compat links changes of 5.0-5ubuntu4]
- d/p/ubuntu/enable-svm-by-default.patch: update to match v6.0
- d/p/ubuntu/define-ubuntu-machine-types.patch: add ubuntu machine types
for v6.0
- d/p/ubuntu/lp-1929926-*: avoid segfaults by uretprobes (LP 1929926)
- Ease the use of module retention on upgrades (LP 1913421)
- debian/qemu-block-extra.postinst: enable mount unit on install/upgrade
* Dropped Changes [in 1:6.0+dfsg-2exp]:
- d/control-in: Disable capstone disassembler library support (universe)
- Disable fuse export (universe dependency)
- Ease the use of module retention on upgrades (LP 1913421)
- d/run-qemu.mount, d/rules: provide run-qemu.mount in qemu-block-extra
- d/rules: only save modules if /run/qemu isn't noexec
- d/rules: clear all (current and former) modules on purge
- d/control: qemu 6.0 broke libvirt <7.2 add a breaks to avoid partial
upgrade issues (LP 1932264)
- Enable SDL as secondary UI backend (LP 1256185)
- d/control: add build dependency libsdl2-dev
- d/control: enable sdl graphics on build
- d/qemu-system-gui.install: add ui-sdl.so
- d/control: add runtime dependency to libgl1
* Dropped Changes [no more needed]
- let qemu-utils recommend sharutils
* Added changes:
- d/optionrom.mak, d/p/u/avoid-fcf-clashing-with-i486.patch: fix
-fcf-protection being unavailble on -march=i486 (LP: #1940029)
- d/p/u/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch: add new 3931
and 3932 machines (LP: #1932175)
- d/p/u/lp-1940288-audio-Never-send-migration-section.patch: fix
migration with audio devices present (LP: #1940288)
qemu (1:6.0+dfsg-2exp) experimental; urgency=medium
[ Christian Ehrhardt ]
* qemu 6.0 broke libvirt <7.2, add a Breaks
to avoid partial upgrade issues (LP: #1932264)
* enable SDL as secondary UI backend (LP: #1256185)
* clear all (current and former) modules on purge
* only save modules if /run/qemu isn't noexec
* provide run-qemu.mount in qemu-block-extra
(disabled in debian for now)
* Disable capstone disassembler library support in ubuntu (universe)
[ Michael Tokarev ]
* qemu does not ship Changelog file anymore
* drop version from libfuse-dev build-depends (noticed by Ville Skyttä)
* a few patches from upstream stable:
- target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch
fix various crashes in ppc system emulation.
Thanks to Christian Ehrhardt for pointing this out
- pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch
(Closes: #990565, CVE-2021-3582)
- pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch
(Closes: #990564, CVE-2021-3607)
- pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch
(Closes: #990563, CVE-2021-3608)
- usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch
(Closes: #988157, CVE-2021-3527)
* mention closing of 3 bugs in am53c974 (ESP) device emulation by 6.0
(Closes: #979679, CVE-2020-35504)
(Closes: #984455, CVE-2020-35505)
(Closes: #984454, CVE-2020-35506)
* make fuse debian-only, since libfuse3 in ubuntu is in universe
* fix microvm default machine type for a new build system (LP: #1936894)
-- Christian Ehrhardt <christian.ehrhardt at canonical.com> Thu, 12 Aug
2021 15:35:12 +0200
** Changed in: qemu (Ubuntu)
Status: Fix Committed => Fix Released
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-35504
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-35505
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-35506
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3527
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3582
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3607
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3608
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gcc-11 in Ubuntu.
https://bugs.launchpad.net/bugs/1940029
Title:
Default of fcf-protection should only be enabled where it can work
Status in gcc-11 package in Ubuntu:
New
Status in qemu package in Ubuntu:
Fix Released
Bug description:
Hi,
I've happened to find this breaking a qemu build that was breaking like:
c -MMD -MP -MT linuxboot_dma.o -MF ./linuxboot_dma.d -O2 -g -march=i486 -Wall -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -Wformat -Werror=format-security -Wdate-time -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fno-pie -ffreestanding -I/<<PKGBUILDDIR>>/pc-bios/optionrom//../../include -fno-stack-protector -m16 -Wa,-32 -c /<<PKGBUILDDIR>>/pc-bios/optionrom/linuxboot_dma.c -o linuxboot_dma.o
cc1: error: ‘-fcf-protection’ is not compatible with this target
As usual this looks complex but it can be reduced to your favorite C
hello world.
It should work if you build it with:
$ cc -Wall -Werror test.c -o test.o
But the following will fail:
$ cc -Wall -Werror -march=i486 -m16 test.c -o test.o
cc1: error: ‘-fcf-protection’ is not compatible with this target
This is some of the always crazy boot blobs that virtualization needs here and there - and I hope I can resolve it for qemu in the build. But in general while I think the fcf default (https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-fcf-protection) is ok, it should not be default on arch combinations where it can never work.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-11/+bug/1940029/+subscriptions
More information about the foundations-bugs
mailing list