On Wed, 2016-05-04 at 07:16 -0700, akuster wrote: > > On 05/04/2016 02:52 AM, Joshua G Lock wrote: > > > > Hi Armin, > > > > On Thu, 2016-04-28 at 11:23 -0700, Armin Kuster wrote: > > > > > > From: Armin Kuster <[email protected]> > > > > > I've been seeing: > > > > "qemu: uncaught target signal 11 (Segmentation fault) - core > > dumped" > > > > when trying to build gobject-introspection for qemux86 recently and > > narrowed it down to this change, if I revert this patch the use of > > qemu-native by gobject-introspection no longer causes a > > segmentation > > fault. > well that is not good. To be clear, this is a build issue not an > execution issue? I would like to better understand what went wrong to > tighten up my processes.
It's an execution issue for qemu-native, the segmentation error occurs when trying to build gobject-introspection (which calls qemu-native). I didn't try calling qemu-native any other way (runqemu, etc) to see whether it was something specific to the way gobject-introspection calls qemu. > > > > > > Are we missing some related patches for this CVE fix? > The only commit identified for is the on this patch came from. > > I haven't dug > > > > into the details, but noticed that Fedora's CVE-2016-2857 > > diffstat[1] > > is much larger than ours[2]. > The Fedora change includes several other CVE fixes > +# CVE-2016-2538: Integer overflow in usb module (bz #1305815) > +Patch0103: 0103-usb-check-RNDIS-message-length.patch > +Patch0104: 0104-usb-check-RNDIS-buffer-offsets-length.patch > +# CVE-2016-2841: ne2000: infinite loop (bz #1304047) > +Patch0105: 0105-net-ne2000-check-ring-buffer-control-registers.patch > +# CVE-2016-2857: net: out of bounds read (bz #1309564) > +Patch0106: 0106-net-check-packet-payload-length.patch > +# CVE-2016-2392: usb: null pointer dereference (bz #1307115) > +Patch0107: 0107-usb-check-USB-configuration-descriptor-object.patch > +# Fix external snapshot any more after active committing (bz > #1300209) > +Patch0108: 0108-block-set-device_list.tqe_prev-to-NULL-on-BDS- > remova.patch > > which we seem to be missing some as well. Several (possibly all) of those are in the 2.5.1 upgrade I proposed. Regards, Joshua -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
