Date: Wed, 12 Apr 2017 06:43:19 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r50153 - in head/share: security/advisories security/patches/EN-17:05 security/patches/SA-17:03 xml Message-ID: <201704120643.v3C6hJMW082336@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: delphij Date: Wed Apr 12 06:43:19 2017 New Revision: 50153 URL: https://svnweb.freebsd.org/changeset/doc/50153 Log: Add EN-17:05 and SA-17:03. Added: head/share/security/advisories/FreeBSD-EN-17:05.xen.asc (contents, props changed) head/share/security/advisories/FreeBSD-SA-17:03.ntp.asc (contents, props changed) head/share/security/patches/EN-17:05/ head/share/security/patches/EN-17:05/xen-10.3.patch (contents, props changed) head/share/security/patches/EN-17:05/xen-10.3.patch.asc (contents, props changed) head/share/security/patches/EN-17:05/xen-11.0.patch (contents, props changed) head/share/security/patches/EN-17:05/xen-11.0.patch.asc (contents, props changed) head/share/security/patches/SA-17:03/ head/share/security/patches/SA-17:03/ntp-10.3.patch.xz (contents, props changed) head/share/security/patches/SA-17:03/ntp-10.3.patch.xz.asc (contents, props changed) head/share/security/patches/SA-17:03/ntp-11.0.patch.xz (contents, props changed) head/share/security/patches/SA-17:03/ntp-11.0.patch.xz.asc (contents, props changed) Modified: head/share/xml/advisories.xml head/share/xml/notices.xml Added: head/share/security/advisories/FreeBSD-EN-17:05.xen.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-EN-17:05.xen.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,177 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-17:05.xen Errata Notice + The FreeBSD Project + +Topic: Xen migration enhancements + +Category: core +Module: xen +Announced: 2017-04-12 +Credits: Citrix Systems R&D, Huawei Technologies +Affects: All supported versions of FreeBSD. +Corrected: 2017-03-21 08:38:12 UTC (stable/11, 11.0-STABLE) + 2017-04-12 06:24:35 UTC (releng/11.0, 11.0-RELEASE-p9) + 2017-03-29 17:11:41 UTC (stable/10, 10.3-STABLE) + 2017-04-12 06:24:35 UTC (releng/10.3, 10.3-RELEASE-p18) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +FreeBSD when running as a Xen guest supports live-migration, that means being +able to move from one physical Xen host to another without interruption of +service. + +Due to the lack of ordering during the resume procedure devices might try to +use the Xen PV timer before it's correctly resumed, leading to unexpected +results. + +II. Problem Description + +There are three issues that currently prevent FreeBSD from working reliably under +heavy live-migration stress: + +1. FreeBSD cannot recover from a failed live migration. It is a Xen feature to +fail a live migration, which means the VM will continue running on the same +host. FreeBSD was not capable of coping with this situation. + +[This is https://reviews.freebsd.org/D9635] + +2. User-space processes that make use of the xenstore device +(/dev/xen/xenstore) might manage to lock-up the resume procedure, preventing +the kernel from resuming correctly after a live-migration. + +[This is https://reviews.freebsd.org/D9638] + +3. The Xen PV timer is attached to the xenpv bus on FreeBSD 11.0, and the xenpv +bus itself is attached after the PCI bus and other buses. This means that the +Xen PV timer is also resume quite late, and device drivers might try to use the +timer before it's resumed correctly, leading to erratic behavior or lockups. + +III. Impact + +FreeBSD 10.3 and 11.0 are affected by the 1. and 2. issues when being migrated +as a Xen guest. + +Only FreeBSD 11.0 is affected when live-migrated as a Xen guest. + +IV. Workaround + +Not attempting to use live-migration when running as a Xen guest will prevent +those issues. + +Not having user-space processes will prevent issue 2. from happening. + +For issue 3, the administrator can switch to a different timer, like the TSC, if +there is plan to migrate the VM: + +# sysctl -a | grep timecounter.choice +kern.timecounter.choice: XENTIMER(950) ACPI-safe(850) i8254(0) TSC-low(-100) dummy(-1000000) +# sysctl -w kern.timecounter.hardware=TSC-low + +V. Solution + +Issue 1. has been solved by adding the proper logic in FreeBSD in order to +recover from failed live migrations. + +Issue 2. has been resolved by adding xenstore locking around the suspend +procedure, in order to make sure no user-space process is holding the xenstore +lock when going into suspension. + +Issue 3. has been solved by marking the Xen PV timer as not safe for suspension +until the order issues can be solved. + +Perform one of the following: + +1) Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date. + +A reboot is required. + +2) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install + +A reboot is required. + +3) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 11.0] +# fetch https://security.FreeBSD.org/patches/EN-17:05/xen-11.0.patch +# fetch https://security.FreeBSD.org/patches/EN-17:05/xen-11.0.patch.asc +# gpg --verify xen-11.0.patch.asc + +[FreeBSD 10.3] +# fetch https://security.FreeBSD.org/patches/EN-17:05/xen-10.3.patch +# fetch https://security.FreeBSD.org/patches/EN-17:05/xen-10.3.patch.asc +# gpg --verify xen-10.3.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/10/ r316170 +releng/10.3/ r316722 +stable/11/ r315668 +releng/11.0/ r316722 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-17:05.xen.asc>; +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljtyccACgkQ7Wfs1l3P +aucjmxAAtLQLh+Xjlue/pTN4OQFSlfS4drkk2ufnQqJON7qe+P6MUcOJaZPb730C +uFNX4XbRbUxsAx04N2LAygTungvl79LgacHAOL4UYC9z055qFISMY8/fPZN35k1G +rDAJ5C0O7/YLCA7Uxcars1FfPFxNuLBK78tjvpP6PHXbI/jm6CO8NRgnlZRjRIAg +088M5Fqc4ucM6qfesG6cjpsb3QgwJz7ZP8ioLIJpdCsrmCSsW4+ceD9bfCxzIPHJ +Gsb2nDw++n/QZEU0Ely6CjlNh9Y7oRDC7xcOzCyYGhUASATfqjfqSGOFUFpUD8PB +IcGNXew4IxTU0hhpkKO42bdi5jORzJy4EVCHOrjPeecZ6NL5Cmj9Yvnd2SEV8ura +Zm2+gpVmsL4hBTLg4cxjjGApzH11289imUfHCEhv2ehxLXEwSziDzAAcKaWdrTOU +KQ3HSIaitxynWP8YhmYDgNP2599iuXSnJvUwLtYJ03zEUILV+NTvEKqTMqLzxA90 +lYYjq+vsF3G+A31TWKwIWR1VU+CBec6NHvZd7nxWb236hfxHNJPrrqUDCqhOfHaG +q6Lf//VPGTHAeLIQ5NPRr5/FwgsAHZCnyslg6bMQyqyql/3j/fMWKu4vOtI554mP +0GCTyEidEHxm3pXYCiv/RnTmnbiu7hQyZUFwgVISHlmnk+HWXSI= +=xLET +-----END PGP SIGNATURE----- Added: head/share/security/advisories/FreeBSD-SA-17:03.ntp.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-17:03.ntp.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,163 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-17:03.ntp Security Advisory + The FreeBSD Project + +Topic: Multiple vulnerabilities of ntp + +Category: contrib +Module: ntp +Announced: 2017-04-12 +Credits: Network Time Foundation +Affects: All supported versions of FreeBSD. +Corrected: 2017-03-28 04:48:17 UTC (stable/11, 11.0-STABLE) + 2017-04-12 06:24:35 UTC (releng/11.0, 11.0-RELEASE-p9) + 2017-03-28 04:48:55 UTC (stable/10, 10.3-STABLE) + 2017-04-12 06:24:35 UTC (releng/10.3, 10.3-RELEASE-p18) +CVE Name: CVE-2017-6464, CVE-2017-6462, CVE-2017-6463, CVE-2016-9042 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP) +used to synchronize the time of a computer system to a reference time +source. + +II. Problem Description + +A vulnerability was discovered in the NTP server's parsing of configuration +directives. [CVE-2017-6464] + +A vulnerability was found in NTP, in the parsing of packets from the +DPTS Clock. [CVE-2017-6462] + +A vulnerability was discovered in the NTP server's parsing of configuration +directives. [CVE-2017-6463] + +A vulnerability was found in NTP, affecting the origin timestamp check +function. [CVE-2016-9042] + +III. Impact + +A remote, authenticated attacker could cause ntpd to crash by sending a +crafted message. [CVE-2017-6463, CVE-2017-6464] + +A malicious device could send crafted messages, causing ntpd to crash. +[CVE-2017-6462] + +An attacker able to spoof messages from all of the configured peers +could send crafted packets to ntpd, causing later replies from those +peers to be discarded, resulting in denial of service. [CVE-2016-9042] + +IV. Workaround + +No workaround is available, but systems not running ntpd(8) are not +affected. Network administrators are advised to implement BCP-38, +which helps to reduce the risk associated with these attacks. + +V. Solution + +Perform one of the following: + +1) Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +The ntpd service has to be restarted after the update. A reboot is +recommended but not required. + +2) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install + +The ntpd service has to be restarted after the update. A reboot is +recommended but not required. + +3) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 11.0] +# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-11.0.patch.xz +# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-11.0.patch.xz.asc +# gpg --verify ntp-11.0.patch.xz.asc + +[FreeBSD 10.3] +# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-10.3.patch.xz +# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-10.3.patch.xz.asc +# gpg --verify ntp-10.3.patch.xz.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile the operating system using buildworld and installworld as +described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. + +Restart the applicable daemons, or reboot the system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/10/ r316069 +releng/10.3/ r316722 +stable/11/ r316068 +releng/11.0/ r316722 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042>; + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6462>; + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6463>; + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6464>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc>; +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljty+gACgkQ7Wfs1l3P +audFpxAA30Po/44RV8x98fcopL+/qX0bKhs2yORCcYs/ebrPaDW6ghdqPAPyNDen +qJSoEU6FFZxU508reu6mcJIze0YzSC2D4Xe+BjtVjTUhgZ1mUlfx+0Dqa6DsmyPE +wreYZ0+aPJPSg82P4pOR+Oo4Omh0BHXw/Yu+uJxd+VSGAWg9zJk9QcRyy3QKsPFn +YbMYjAsMk1x2i/q6GzRnoJXAFT9c1QsKRP1QU3JivDEQEYwreqKxkG7Ex9OkUOmL +CIPVG19K7iddnMfiQPjhPhyAOFWrtKMm1rjcg1vSEMUQ24MtVotGOgNkKXEf0vjT +eVX91sIRYGgy9utg6Mg4pnDT7m94PMh7mORgfphHg7l7LFVGYKAbHF7khIMtrs4k +/ZU5i7xZqKR6xNm4oWtaBC9EipkWfjnXjBRG30t3kdD2r7ElJ+Y3mvPdalFsxd+U +gP2Wgn//byToXVUGFLChR7KSWDOjUpdiGu3UUDG4LmG/U4whDsSobPgOF3SzbALF +mx8f7OWkOYCnQ9WuhI3PVvCdLncjZ5UdLaQ5nP53pn3rGk9C4MJpGlTI2iS1gwFV +n09mE5zXueI3jVJm+An2X2Z3C8fTCRHb7n3Sej2wnrgiXk8z/8ftX6VJcUxdgW+A +OYFztl0iKgjgEXix33FZ5baivohQVhAT5rUQRQ/+gcrvL8rbJQg= +=58Te +-----END PGP SIGNATURE----- Added: head/share/security/patches/EN-17:05/xen-10.3.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-17:05/xen-10.3.patch Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,214 @@ +--- sys/dev/xen/blkfront/blkfront.c.orig ++++ sys/dev/xen/blkfront/blkfront.c +@@ -1503,6 +1503,11 @@ + { + struct xbd_softc *sc = device_get_softc(dev); + ++ if (xen_suspend_cancelled) { ++ sc->xbd_state = XBD_STATE_CONNECTED; ++ return (0); ++ } ++ + DPRINTK("xbd_resume: %s\n", xenbus_get_node(dev)); + + xbd_free(sc); +--- sys/dev/xen/control/control.c.orig ++++ sys/dev/xen/control/control.c +@@ -151,6 +151,7 @@ + #include <machine/xen/xenvar.h> + #include <machine/xen/xenfunc.h> + ++bool xen_suspend_cancelled; + /*--------------------------- Forward Declarations --------------------------*/ + /** Function signature for shutdown event handlers. */ + typedef void (xctrl_shutdown_handler_t)(void); +@@ -341,8 +342,11 @@ + #ifdef SMP + cpuset_t cpu_suspend_map; + #endif +- int suspend_cancelled; + ++ EVENTHANDLER_INVOKE(power_suspend_early); ++ xs_lock(); ++ stop_all_proc(); ++ xs_unlock(); + EVENTHANDLER_INVOKE(power_suspend); + + if (smp_started) { +@@ -392,16 +396,20 @@ + intr_suspend(); + xen_hvm_suspend(); + +- suspend_cancelled = HYPERVISOR_suspend(0); ++ xen_suspend_cancelled = !!HYPERVISOR_suspend(0); + +- xen_hvm_resume(suspend_cancelled != 0); +- intr_resume(suspend_cancelled != 0); ++ if (!xen_suspend_cancelled) { ++ xen_hvm_resume(false); ++ } ++ intr_resume(xen_suspend_cancelled != 0); + enable_intr(); + + /* + * Reset grant table info. + */ +- gnttab_resume(); ++ if (!xen_suspend_cancelled) { ++ gnttab_resume(); ++ } + + #ifdef SMP + /* Send an IPI_BITMAP in case there are pending bitmap IPIs. */ +@@ -429,6 +437,8 @@ + thread_unlock(curthread); + } + ++ resume_all_proc(); ++ + EVENTHANDLER_INVOKE(power_resume); + + if (bootverbose) +--- sys/dev/xen/netfront/netfront.c.orig ++++ sys/dev/xen/netfront/netfront.c +@@ -509,6 +509,15 @@ + { + struct netfront_info *info = device_get_softc(dev); + ++ if (xen_suspend_cancelled) { ++ XN_RX_LOCK(info); ++ XN_TX_LOCK(info); ++ netfront_carrier_on(info); ++ XN_TX_UNLOCK(info); ++ XN_RX_UNLOCK(info); ++ return (0); ++ } ++ + info->xn_resume = true; + netif_disconnect_backend(info); + return (0); +@@ -796,6 +805,45 @@ + } + + static void ++netif_release_rx_bufs_copy(struct netfront_info *np) ++{ ++ struct mbuf *m; ++ grant_ref_t ref; ++ unsigned int i, busy, inuse; ++ ++ XN_RX_LOCK(np); ++ ++ for (busy = inuse = i = 0; i < NET_RX_RING_SIZE; i++) { ++ ref = np->grant_rx_ref[i]; ++ ++ if (ref == GRANT_REF_INVALID) ++ continue; ++ ++ inuse++; ++ ++ m = np->rx_mbufs[i]; ++ ++ if (!gnttab_end_foreign_access_ref(ref)) { ++ busy++; ++ continue; ++ } ++ ++ gnttab_release_grant_reference(&np->gref_rx_head, ref); ++ np->grant_rx_ref[i] = GRANT_REF_INVALID; ++ add_id_to_freelist(np->rx_mbufs, i); ++ ++ m_freem(m); ++ } ++ ++ if (busy != 0) ++ device_printf(np->xbdev, ++ "Unable to release %u of %u in use grant references out of %zu total.\n", ++ busy, inuse, NET_RX_RING_SIZE); ++ ++ XN_RX_UNLOCK(np); ++} ++ ++static void + network_alloc_rx_buffers(struct netfront_info *sc) + { + int otherend_id = xenbus_get_otherend_id(sc->xbdev); +@@ -2190,6 +2238,12 @@ + info->xn_ifp = NULL; + } + ifmedia_removeall(&info->sc_media); ++ netif_release_tx_bufs(info); ++ if (info->copying_receiver) ++ netif_release_rx_bufs_copy(info); ++ ++ gnttab_free_grant_references(info->gref_tx_head); ++ gnttab_free_grant_references(info->gref_rx_head); + } + + static void +--- sys/xen/xen-os.h.orig ++++ sys/xen/xen-os.h +@@ -57,6 +57,8 @@ + extern int xen_disable_pv_nics; + #endif + ++extern bool xen_suspend_cancelled; ++ + enum xen_domain_type { + XEN_NATIVE, /* running on bare hardware */ + XEN_PV_DOMAIN, /* running in a PV domain */ +--- sys/xen/xenbus/xenbusb.c.orig ++++ sys/xen/xenbus/xenbusb.c +@@ -791,6 +791,11 @@ + if (device_get_state(kids[i]) == DS_NOTPRESENT) + continue; + ++ if (xen_suspend_cancelled) { ++ DEVICE_RESUME(kids[i]); ++ continue; ++ } ++ + ivars = device_get_ivars(kids[i]); + + xs_unregister_watch(&ivars->xd_otherend_watch); +--- sys/xen/xenstore/xenstore.c.orig ++++ sys/xen/xenstore/xenstore.c +@@ -1657,3 +1657,20 @@ + sx_xunlock(&xs.xenwatch_mutex); + } + } ++ ++void ++xs_lock(void) ++{ ++ ++ sx_xlock(&xs.request_mutex); ++ return; ++} ++ ++void ++xs_unlock(void) ++{ ++ ++ sx_xunlock(&xs.request_mutex); ++ return; ++} ++ +--- sys/xen/xenstore/xenstorevar.h.orig ++++ sys/xen/xenstore/xenstorevar.h +@@ -338,4 +338,15 @@ + */ + struct sbuf *xs_join(const char *, const char *); + ++/** ++ * Lock the xenstore request mutex. ++ */ ++void xs_lock(void); ++ ++/** ++ * Unlock the xenstore request mutex. ++ */ ++void xs_unlock(void); ++ + #endif /* _XEN_XENSTORE_XENSTOREVAR_H */ ++ Added: head/share/security/patches/EN-17:05/xen-10.3.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-17:05/xen-10.3.patch.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,17 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljtydAACgkQ7Wfs1l3P +audxcBAA1yPLFy9chiDWxOhsJZxiAL5r7ferseaUBWyAupmECLy7eiZU25W8T2Bc +zqQXbuqSFpq+LCQ6mIqbd0F9JIQxEkG1VVT3vVIiiuuqsZrO5kZfrHLtB3G9IHbD +Wrp5NQ4VPQp9ur5oqPKVolAKLtW+XNfu0kMPrK2n2GiyLJyP3uGanCFfQrhsjktS +a9rXQrYyqk7yx/JXsz3GO2YeUaQUY8Y8B0jxox4pK70WZWvua2OwXdSZadVCzLIx +7gmCdu8foMGaG2MBlTQf8e2SLQM5TS0RQcmw0WFRwaDUMiUhRP+QB4pdolqHr+G6 +o8WiwsOp65ow7hlbsg2MaWPkF9dKf6dWjX8b4/dw2budlpeMV+SMiDqOiG2U6cdA +/9I1ZHBBAgOEyUh/X8PPp9snGKHkbNIRCFbJr02SVYy7LXjVrTZiAuEQCTQpMUTy +hFQ1gF2hgFL3h0DcJ907/lmE5SGFU37m5oC9pRL7tT7EpyiMdSifjukMl0EiWEPp +MhbZJM71zcTZXqg9KAghTm9gBd1iQcqmBsvC8T6lRQwDShNgIZ7a4J3PVNNG2vQ5 +9clK9eszKRciMpWfuB1IK0JlTUmOAKrkGI/ZBOsvRhRrfpcCAOTKNmDWwDnKR7w1 +w2TZFqsNVdySpR88V2vFK0SgjJzMlrOa1r92bx6AcHcdX0WkFDA= +=SW3x +-----END PGP SIGNATURE----- Added: head/share/security/patches/EN-17:05/xen-11.0.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-17:05/xen-11.0.patch Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,176 @@ +--- sys/dev/xen/blkfront/blkfront.c.orig ++++ sys/dev/xen/blkfront/blkfront.c +@@ -1529,6 +1529,11 @@ + { + struct xbd_softc *sc = device_get_softc(dev); + ++ if (xen_suspend_cancelled) { ++ sc->xbd_state = XBD_STATE_CONNECTED; ++ return (0); ++ } ++ + DPRINTK("xbd_resume: %s\n", xenbus_get_node(dev)); + + xbd_free(sc); +--- sys/dev/xen/control/control.c.orig ++++ sys/dev/xen/control/control.c +@@ -148,6 +148,7 @@ + + #include <xen/xenbus/xenbusvar.h> + ++bool xen_suspend_cancelled; + /*--------------------------- Forward Declarations --------------------------*/ + /** Function signature for shutdown event handlers. */ + typedef void (xctrl_shutdown_handler_t)(void); +@@ -196,10 +197,11 @@ + #ifdef SMP + cpuset_t cpu_suspend_map; + #endif +- int suspend_cancelled; + + EVENTHANDLER_INVOKE(power_suspend_early); ++ xs_lock(); + stop_all_proc(); ++ xs_unlock(); + EVENTHANDLER_INVOKE(power_suspend); + + #ifdef EARLY_AP_STARTUP +@@ -267,16 +269,20 @@ + intr_suspend(); + xen_hvm_suspend(); + +- suspend_cancelled = HYPERVISOR_suspend(0); ++ xen_suspend_cancelled = !!HYPERVISOR_suspend(0); + +- xen_hvm_resume(suspend_cancelled != 0); +- intr_resume(suspend_cancelled != 0); ++ if (!xen_suspend_cancelled) { ++ xen_hvm_resume(false); ++ } ++ intr_resume(xen_suspend_cancelled != 0); + enable_intr(); + + /* + * Reset grant table info. + */ +- gnttab_resume(NULL); ++ if (!xen_suspend_cancelled) { ++ gnttab_resume(NULL); ++ } + + #ifdef SMP + if (!CPU_EMPTY(&cpu_suspend_map)) { +--- sys/dev/xen/netfront/netfront.c.orig ++++ sys/dev/xen/netfront/netfront.c +@@ -458,7 +458,21 @@ + netfront_resume(device_t dev) + { + struct netfront_info *info = device_get_softc(dev); ++ u_int i; + ++ if (xen_suspend_cancelled) { ++ for (i = 0; i < info->num_queues; i++) { ++ XN_RX_LOCK(&info->rxq[i]); ++ XN_TX_LOCK(&info->txq[i]); ++ } ++ netfront_carrier_on(info); ++ for (i = 0; i < info->num_queues; i++) { ++ XN_RX_UNLOCK(&info->rxq[i]); ++ XN_TX_UNLOCK(&info->txq[i]); ++ } ++ return (0); ++ } ++ + netif_disconnect_backend(info); + return (0); + } +--- sys/dev/xen/timer/timer.c.orig ++++ sys/dev/xen/timer/timer.c +@@ -417,8 +417,20 @@ + /* Register the timecounter. */ + sc->tc.tc_name = "XENTIMER"; + sc->tc.tc_quality = XENTIMER_QUALITY; +- sc->tc.tc_flags = TC_FLAGS_SUSPEND_SAFE; + /* ++ * FIXME: due to the lack of ordering during resume, FreeBSD cannot ++ * guarantee that the Xen PV timer is resumed before any other device ++ * attempts to make use of it, so mark it as not safe for suspension ++ * (ie: remove the TC_FLAGS_SUSPEND_SAFE flag). ++ * ++ * NB: This was not a problem in previous FreeBSD versions because the ++ * timer was directly attached to the nexus, but it is an issue now ++ * that the timer is attached to the xenpv bus, and thus resumed ++ * later. ++ * ++ * sc->tc.tc_flags = TC_FLAGS_SUSPEND_SAFE; ++ */ ++ /* + * The underlying resolution is in nanoseconds, since the timer info + * scales TSC frequencies using a fraction that represents time in + * terms of nanoseconds. +--- sys/dev/xen/xenstore/xenstore.c.orig ++++ sys/dev/xen/xenstore/xenstore.c +@@ -1699,3 +1699,20 @@ + sx_xunlock(&xs.xenwatch_mutex); + } + } ++ ++void ++xs_lock(void) ++{ ++ ++ sx_xlock(&xs.request_mutex); ++ return; ++} ++ ++void ++xs_unlock(void) ++{ ++ ++ sx_xunlock(&xs.request_mutex); ++ return; ++} ++ +--- sys/xen/xen-os.h.orig ++++ sys/xen/xen-os.h +@@ -56,6 +56,8 @@ + extern int xen_disable_pv_disks; + extern int xen_disable_pv_nics; + ++extern bool xen_suspend_cancelled; ++ + enum xen_domain_type { + XEN_NATIVE, /* running on bare hardware */ + XEN_PV_DOMAIN, /* running in a PV domain */ +--- sys/xen/xenbus/xenbusb.c.orig ++++ sys/xen/xenbus/xenbusb.c +@@ -791,6 +791,11 @@ + if (device_get_state(kids[i]) == DS_NOTPRESENT) + continue; + ++ if (xen_suspend_cancelled) { ++ DEVICE_RESUME(kids[i]); ++ continue; ++ } ++ + ivars = device_get_ivars(kids[i]); + + xs_unregister_watch(&ivars->xd_otherend_watch); +--- sys/xen/xenstore/xenstorevar.h.orig ++++ sys/xen/xenstore/xenstorevar.h +@@ -338,4 +338,15 @@ + */ + struct sbuf *xs_join(const char *, const char *); + ++/** ++ * Lock the xenstore request mutex. ++ */ ++void xs_lock(void); ++ ++/** ++ * Unlock the xenstore request mutex. ++ */ ++void xs_unlock(void); ++ + #endif /* _XEN_XENSTORE_XENSTOREVAR_H */ ++ Added: head/share/security/patches/EN-17:05/xen-11.0.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-17:05/xen-11.0.patch.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,17 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljtydAACgkQ7Wfs1l3P +auc88A/+OR7nEKgcAvEQgW8gx/LiVXvBIxjVXf7zZ6YgddZiDjkT9kOVgMMkpX3g +4v0FJ+LHcWcUGtOAncdPox5Her/Vh6p63/sbeAghxoAO1G11gwT06y1GJCOVnUcg +DcwqrpAinv+96aKY0XNio+VHPLPTmXS/G/0GSaI2zcmwkTKTAojVTIm5XDs+urba +w/BgiIJn9uUOHWLW2WvUwQLpOZZi+97atH1+pz6m/GTxOy+X8CXL2FClxvsaKZKV +XLrq/nNrtO2kAqu3CSy6SxJcOR1n+hPf58yGr/km9Zz1RVMGiS5UiPos4FkF6bDN +O1F6PwfBtHLvKFI0ufNrLAd2fJp73MwzPG1p3rJA+86ijZz5ngqpnDOG/ApAhbyM +p8oBWM8nKbbVy1ISAFi3M0xUREwxbk4Dg3GjM0MGf3h4p6T3eYh9EBiFSBGKlaQj +XEejk8FfwV2nDZB/LSBnhw6FCKMQnTjKa1oXxLyVGxhBbDgRdHu87vfRfdaXhjBE +icDHn1u9pYAR6wrXCDm+VhMv18Lo3jCg6t00r6kjroC6A8V0jqm0EOjIF7WbgA4u +v0h7w9h+5bZCeY2xlybVoafk32PyzLqKPHO47XiSDFBeZbMXdfamDcTbhxKotuuX +mtqQ8jntfyuMPA1QkzagbWDi3ytmMPNw+IgUCY8beuOEgDT3C+I= +=SJ6Q +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-17:03/ntp-10.3.patch.xz ============================================================================== Binary file. No diff available. Added: head/share/security/patches/SA-17:03/ntp-10.3.patch.xz.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-17:03/ntp-10.3.patch.xz.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,17 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljty/QACgkQ7Wfs1l3P +audZTA//VWVCVJG3oXcNaA0f1pnwMFWbMk0cioRPNPiZSZtPr/PaAFzQlCb233rh +VqI1rJQGcQEmDcCTIdq1dhLHj5g5Wpd3wsa1Rmzcsaal0Cz2XFhsYN0kiZbpI4nE +fOFVYng0+BE4VYY/zKIuSH1uhIJm1luAvPx6T09y/IBcATeqYbJkm1E7Bb80CpJz +c9+eC+o9ZGoR+5Vs5tD9ex/4w1ukq3A3lzxpvbpuXCgpZhP0stFeHPGg8fc/RUFR +0JBXyfIcjpUDF4x7osxzCkDBmzTPQyhQ3IPRvvYEdX0sDK9Id7FS3fGNmBF0hz6A +q95I5UF7EVgaeab4xeMc+Z4XqbozKkgZ15Cy0l3oDJ6ETU/GL2cYYEggOaMiHY0+ +djKv8D3+ipvOMbjE73UymbQDNYDQb04VVV5Gjv4rfrvwzPpbmi63pR7FQLcgSWfY +F9fc6T6EPuZHkpR7RdNo52YSeVWBC5ICiPySMDV0g/fEZIjdoU1QrT/5dmWtFGTR +pwQbwOHYdSRXNMsYvhyecsBTQdEFE6w9zgt/85rYfwjmz5nAO9oEn9FdCv2W7PsE +PbPJ3P/8bEvoA1VjZ46bGz9IuK/0Z9p832pB1K3ppN1rbHLmHK9tPuhIW2EQEgJI +v4KOeNOzcIIFkfh5EMsZx2LVr1CV9OJ+Krl8oEA5dXjluqigYuk= +=cXVX +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-17:03/ntp-11.0.patch.xz ============================================================================== Binary file. No diff available. Added: head/share/security/patches/SA-17:03/ntp-11.0.patch.xz.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-17:03/ntp-11.0.patch.xz.asc Wed Apr 12 06:43:19 2017 (r50153) @@ -0,0 +1,17 @@ +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.1.19 (FreeBSD) + +iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljty/QACgkQ7Wfs1l3P +audFIQ//e9QSmpTDaJ7kvmMdSlJEWH3NFdVVTa37HDLVp4Xf8KQHtOIkEogViuwy +xIRc/NRhJL8Y0lzyeuG/23GooUN27CaKXNFs3saZMS8DCQmo40/dnefa8kuwf9UZ +9ZeCJhDacGvbEhygPhRXUUgH8DVY1Er2UM5icPI2dmXVplIHGs1RNyPYsAqCXoDc +5dhlCxXTfDaHO1igX9m/rAhJP4R2anp9oCPzlGFL3+0TJq0hNvD9Z0CutbrfnhId +ypiV8dNgaTElWTt1VLe+xRZPvhcqkVWjMulqiixc9yRYDJejDwhGkKIi/hY7tvT4 +XhXQqqh8svYiRZ+2Gi/tNeHRT8Rv5nddf0hsikXFvpP/ipHohCpVKlPEWmFp3uSy +A3L+coguwwTXWiq4Kp/kp9Qad7W9+W1pPFxGjxofQvK9eVJV3iiyM6X0wouXwfaX +j9GFjDZIdZH/uCGADq6YNn+Pjqmzv9lHblYwXIhAr+MKbhuw4oJIcMa6u/yw8xs8 +nlAzgPzmdkzo3j8Q7cKl+6rInAi3N6JJo42XJsf+L8Rqk0aNdW6C3HDG5omt2Qqa +r25rr3MC2BPnSoUcPSlSXCgy7i1/LprBISNNbIwtBrhLW0nmcJZAeutPMkOPbVXx +ng0uXU0XUD3IDiZ9PaKAPTIVvjDAh9f5OC3m3+VEz01yL8teNvg= +=L1P6 +-----END PGP SIGNATURE----- Modified: head/share/xml/advisories.xml ============================================================================== --- head/share/xml/advisories.xml Tue Apr 11 12:16:21 2017 (r50152) +++ head/share/xml/advisories.xml Wed Apr 12 06:43:19 2017 (r50153) @@ -8,6 +8,18 @@ <name>2017</name> <month> + <name>4</name> + + <day> + <name>12</name> + + <advisory> + <name>FreeBSD-SA-17:03.ntp</name> + </advisory> + </day> + </month> + + <month> <name>2</name> <day> Modified: head/share/xml/notices.xml ============================================================================== --- head/share/xml/notices.xml Tue Apr 11 12:16:21 2017 (r50152) +++ head/share/xml/notices.xml Wed Apr 12 06:43:19 2017 (r50153) @@ -8,6 +8,18 @@ <name>2017</name> <month> + <name>4</name> + + <day> + <name>12</name> + + <notice> + <name>FreeBSD-EN-17:05.xen</name> + </notice> + </day> + </month> + + <month> <name>2</name> <day>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704120643.v3C6hJMW082336>