Re: [Qemu-stable] [Qemu-devel] [PATCH 00/79] Patch Round-up for stable 2.9.1, freeze on 2017-09-04

[Cole Robinson]

On 08/28/2017 08:13 PM, Michael Roth wrote:
> Hi everyone,
> 
> The following new patches are queued for QEMU stable v2.9.1:
> 
>   https://github.com/mdroth/qemu/commits/stable-2.9-staging
> 
> The release is planned for 2017-09-07:
> 
>   http://wiki.qemu.org/Planning/2.9
> 
> Please respond here or CC address@hidden on any patches you
> think should be included in the release.
> 

Here's extra patches we are carrying for Fedora 26:

Applying: vmw_pvscsi: check message ring page count at initialisation
Applying: audio: release capture buffers
Applying: scsi: avoid an off-by-one error in megasas_mmio_write
Applying: 9pfs: local: forbid client access to metadata (CVE-2017-7493)
Applying: megasas: do not read sense length more than once from frame
Applying: megasas: do not read iovec count more than once from frame
Applying: megasas: do not read DCMD opcode more than once from frame
Applying: megasas: do not read command more than once from frame
Applying: megasas: do not read SCSI req parameters more than once from frame
Applying: megasas: always store SCSIRequest* into MegasasCmd
Applying: usb-redir: fix stack overflow in usbredir_log_data
Applying: qemu-nbd: Ignore SIGPIPE
Applying: vnc: Set default kbd delay to 10ms


The last one was part of agraf's input fixes, not sure if it's strictly
required to fix the root issue but when all 3 patches were applied it fixed
fedora's automated QA system.

The rest of the patches are for CVEs but not sure about the severity

Thanks,
Cole