Obviously, we can't run GHCi of a cross-compiler, but respecting targetPrefix
will give a more helpful error message:
<command line>: not built for interactive use
Note that this test also succeeds in pkgsCross though using a stdenv
with cc is crucial, since its setup hooks are required for -lgmp to work.
Maybe this is something we should look at for GHC again, maybe we can
add extra entries to the package db, so it passes the necessary -L flags
by itself?
The commit adding LOCALE_ARCHIVE, 8a21e02e31, cites haddock
generation which happens during the build and on the build platform.
As it turns out, the user guide also depends on locales because
sphinx tries to set a locale during execution.
This should fix cross compiling ghc from glibc to non glibc, e.g.
x86_64-pc-linux-gnu -> aarch64-unknown-linux-musl
This patch only affects ARM, but it's better than setting ARM as knownVulnerabilities.
Arm issues with page refcounting
There are two issues related to the mapping of pages belonging to other
domains: For one, an assertion is wrong there, where the case actually
needs handling. A NULL pointer de-reference could result on a release
build. This is CVE-2025-58144.
And then the P2M lock isn't held until a page reference was actually
obtained (or the attempt to do so has failed). Otherwise the page can
not only change type, but even ownership in between, thus allowing
domain boundaries to be violated. This is CVE-2025-58145.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Mutiple vulnerabilities in the Viridian interface
There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:
1. A NULL pointer dereference in the updating of the reference TSC area.
This is CVE-2025-27466.
2. A NULL pointer dereference by assuming the SIM page is mapped when
a synthetic timer message has to be delivered. This is
CVE-2025-58142.
3. A race in the mapping of the reference TSC page, where a guest can
get Xen to free a page while still present in the guest physical to
machine (p2m) page tables. This is CVE-2025-58143.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
