kvmfr: backport security patch for potential buffer overflow & build fix for linux_6_10

[j-brn]

Description of changes

Things done

• kvmfr: added a patch for kvmfr from the upstream repo to fix the build for linux

• looking-glass-client: replaced an already included patch from upstream with fetchpatch

• Built on platform(s)

  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin

• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

  • sandbox = relaxed
  • sandbox = true

• Tested, as applicable:

  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages

• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage

• Tested basic functionality of all binary files (usually in ./result/bin/)

• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)

  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module

• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Naxdy]

Kernel module builds.

[Svenum]

I am waiting for this. Any news?

[j-brn]

I am waiting for this. Any news?

Just waiting for someone to merge it. The change is ready to use, I'm already using the updated derivation with an overlay.

[Svenum]

Ok, i have build an overlay yesterday too

[thedaringdev]

Waiting on this aswell

[Svenum]

Waiting on this aswell

Here is my Overlay. Works great for me

  final: prev: {                                   
    linuxPackages_latest = prev.linuxPackages_latest.extend (kfinal: kprev: {                                   
      kvmfr = prev.linuxPackages_latest.kvmfr.overrideAttrs (old: {                                   
        patches = [                                   
          (prev.fetchpatch {                                   
            url = "https://github.com/gnif/LookingGlass/commit/7305ce36af211220419eeab302ff28793d515df2.patch";                                   
            hash = "sha256-97nZsIH+jKCvSIPf1XPf3i8Wbr24almFZzMOhjhLOYk=";                                   
            stripLen = 1;                                   
          })                                   
        ];                                   
      });                                   
    });                                   
                                     
    looking-glass-client = prev.looking-glass-client.overrideAttrs (old: {                                   
      patches = [                                   
        (prev.fetchpatch {                                   
          url = "https://github.com/gnif/LookingGlass/commit/20972cfd9b940fddf9e7f3d2887a271d16398979.patch";                                   
          hash = "sha256-CqB8AmOZ4YxnEsQkyu/ZEaun6ywpSh4B7PM+MFJF0qU=";                                   
          stripLen = 1;                                   
        })                                   
      ];                                   
    });

[j-brn]

Added another patch that fixes a potential buffer overflow vulnerability reported in gnif/LookingGlass#1133