OSDN Git Service
Greg Kurz [Wed, 12 Dec 2018 13:18:10 +0000 (14:18 +0100)]
xen/9pfs: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
Because it is a recommended coding practice (see HACKING).
Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Anthony PERARD <anthony.perard@citrix.com>
Greg Kurz [Wed, 12 Dec 2018 13:18:10 +0000 (14:18 +0100)]
9p: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
Because it is a recommended coding practice (see HACKING).
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
Peter Maydell [Tue, 11 Dec 2018 19:18:58 +0000 (19:18 +0000)]
Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging
Machine queue post-3.1.0 (including 4.0 machine-types)
Features:
* Add 4.0 machine-types to q35/440fx/arm/spapr (Alex Williamson)
Documentation:
* Document vCPU hotplug procedure (Kashyap Chamarthy)
* Deprecate `cpu-add` monitor commands (Kashyap Chamarthy)
Bug fixes:
* A small sun4v_rtc_write() tracing fix that fell through the cracks
(Eduardo Habkost)
* Validation of "host-nodes" option on memory backends (Eduardo Habkost)
* memory-device fixes and cleanups (David Hildenbrand)
Cleanups:
* Machine-type code cleanup (remove unnecessary instance_init functions)
(Eduardo Habkost)
* qdev, qom, and global property code cleanups (Marc-André Lureau)
* PCMachineState field renames (Corey Minyard)
* numa: Match struct to typedef name (Eric Blake)
* hostmem-file: remove object id from pmem error message (Zhang Yi)
# gpg: Signature made Tue 11 Dec 2018 17:58:03 GMT
# gpg: using RSA key
2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6
* remotes/ehabkost/tags/machine-next-pull-request: (24 commits)
qom: remove unimplemented class_finalize
qdev: move qdev_prop_register_global_list() to tests
accel: register global_props like machine globals
qom: make user_creatable_complete() specific to UserCreatable
qom: make interface types abstract
tests: qdev_prop_check_globals() doesn't return "all_used"
pc: Use default_machine_opts to set suppress_vmdesc
spapr: Delete instance_options functions
spapr: Use default_machine_opts to set suppress_vmdesc
spapr: Use default_machine_opts to set use_hotplug_event_source
virt: Eliminate separate instance_init functions
q35/440fx/arm/spapr: Add QEMU 4.0 machine type
hostmem: Validate host-nodes before setting bitmap
numa: Match struct to typedef name
i386: Rename bools in PCMachineState to end in _enabled
move ObjectClass to typedefs.h
memory-device: avoid overflows on very huge devices
memory-device: use QEMU_IS_ALIGNED
range: pass const pointer where possible
Deprecate HMP `cpu-add`
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:10 +0000 (18:20 +0400)]
qom: remove unimplemented class_finalize
Instead of trying to implement something that isn't well specified,
remove it. (it would be tricky to implement, since a class struct is
memcpy on children types...)
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181204142023.15982-7-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:09 +0000 (18:20 +0400)]
qdev: move qdev_prop_register_global_list() to tests
The function is only used by a test, move it there.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <
20181204142023.15982-6-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:08 +0000 (18:20 +0400)]
accel: register global_props like machine globals
global_props is only used for Xen xen_compat_props. It's a static
array of GlobalProperty, like machine globals in SET_MACHINE_COMPAT().
Let's register the globals the same way, without extra copy allocation.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <
20181204142023.15982-5-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:07 +0000 (18:20 +0400)]
qom: make user_creatable_complete() specific to UserCreatable
Instead of accepting any Object*, change user_creatable_complete() to
require a UserCreatable*. Modify the callers to pass the appropriate
argument, removing redundant dynamic cast checks in object creation.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181204142023.15982-4-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:06 +0000 (18:20 +0400)]
qom: make interface types abstract
Interfaces don't have instance, let's make the interface type really
abstract to avoid confusion.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181204142023.15982-3-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Marc-André Lureau [Tue, 4 Dec 2018 14:20:05 +0000 (18:20 +0400)]
tests: qdev_prop_check_globals() doesn't return "all_used"
Instead, it returns 1 if an error was detected, which is the case for:
/qdev/properties/dynamic/global/subprocess:
warning: global dynamic-prop-type-bad.prop3 has invalid class name
warning: global nohotplug-type.prop5=105 not used
warning: global nondevice-type.prop6 has invalid class name
Clarify the function return value.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181204142023.15982-2-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 5 Dec 2018 20:58:27 +0000 (18:58 -0200)]
pc: Use default_machine_opts to set suppress_vmdesc
Instead of setting suppress_vmdesc at instance_init time, set
default_machine_opts on pc_i440fx_2_2_machine_options() to
implement equivalent behavior.
This will let us eliminate the need for pc_compat_*() functions
for PC machine-types.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181205205827.19387-6-ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 5 Dec 2018 20:58:26 +0000 (18:58 -0200)]
spapr: Delete instance_options functions
Now that all instance_options functions for spapr are empty,
delete them.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181205205827.19387-5-ehabkost@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 5 Dec 2018 20:58:25 +0000 (18:58 -0200)]
spapr: Use default_machine_opts to set suppress_vmdesc
Instead of setting suppress_vmdesc at instance_init time, set
default_machine_opts on spapr_machine_2_2_class_options() to
implement equivalent behavior.
This will let us eliminate the need for separate instance_init
functions for each spapr machine-type.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181205205827.19387-4-ehabkost@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 5 Dec 2018 20:58:24 +0000 (18:58 -0200)]
spapr: Use default_machine_opts to set use_hotplug_event_source
Instead of setting use_hotplug_event_source at instance_init
time, set default_machine_opts on spapr_machine_2_7_class_options()
to implement equivalent behavior.
This will let us eliminate the need for separate instance_init
functions for each spapr machine-type.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181205205827.19387-3-ehabkost@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 5 Dec 2018 20:58:23 +0000 (18:58 -0200)]
virt: Eliminate separate instance_init functions
All instance_init functions for all virt machine-types run
exactly the same code, so we don't need separate functions. We
only need to set instance_init for TYPE_VIRT_MACHINE.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181205205827.19387-2-ehabkost@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Alex Williamson [Tue, 4 Dec 2018 16:27:16 +0000 (09:27 -0700)]
q35/440fx/arm/spapr: Add QEMU 4.0 machine type
Including all machine types that might have a pcie-root-port.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Message-Id: <
154394083644.28192.
8501647946108201466.stgit@gimli.home>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
[ehabkost: fixed accidental recursion at spapr_machine_3_1_class_options()]
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Fri, 30 Nov 2018 12:28:44 +0000 (10:28 -0200)]
hostmem: Validate host-nodes before setting bitmap
host_memory_backend_set_host_nodes() was not validating
host-nodes before writing to backend->host_nodes, making QEMU
write beyond the end of the bitmap.
Fix the crash and add a simple regression test for the fix.
While at it, fix memory leak of the list returned by
visit_type_uint16List().
Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181130122844.29103-1-ehabkost@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
[ehabkost: removed test case code]
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eric Blake [Thu, 15 Nov 2018 21:17:52 +0000 (15:17 -0600)]
numa: Match struct to typedef name
There's no reason to violate our naming conventions by having a
struct with a different name than its typedef. Messed up since
its introduction in commit
8c85901e, but made more obvious when
commit
3bfe5716 promoted it to typedefs.h.
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <
20181115211752.
1295571-3-eblake@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Corey Minyard [Wed, 7 Nov 2018 15:24:34 +0000 (09:24 -0600)]
i386: Rename bools in PCMachineState to end in _enabled
This makes their function more clear and prevents conflicts when adding
the actual devices to the machine state, if necessary.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181107152434.22219-1-minyard@acm.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Gerd Hoffmann [Tue, 6 Nov 2018 10:23:30 +0000 (11:23 +0100)]
move ObjectClass to typedefs.h
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <
20181106102335.20027-2-kraxel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
David Hildenbrand [Tue, 23 Oct 2018 15:23:05 +0000 (17:23 +0200)]
memory-device: avoid overflows on very huge devices
Should not be a problem right now, but it could theoretically happen
in the future.
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <
20181023152306.3123-7-david@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
David Hildenbrand [Tue, 23 Oct 2018 15:23:04 +0000 (17:23 +0200)]
memory-device: use QEMU_IS_ALIGNED
Shorter and easier to read.
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <
20181023152306.3123-6-david@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
David Hildenbrand [Tue, 23 Oct 2018 15:23:02 +0000 (17:23 +0200)]
range: pass const pointer where possible
If there are no changes, let's use a const pointer.
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <
20181023152306.3123-4-david@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Kashyap Chamarthy [Tue, 30 Oct 2018 12:35:25 +0000 (13:35 +0100)]
Deprecate HMP `cpu-add`
Since we're deprecating the QMP `cpu-add`, let's deprecate its HMP
equivalent, too.
Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Message-Id: <
20181030123526.26415-3-kchamart@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Kashyap Chamarthy [Tue, 30 Oct 2018 12:35:24 +0000 (13:35 +0100)]
Deprecate QMP `cpu-add`
The intended functionality of QMP `cpu-add` is replaced with
`device_add` (and `query-hotpluggable-cpus`). So let's deprecate
`cpu-add`.
A complete example of vCPU hotplug with the recommended way (using
`device_add`) is provided as part of a seperate docs patch.
Suggested-by: Eduardo Habkost <ehabkost@redhat.com
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Message-Id: <
20181030123526.26415-2-kchamart@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Kashyap Chamarthy [Tue, 30 Oct 2018 12:35:26 +0000 (13:35 +0100)]
docs: Document vCPU hotplug procedure
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Message-Id: <
20181030123526.26415-4-kchamart@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Eduardo Habkost [Wed, 31 Oct 2018 00:18:43 +0000 (21:18 -0300)]
hw/timer/sun4v-rtc: Fix tracing at sun4v_rtc_write()
The code was converted to use sun4v_rtc_read() by mistake, fix
it.
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <
20181031001843.12892-1-ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Zhang Yi [Wed, 24 Oct 2018 14:14:56 +0000 (22:14 +0800)]
hostmem-file: remove object id from pmem error message
We will never get the canonical path from the object
before object_property_add_child.
Signed-off-by: Zhang Yi <yi.z.zhang@linux.intel.com>
Message-Id: <
a6491f996827f4039c1a52198ed5dcc7727cb0f9.
1540389255.git.yi.z.zhang@linux.intel.com>
[ehabkost: reword commit message]
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Peter Maydell [Tue, 11 Dec 2018 17:27:58 +0000 (17:27 +0000)]
Open 4.0 development tree
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 11 Dec 2018 17:18:37 +0000 (17:18 +0000)]
Update version for v3.1.0 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 6 Dec 2018 17:07:12 +0000 (17:07 +0000)]
Update version for v3.1.0-rc5 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Prasad J Pandit [Thu, 6 Dec 2018 12:18:30 +0000 (17:48 +0530)]
i2c: pm_smbus: check smb_index before block transfer write
While performing block transfer write in smb_ioport_writeb(),
'smb_index' is incremented and used to index smb_data[] array.
Check 'smb_index' value to avoid OOB access.
Note that this bug is exploitable by a guest to escape
from the virtual machine. However the commit which
introduced the bug was only made after the 3.0 release,
and so it is not present in any released QEMU versions.
Fixes:
38ad4fae43 i2c: pm_smbus: Add block transfer capability
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id:
20181206121830.6177-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 4 Dec 2018 18:31:50 +0000 (18:31 +0000)]
Update version for v3.1.0-rc4 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wang [Tue, 4 Dec 2018 03:53:47 +0000 (11:53 +0800)]
virtio-net-test: add large tx buffer test
This test tries to build a packet whose size is greater than INT_MAX
which tries to trigger integer overflow in qemu_net_queue_append_iov()
which may result OOB.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id:
20181204035347.6148-6-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wang [Tue, 4 Dec 2018 03:53:46 +0000 (11:53 +0800)]
virtio-net-test: remove unused macro
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Message-id:
20181204035347.6148-5-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wang [Tue, 4 Dec 2018 03:53:45 +0000 (11:53 +0800)]
virtio-net-test: accept variable length argument in pci_test_start()
This allows flexibility to be reused for all kinds of command line
used by other tests.
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Message-id:
20181204035347.6148-4-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wang [Tue, 4 Dec 2018 03:53:44 +0000 (11:53 +0800)]
net: hub: suppress warnings of no host network for qtest
If we want to qtest through hub, it would be much more simpler and
safer to configure the hub without host network. So silent this
warnings for qtest.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id:
20181204035347.6148-3-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wang [Tue, 4 Dec 2018 03:53:43 +0000 (11:53 +0800)]
net: drop too large packet early
We try to detect and drop too large packet (>INT_MAX) in
1592a9947036
("net: ignore packet size greater than INT_MAX") during packet
delivering. Unfortunately, this is not sufficient as we may hit
another integer overflow when trying to queue such large packet in
qemu_net_queue_append_iov():
- size of the allocation may overflow on 32bit
- packet->size is integer which may overflow even on 64bit
Fixing this by moving the check to qemu_sendv_packet_async() which is
the entrance of all networking codes and reduce the limit to
NET_BUFSIZE to be more conservative. This works since:
- For the callers that call qemu_sendv_packet_async() directly, they
only care about if zero is returned to determine whether to prevent
the source from producing more packets. A callback will be triggered
if peer can accept more then source could be enabled. This is
usually used by high speed networking implementation like virtio-net
or netmap.
- For the callers that call qemu_sendv_packet() that calls
qemu_sendv_packet_async() indirectly, they often ignore the return
value. In this case qemu will just the drop packets if peer can't
receive.
Qemu will copy the packet if it was queued. So it was safe for both
kinds of the callers to assume the packet was sent.
Since we move the check from qemu_deliver_packet_iov() to
qemu_sendv_packet_async(), it would be safer to make
qemu_deliver_packet_iov() static to prevent any external user in the
future.
This is a revised patch of CVE-2018-17963.
Cc: qemu-stable@nongnu.org
Cc: Li Qiang <liq3ea@163.com>
Fixes:
1592a9947036 ("net: ignore packet size greater than INT_MAX")
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id:
20181204035347.6148-2-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 3 Dec 2018 19:57:59 +0000 (19:57 +0000)]
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-
20181203-pull-request' into staging
usb: mtp fixes.
# gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT
# gpg: using RSA key
4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/fixes-31-
20181203-pull-request:
usb-mtp: outlaw slashes in filenames
usb-mtp: fix utf16_to_str
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann [Mon, 3 Dec 2018 10:10:45 +0000 (11:10 +0100)]
usb-mtp: outlaw slashes in filenames
Slash is unix directory separator, so they are not allowed in filenames.
Note this also stops the classic escape via "../".
Fixes: CVE-2018-16867
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20181203101045.27976-3-kraxel@redhat.com
Gerd Hoffmann [Mon, 3 Dec 2018 10:10:44 +0000 (11:10 +0100)]
usb-mtp: fix utf16_to_str
Make utf16_to_str return an allocated string. Remove the assumtion that
the number of string bytes equals the number of utf16 chars (which is
only true for ascii chars). Instead call wcstombs twice, once to figure
the storage size and once for the actual conversion (as suggested by the
wcstombs manpage).
FIXME: surrogate pairs are not working correctly. Pre-existing bug,
fixing that is left for another day.
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id:
20181203101045.27976-2-kraxel@redhat.com
Peter Maydell [Mon, 3 Dec 2018 17:43:20 +0000 (17:43 +0000)]
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-12-03' into staging
nbd patches for 2018-12-03
Improve x-dirty-bitmap handling for experimenting with pull mode
incremental backups.
- Eric Blake: 0/3 NBD dirty bitmap cleanups
# gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT
# gpg: using RSA key
A7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg: aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A
* remotes/ericb/tags/pull-nbd-2018-12-03:
nbd/client: Send NBD_CMD_DISC if open fails after connect
nbd/client: Make x-dirty-bitmap more reliable
nbd/server: Advertise all contexts in response to bare LIST
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 3 Dec 2018 17:12:48 +0000 (17:12 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- mirror: Fix deadlock
# gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT
# gpg: using RSA key
7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
iotests: simple mirror test with kvm on 1G image
mirror: fix dead-lock
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Vladimir Sementsov-Ogievskiy [Mon, 3 Dec 2018 15:12:09 +0000 (16:12 +0100)]
iotests: simple mirror test with kvm on 1G image
This test is broken without previous commit fixing dead-lock in mirror.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Vladimir Sementsov-Ogievskiy [Thu, 29 Nov 2018 10:18:00 +0000 (13:18 +0300)]
mirror: fix dead-lock
Let start from the beginning:
Commit
b9e413dd375 (in 2.9)
"block: explicitly acquire aiocontext in aio callbacks that need it"
added pairs of aio_context_acquire/release to mirror_write_complete and
mirror_read_complete, when they were aio callbacks for blk_aio_* calls.
Then, commit
2e1990b26e5 (in 3.0) "block/mirror: Convert to coroutines"
dropped these blk_aio_* calls, than mirror_write_complete and
mirror_read_complete are not callbacks more, and don't need additional
aiocontext acquiring. Furthermore, mirror_read_complete calls
blk_co_pwritev inside these pair of aio_context_acquire/release, which
leads to the following dead-lock with mirror:
(gdb) info thr
Id Target Id Frame
3 Thread (LWP 145412) "qemu-system-x86" syscall ()
2 Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait ()
* 1 Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait ()
(gdb) bt
#0 __lll_lock_wait ()
#1 _L_lock_812 ()
#2 __GI___pthread_mutex_lock
#3 qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>,
file=0x5610327d8654 "util/main-loop.c", line=236) at
util/qemu-thread-posix.c:66
#4 qemu_mutex_lock_iothread_impl
#5 os_host_main_loop_wait (timeout=
480116000) at util/main-loop.c:236
#6 main_loop_wait (nonblocking=0) at util/main-loop.c:497
#7 main_loop () at vl.c:1892
#8 main
Printing contents of qemu_global_mutex, I see that "__owner = 145416",
so, thr1 is main loop, and now it wants BQL, which is owned by thr2.
(gdb) thr 2
(gdb) bt
#0 __lll_lock_wait ()
#1 _L_lock_870 ()
#2 __GI___pthread_mutex_lock
#3 qemu_mutex_lock_impl (mutex=0x561034d25dc0, ...
#4 aio_context_acquire (ctx=0x561034d25d60)
#5 dma_blk_cb
#6 dma_blk_io
#7 dma_blk_read
#8 ide_dma_cb
#9 bmdma_cmd_writeb
#10 bmdma_write
#11 memory_region_write_accessor
#12 access_with_adjusted_size
#15 flatview_write
#16 address_space_write
#17 address_space_rw
#18 kvm_handle_io
#19 kvm_cpu_exec
#20 qemu_kvm_cpu_thread_fn
#21 qemu_thread_start
#22 start_thread
#23 clone ()
Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio
context mutex, which is owned by thr1. Classic dead-lock.
Then, let's check that aio context is hold by mirror coroutine: just
print coroutine stack of first tracked request in mirror job target:
(gdb) [...]
(gdb) qemu coroutine 0x561035dd0860
#0 qemu_coroutine_switch
#1 qemu_coroutine_yield
#2 qemu_co_mutex_lock_slowpath
#3 qemu_co_mutex_lock
#4 qcow2_co_pwritev
#5 bdrv_driver_pwritev
#6 bdrv_aligned_pwritev
#7 bdrv_co_pwritev
#8 blk_co_pwritev
#9 mirror_read_complete () at block/mirror.c:232
#10 mirror_co_read () at block/mirror.c:370
#11 coroutine_trampoline
#12 __start_context
Yes it is mirror_read_complete calling blk_co_pwritev after acquiring
aio context.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Roman Bolshakov [Mon, 3 Dec 2018 10:04:14 +0000 (13:04 +0300)]
i386: hvf: Fix overrun of _decode_tbl1
Single opcode instructions in ff group were incorrectly processed
because an overrun of _decode_tbl1[0xff] resulted in access of
_decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of
decode_ffgroup:
7d71: decode_sldtgroup: 1
Unimplemented handler (7d71) for 108 (ff 0)
While at it correct maximum length for _decode_tbl2 and _decode_tbl3.
Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Corey Minyard [Mon, 3 Dec 2018 12:52:50 +0000 (06:52 -0600)]
i2c: Add a length check to the SMBus write handling
Avoid an overflow.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: QEMU Stable <qemu-stable@nongnu.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Blake [Fri, 30 Nov 2018 02:32:32 +0000 (20:32 -0600)]
nbd/client: Send NBD_CMD_DISC if open fails after connect
If nbd_client_init() fails after we are already connected,
then the server will spam logs with:
Disconnect client, due to: Unexpected end-of-file before all bytes were read
unless we gracefully disconnect before closing the connection.
Ways to trigger this:
$ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809
$ qemu-img map --output=json --image-opts $opts,read-only=off
$ qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch:
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <
20181130023232.
3079982-4-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Eric Blake [Fri, 30 Nov 2018 02:32:31 +0000 (20:32 -0600)]
nbd/client: Make x-dirty-bitmap more reliable
The implementation of x-dirty-bitmap in qemu 3.0 (commit
216ee365)
silently falls back to treating the server as not supporting
NBD_CMD_BLOCK_STATUS if a requested meta_context name was not
negotiated, which in turn means treating the _entire_ image as
data. Since our hack relied on using 'qemu-img map' to view
which portions of the image were dirty by seeing what the
redirected bdrv_block_status() treats as holes, this means
that our fallback treats the entire image as clean. Better
would have been to treat the entire image as dirty, or to fail
to connect because the user's request for a specific context
could not be honored. This patch goes with the latter.
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <
20181130023232.
3079982-3-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Eric Blake [Fri, 30 Nov 2018 02:32:30 +0000 (20:32 -0600)]
nbd/server: Advertise all contexts in response to bare LIST
The NBD spec, and even our code comment, says that if the client
asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should
reply with (a possibly-compressed representation of) ALL contexts
that we are willing to let them try. But commit
3d068aff forgot
to advertise qemu:dirty-bitmap:FOO.
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <
20181130023232.
3079982-2-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Peter Maydell [Wed, 28 Nov 2018 17:37:34 +0000 (17:37 +0000)]
Update version for v3.1.0-rc3 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Thomas Huth [Wed, 28 Nov 2018 09:58:14 +0000 (10:58 +0100)]
target/arm/sve_helper: Fix compilation with clang 3.4
Clang 3.4 does not know the "flatten" attribute yet. We've already
introduced the QEMU_FLATTEN macro for this in commit
97ff87c0ed020c2,
so use this macro now here, too, to fix this issue.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id:
1543399094-2260-1-git-send-email-thuth@redhat.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Thomas Huth [Wed, 28 Nov 2018 09:35:36 +0000 (10:35 +0100)]
hw/arm/aspeed: Fix build issue with clang 3.4
When using clang 3.4.2, compilation of QEMU fails like this:
CC aarch64-softmmu/hw/arm/aspeed.o
hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11
feature [-Werror,-Wtypedef-redefinition]
} AspeedBoardState;
^
include/hw/arm/aspeed.h:14:33: note: previous definition is here
typedef struct AspeedBoardState AspeedBoardState;
^
1 error generated.
make[1]: *** [hw/arm/aspeed.o] Error 1
make: *** [subdir-aarch64-softmmu] Error 2
Remove the duplicated typedef to fix this issue.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id:
1543397736-8198-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 28 Nov 2018 11:32:33 +0000 (11:32 +0000)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
* lsi HBA reselection fix (George)
* Small cleanups (Li Qiang)
* bugfixes for vhost-user-bridge and hostmem (Marc-André)
* single-thread TCG fix (me)
* VMX migration blocker (me)
* target/i386 fix for LOCK (Richard)
* MAINTAINERS update (Philippe, Thomas)
# gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT
# gpg: using RSA key
BFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* remotes/bonzini/tags/for-upstream:
hostmem: no need to check for host_memory_backend_mr_inited() in alloc()
hostmem-memfd: honour share=on/off property
MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device
MAINTAINERS: Add some missing entries related to accelerators
target/i386: Generate #UD when applying LOCK to a register destination
checkpatch: g_test_message does not need a trailing newline
vl.c: remove outdated comment
vhost-user-bridge: fix recvmsg iovlen
vl: Improve error message when we can't load fw_cfg from file
vmstate: constify VMStateField
migration: savevm: consult migration blockers
lsi: Reselection needed to remove pending commands from queue
cpus: run work items for all vCPUs if single-threaded
target/i386: kvm: add VMX migration blocker
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Marc-André Lureau [Mon, 10 Sep 2018 13:49:46 +0000 (17:49 +0400)]
hostmem: no need to check for host_memory_backend_mr_inited() in alloc()
memfd_backend_memory_alloc/file_backend_memory_alloc both needlessly
are are calling host_memory_backend_mr_inited() which creates an
illusion that alloc could be called multiple times but it isn't, it's
called once from UserCreatable complete().
Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
John Snow [Tue, 27 Nov 2018 18:49:29 +0000 (13:49 -0500)]
scsi: Address spurious clang warning
Some versions of Clang prior to 6.0 (and some builds of clang after,
such as 6.0.1-2.fc28) fail to recognize { 0 } as a valid initializer
for a struct with subobjects when -Wmissing-braces is enabled.
https://bugs.llvm.org/show_bug.cgi?id=21689 and
https://reviews.llvm.org/rL314499 suggests this should be fixed in 6.0,
but it might not be the case for older versions or downstream versions.
For now, follow the precedent of
ebf2a499 and replace the standard { 0 }
with the accepted { } to silence this warning and allow the build to
work under clang 6.0.1-2.fc28, and builds prior to 6.0.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id:
20181127184929.20065-1-jsnow@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Markus Armbruster [Tue, 27 Nov 2018 08:41:43 +0000 (09:41 +0100)]
vfio-helpers: Fix qemu_vfio_open_pci() crash
qemu_vfio_open_common() initializes s->lock only after passing s to
qemu_vfio_dma_map() via qemu_vfio_init_ramblock().
qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes.
Fix by initializing s->lock first.
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=
1645840
Fixes:
418026ca43bc2626db092d7558258f9594366f28
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id:
20181127084143.1113-1-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Marc-André Lureau [Tue, 28 Aug 2018 15:38:40 +0000 (17:38 +0200)]
hostmem-memfd: honour share=on/off property
The share=on/off property is used to modified mmap() MAP_SHARED
setting. Make it on by default for convenience and compatibility
reasons.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Philippe Mathieu-Daudé [Thu, 22 Nov 2018 02:11:39 +0000 (03:11 +0100)]
MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device
Step in to maintain it, with Laszlo (EDK2) and Gerd (SeaBIOS)
as designated reviewers.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20181122021139.1486-1-philmd@redhat.com>
Acked-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Thomas Huth [Thu, 22 Nov 2018 12:57:18 +0000 (13:57 +0100)]
MAINTAINERS: Add some missing entries related to accelerators
Add some files from accel/stubs/, include/hw/kvm/ and scripts/kvm/
to the MAINTAINERS file.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <
1542891438-13329-1-git-send-email-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Richard Henderson [Tue, 13 Nov 2018 19:35:10 +0000 (20:35 +0100)]
target/i386: Generate #UD when applying LOCK to a register destination
Fixes a TCG crash due to attempting the atomic operation without
having set up the address first. This does not attempt to fix
all of the other missing checks for LOCK.
Fixes:
a7cee522f35
Fixes: https://bugs.launchpad.net/qemu/+bug/
1803160
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <
20181113193510.24862-1-richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Wed, 21 Nov 2018 18:27:20 +0000 (19:27 +0100)]
checkpatch: g_test_message does not need a trailing newline
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Li Qiang [Thu, 15 Nov 2018 10:06:25 +0000 (02:06 -0800)]
vl.c: remove outdated comment
Cc: qemu-trivial@nongnu.org
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <
1542276385-7638-1-git-send-email-liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Marc-André Lureau [Fri, 9 Nov 2018 17:30:28 +0000 (21:30 +0400)]
vhost-user-bridge: fix recvmsg iovlen
After iov_discard_front(), the iov may be smaller than its initial
size. Fixes the heap-buffer-overflow spotted by ASAN:
==9036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e0 at pc 0x7fe632eca3f0 bp 0x7ffddc4a05a0 sp 0x7ffddc49fd48
WRITE of size 32 at 0x6060000001e0 thread T0
#0 0x7fe632eca3ef (/lib64/libasan.so.5+0x773ef)
#1 0x7fe632ecad23 in __interceptor_recvmsg (/lib64/libasan.so.5+0x77d23)
#2 0x561e7491936b in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:333
#3 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
#4 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
#5 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
#6 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)
#7 0x561e7491667d in _start (/home/elmarco/src/qemu/build/tests/vhost-user-bridge+0x3967d)
0x6060000001e0 is located 0 bytes to the right of 64-byte region [0x6060000001a0,0x6060000001e0)
allocated by thread T0 here:
#0 0x7fe632f42848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848)
#1 0x561e7493acd8 in virtqueue_alloc_element /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1848
#2 0x561e7493c2a8 in vu_queue_pop /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1954
#3 0x561e749189bf in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:297
#4 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
#5 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
#6 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
#7 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x773ef)
Shadow bytes around the buggy address:
0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 05 fa fa fa fa fa
0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd
0x0c0c7fff8020: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa
0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
0x0c0c7fff8050: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <
20181109173028.3372-1-marcandre.lureau@redhat.com>
Signed-off-by: Paolo BOnzini <pbonzini@redhat.com>
Li Qiang [Thu, 1 Nov 2018 05:59:31 +0000 (22:59 -0700)]
vl: Improve error message when we can't load fw_cfg from file
parse_fw_cfg() reports "can't load" without further details. Get
the details from g_file_get_contents(), and include them in the
error message.
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <
1541051971-28584-1-git-send-email-liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Marc-André Lureau [Wed, 14 Nov 2018 13:29:30 +0000 (17:29 +0400)]
vmstate: constify VMStateField
Because they are supposed to remain const.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <
20181114132931.22624-1-marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Peter Maydell [Tue, 27 Nov 2018 14:35:11 +0000 (14:35 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- block: Fix crash on migration with explicit child nodes
- nvme: Fix spurious interrupts
# gpg: Signature made Tue 27 Nov 2018 11:59:40 GMT
# gpg: using RSA key
7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
nvme: Fix spurious interrupts
iotests: Test migration with -blockdev
block: Don't inactivate children before parents
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Paolo Bonzini [Wed, 14 Nov 2018 09:48:00 +0000 (10:48 +0100)]
migration: savevm: consult migration blockers
There is really no difference between live migration and savevm, except
that savevm does not require bdrv_invalidate_cache to be implemented
by all disks. However, it is unlikely that savevm is used with anything
except qcow2 disks, so the penalty is small and worth the improvement
in catching bad usage of savevm.
Only one place was taking care of savevm when adding a migration blocker,
and it can be removed.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
George Kennedy [Fri, 9 Nov 2018 15:18:12 +0000 (10:18 -0500)]
lsi: Reselection needed to remove pending commands from queue
Under heavy IO (e.g. fio) the queue is not checked frequently enough for
pending commands. As a result some pending commands are timed out by the
linux sym53c8xx driver, which sends SCSI Abort messages for the timed out
commands. The SCSI Abort messages result in linux errors, which show up
on the console and in /var/log/messages.
e.g.
sd 0:0:3:0: [sdd] tag#33 ABORT operation started
scsi target0:0:3: control msgout:
80 20 47 d
sd 0:0:3:0: ABORT operation complete.
scsi target0:0:4: message d sent on bad reselection
Now following a WAIT DISCONNECT Script instruction, and if there is no
current command, check for a pending command on the queue and if one
exists call lsi_reselect().
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Message-Id: <
1541776692-12271-1-git-send-email-george.kennedy@oracle.com>
[For safety, add a s->current check in lsi_update_irq - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Wed, 14 Nov 2018 11:36:57 +0000 (12:36 +0100)]
cpus: run work items for all vCPUs if single-threaded
This avoids the following I/O thread deadlock:
1) the I/O thread calls run_on_cpu for CPU 3 from a timer. single_tcg_halt_cond
is signaled
2) CPU 1 is running and exits. It finds no work item and enters CPU 2
3) because the I/O thread is stuck in run_on_cpu, the round-robin kick
timer never triggers, and CPU 3 never runs the work item
4) run_on_cpu never completes
Reviewed-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Wed, 14 Nov 2018 09:38:13 +0000 (10:38 +0100)]
target/i386: kvm: add VMX migration blocker
Nested VMX does not support live migration yet. Add a blocker
until that is worked out.
Nested SVM only does not support it, but unfortunately it is
enabled by default for -cpu host so we cannot really disable it.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
ZhiPeng Lu [Tue, 27 Nov 2018 11:02:45 +0000 (19:02 +0800)]
hw/virt/arm: Add support for Cortex-A72 in virt
Signed-off-by: ZhiPeng Lu <luzhipeng@uniudc.com>
Message-id:
1543316565-
1101590-1-git-send-email-luzhipeng@uniudc.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Keith Busch [Mon, 26 Nov 2018 17:17:45 +0000 (10:17 -0700)]
nvme: Fix spurious interrupts
The code had asserted an interrupt every time it was requested to check
for new completion queue entries.This can result in spurious interrupts
seen by the guest OS.
Fix this by asserting an interrupt only if there are un-acknowledged
completion queue entries available.
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Kevin Wolf [Mon, 26 Nov 2018 11:21:07 +0000 (12:21 +0100)]
iotests: Test migration with -blockdev
Check that block node activation and inactivation works with a block
graph that is built with individually created nodes.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Kevin Wolf [Fri, 23 Nov 2018 14:11:14 +0000 (15:11 +0100)]
block: Don't inactivate children before parents
bdrv_child_cb_inactivate() asserts that parents are already inactive
when children get inactivated. This precondition is necessary because
parents could still issue requests in their inactivation code.
When block nodes are created individually with -blockdev, all of them
are monitor owned and will be returned by bdrv_next() in an undefined
order (in practice, in the order of their creation, which is usually
children before parents), which obviously fails the assertion:
qemu: block.c:899: bdrv_child_cb_inactivate: Assertion `bs->open_flags & BDRV_O_INACTIVE' failed.
This patch fixes the ordering by skipping nodes with still active
parents in bdrv_inactivate_recurse() because we know that they will be
covered by recursion when the last active parent becomes inactive.
With the correct parents-before-children ordering, we also got rid of
the reason why commit
aad0b7a0bfb introduced two passes, so we can go
back to a single-pass recursion. This is necessary so we can rely on the
BDRV_O_INACTIVE flag to skip nodes with active parents (the flag used
to be set only in pass 2, so we would always skip non-root nodes in
pass 1 because all parents would still be considered active; setting the
flag in pass 1 would mean, that we never skip anything in pass 2 because
all parents are already considered inactive).
Because of the change to single pass, this patch is best reviewed with
whitespace changes ignored.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Peter Maydell [Tue, 27 Nov 2018 11:21:38 +0000 (11:21 +0000)]
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-
20181127-pull-request' into staging
various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi
# gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT
# gpg: using RSA key
4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/fixes-31-
20181127-pull-request:
qapi: add query-display-options command
usb-host: set ifs.detached as true if kernel driver is not active
audio/hda: fix guest triggerable assert
cirrus_vga/migration: update the bank offset before use
ps2kbd: default to scan enabled after reset
fmops: fix off-by-one in AR_TABLE and DR_TABLE array size
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 27 Nov 2018 09:55:05 +0000 (09:55 +0000)]
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging
x86 fixes for -rc3
* Fix SynIC crash
* Fix x86 crash on MSR code on AMD hosts
# gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT
# gpg: using RSA key
2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6
* remotes/ehabkost/tags/x86-for-3.1-pull-request:
hw/hyperv: fix NULL dereference with pure-kvm SynIC
kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann [Thu, 22 Nov 2018 07:16:13 +0000 (08:16 +0100)]
qapi: add query-display-options command
Add query-display-options command, which allows querying the qemu
display configuration. This isn't particularly useful, except it
exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt
can discover recently added -display parameter rendernode (commit
d4dc4ab133b). Works around lack of sufficiently powerful command line
introspection.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Tested-by: Erik Skultety <eskultet@redhat.com>
Message-id:
20181122071613.2889-1-kraxel@redhat.com
[ kraxel: reworded commit message as suggested by armbru ]
linzhecheng [Tue, 20 Nov 2018 08:34:19 +0000 (16:34 +0800)]
usb-host: set ifs.detached as true if kernel driver is not active
If no kernel driver is active, we can already claim and perform I/O on
it without detaching it.
Signed-off-by: linzhecheng <linzhecheng@huawei.com>
Message-id:
20181120083419.17716-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Gerd Hoffmann [Fri, 23 Nov 2018 06:39:57 +0000 (07:39 +0100)]
audio/hda: fix guest triggerable assert
Guest writes to a readonly register trigger the assert in
intel_hda_reg_write(). Add a check and just ignore them.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20181123063957.9515-1-kraxel@redhat.com
Wang Xin [Fri, 23 Nov 2018 06:46:46 +0000 (14:46 +0800)]
cirrus_vga/migration: update the bank offset before use
The cirrus bank0/1 offset should be updated before we update the vram's alias
offset.
Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com>
Message-id:
20181123064646.23036-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Hervé Poussineau [Sun, 21 Oct 2018 19:07:21 +0000 (21:07 +0200)]
ps2kbd: default to scan enabled after reset
A check for scan_enabled has been added to ps2_keyboard_event in commit
143c04c7e0639e53086519592ead15d2556bfbf2 to prevent stream corruption.
This works well as long as operating system is resetting keyboard, or enabling it.
This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET,
KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard.
Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20181021190721.2148-1-hpoussin@reactos.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Roman Kagan [Mon, 26 Nov 2018 15:28:44 +0000 (15:28 +0000)]
hw/hyperv: fix NULL dereference with pure-kvm SynIC
When started in compat configuration of SynIC, e.g.
qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \
-cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic
or explicitly
qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on
QEMU crashes in hyperv_synic_reset() trying to access the non-present
qobject for SynIC.
Add the missing check for NULL.
Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reported-by: Igor Mammedov <imammedo@redhat.com>
Fixes:
9b4cf107b09d18ac30f46fd1c4de8585ccba030c
Fixes:
4a93722f9c279184e95b1e1ad775c01deec05065
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
Message-Id: <
20181126152836.25379-1-rkagan@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Bandan Das [Mon, 26 Nov 2018 04:17:28 +0000 (23:17 -0500)]
kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support
When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's
supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl.
Fixes:
d86f963694df27f11b3681ffd225c9362de1b634
Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: balducci@units.it
Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Peter Maydell [Mon, 26 Nov 2018 13:58:46 +0000 (13:58 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-
20181126' into staging
target-arm queue:
* some updates to MAINTAINERS file entries
* cadence_gem: Remove an incorrect assert()
# gpg: Signature made Mon 26 Nov 2018 13:57:34 GMT
# gpg: using RSA key
3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* remotes/pmaydell/tags/pull-target-arm-
20181126:
net: cadence_gem: Remove incorrect assert()
MAINTAINERS: Add an ARM SMMU section
MAINTAINERS: Assign some more files in the hw/arm/ directory
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Edgar E. Iglesias [Fri, 23 Nov 2018 13:54:50 +0000 (14:54 +0100)]
net: cadence_gem: Remove incorrect assert()
Don't assert on RX descriptor settings when the receiver is
disabled. This fixes an issue with incoming packets on an
unused GEM.
Reported-by: mbilal <muhammad_bilal@mentor.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20181123135450.24829-2-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger [Thu, 22 Nov 2018 18:01:43 +0000 (19:01 +0100)]
MAINTAINERS: Add an ARM SMMU section
Add a new ARM SMMU section and set Eric Auger as the maintainer
for ARM SMMU emulation sources.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id:
20181122180143.14237-1-eric.auger@redhat.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Thomas Huth [Mon, 26 Nov 2018 13:39:23 +0000 (13:39 +0000)]
MAINTAINERS: Assign some more files in the hw/arm/ directory
I apparently missed some more files and even a complete machine (the
"imx25-pdk") in my previous patch... but now we should hopefully have
a completely coverage for all available ARM boards.
Fixes:
95a5db3ae5698b49c63144610ad02913e780c828
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
1542782568-20059-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 26 Nov 2018 11:46:03 +0000 (11:46 +0000)]
Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging
Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489).
# gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT
# gpg: using RSA key
71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg: aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg: aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6
* remotes/gkurz/tags/for-upstream:
9p: fix QEMU crash when renaming files
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 26 Nov 2018 11:07:35 +0000 (11:07 +0000)]
Merge remote-tracking branch 'remotes/xtensa/tags/
20181125-xtensa' into staging
xtensa fixes for 3.1:
- fix register counting logic for linux-user gdbserver;
- provide default memory sizes for XTFPGA boards;
- add missing xtensa patterns to MAINTAINTERS.
# gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT
# gpg: using RSA key
51F9CC91F83FA044
# gpg: Good signature from "Max Filippov <filippov@cadence.com>"
# gpg: aka "Max Filippov <max.filippov@cogentembedded.com>"
# gpg: aka "Max Filippov <jcmvbkbc@gmail.com>"
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044
* remotes/xtensa/tags/
20181125-xtensa:
MAINTAINERS: add missing xtensa patterns
target/xtensa: xtfpga: provide default memory sizes
target/xtensa: drop num_[core_]regs from dc232b/dc233c configs
target/xtensa: gdbstub fix register counting
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann [Tue, 30 Oct 2018 08:23:40 +0000 (09:23 +0100)]
fmops: fix off-by-one in AR_TABLE and DR_TABLE array size
Cc: P J P <ppandit@redhat.com>
Reported-by: Wangjunqing <wangjunqing@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20181030082340.17170-1-kraxel@redhat.com
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Greg Kurz [Fri, 23 Nov 2018 12:28:03 +0000 (13:28 +0100)]
9p: fix QEMU crash when renaming files
When using the 9P2000.u version of the protocol, the following shell
command line in the guest can cause QEMU to crash:
while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done
With 9P2000.u, file renaming is handled by the WSTAT command. The
v9fs_wstat() function calls v9fs_complete_rename(), which calls
v9fs_fix_path() for every fid whose path is affected by the change.
The involved calls to v9fs_path_copy() may race with any other access
to the fid path performed by some worker thread, causing a crash like
shown below:
Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0,
flags=65536, mode=0) at hw/9pfs/9p-local.c:59
59 while (*path && fd != -1) {
(gdb) bt
#0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8,
path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59
#1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8,
path=0x0) at hw/9pfs/9p-local.c:92
#2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8,
fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185
#3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498,
path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53
#4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498)
at hw/9pfs/9p.c:1083
#5 0x0000555555e060a2 in coroutine_trampoline (i0=-
669165424, i1=32767)
at util/coroutine-ucontext.c:116
#6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6
#7 0x0000000000000000 in ()
(gdb)
The fix is to take the path write lock when calling v9fs_complete_rename(),
like in v9fs_rename().
Impact: DoS triggered by unprivileged guest users.
Fixes: CVE-2018-19489
Cc: P J P <ppandit@redhat.com>
Reported-by: zhibin hu <noirfate@gmail.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
Peter Maydell [Fri, 23 Nov 2018 08:54:52 +0000 (08:54 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
- block: Fix option inheritance after stream/commit job graph changes
- qemu-img: Fix memory leak and typo in error message
- nvme: Fixes for lockups and crashes
- scsi-disk: Fix crash if underlying host file or disk returns error
- Several qemu-iotests fixes and improvements
# gpg: Signature made Thu 22 Nov 2018 18:38:30 GMT
# gpg: using RSA key
7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
iotests: Enhance 223 to cover multiple bitmap granularities
nvme: fix bug with PCI IRQ pins on teardown
nvme: fix CMB endianness confusion
Revert "nvme: fix oob access issue(CVE-2018-16847)"
nvme: fix out-of-bounds access to the CMB
nvme: call blk_drain in NVMe reset code to avoid lockups
iotests: fix nbd test 233 to work correctly with raw images
block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
scsi-disk: Fix crash if underlying host file or disk returns error
qemu-img: Fix leak
qemu-img: Fix typo
iotests: Skip 233 if certtool not installed
iotests: Replace assertEquals() with assertEqual()
iotests: Replace time.clock() with Timeout
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Max Filippov [Thu, 22 Nov 2018 23:06:21 +0000 (15:06 -0800)]
MAINTAINERS: add missing xtensa patterns
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Alberto Garcia [Wed, 31 Oct 2018 16:16:38 +0000 (18:16 +0200)]
block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
The previous patch fixed the inherits_from pointer after block-stream,
and this one does the same for block-commit.
When block-commit finishes and the 'top' node is not the topmost one
from the backing chain then all nodes above 'base' up to and including
'top' are removed from the chain.
The bdrv_drop_intermediate() call converts a chain like this one:
base <- intermediate <- top <- active
into this one:
base <- active
In a simple scenario each backing file from the first chain has the
inherits_from attribute pointing to its parent. This means that
reopening 'active' will recursively reopen all its children, whose
options can be changed in the process.
However after the 'block-commit' call base.inherits_from is NULL and
the chain is broken, so 'base' does not inherit from 'active' and will
not be reopened automatically:
$ qemu-img create -f qcow2 hd0.qcow2 1M
$ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
$ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
$ $QEMU -drive if=none,file=hd2.qcow2
{ 'execute': 'block-commit',
'arguments': {
'device': 'none0',
'top': 'hd1.qcow2' } }
{ 'execute': 'human-monitor-command',
'arguments': {
'command-line':
'qemu-io none0 "reopen -o backing.l2-cache-size=2M"' } }
{ "return": "Cannot change the option 'backing.l2-cache-size'\r\n"}
This patch updates base.inherits_from in this scenario, and adds a
test case.
Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Alberto Garcia [Wed, 31 Oct 2018 16:16:37 +0000 (18:16 +0200)]
block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
When a BlockDriverState's child is opened (be it a backing file, the
protocol layer, or any other) inherits_from is set to point to the
parent node. Children opened separately and then attached to a parent
don't have this pointer set.
bdrv_reopen_queue_child() uses this to determine whether a node's
children must also be reopened inheriting the options from the parent
or not. If inherits_from points to the parent then the child is
reopened and its options can be changed, like in this example:
$ qemu-img create -f qcow2 hd0.qcow2 1M
$ qemu-img create -f qcow2 hd1.qcow2 1M
$ $QEMU -drive if=none,node-name=hd0,file=hd0.qcow2,\
backing.driver=qcow2,backing.file.filename=hd1.qcow2
(qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"
If the child does not inherit from the parent then it does not get
reopened and its options cannot be changed:
$ $QEMU -drive if=none,node-name=hd1,file=hd1.qcow2
-drive if=none,node-name=hd0,file=hd0.qcow2,backing=hd1
(qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"
Cannot change the option 'backing.l2-cache-size'
If a disk image has a chain of backing files then all of them are also
connected through their inherits_from pointers (i.e. it's possible to
walk the chain in reverse order from base to top).
However this is broken if the intermediate nodes are removed using
e.g. block-stream because the inherits_from pointer from the base node
becomes NULL:
$ qemu-img create -f qcow2 hd0.qcow2 1M
$ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
$ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
$ $QEMU -drive if=none,file=hd2.qcow2
(qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
(qemu) block_stream none0 0 hd0.qcow2
(qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
Cannot change the option 'backing.l2-cache-size'
This patch updates the inherits_from pointer if the intermediate nodes
of a backing chain are removed using bdrv_set_backing_hd(), and adds a
test case for this scenario.
Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Eric Blake [Mon, 19 Nov 2018 17:29:24 +0000 (11:29 -0600)]
iotests: Enhance 223 to cover multiple bitmap granularities
Testing granularity at the same size as the cluster isn't quite
as fun as what happens when it is larger or smaller. This
enhancement also shows that qemu's nbd server can serve the
same disk over multiple exports simultaneously.
Signed-off-by: Eric Blake <eblake@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Logan Gunthorpe [Wed, 21 Nov 2018 18:10:13 +0000 (11:10 -0700)]
nvme: fix bug with PCI IRQ pins on teardown
When the submission and completion queues are being torn down
the IRQ will be asserted for the completion queue when the
submsission queue is deleted. Then when the completion queue
is deleted it stays asserted. Thus, on systems that do
not use MSI, no further interrupts can be triggered on the host.
Linux sees this as a long delay when unbinding the nvme device.
Eventually the interrupt timeout occurs and it continues.
To fix this we ensure we deassert the IRQ for a CQ when it is
deleted.
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Paolo Bonzini [Thu, 22 Nov 2018 18:23:35 +0000 (19:23 +0100)]
nvme: fix CMB endianness confusion
The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be
read/written as if it was little-endian output (in the case of
big endian, we get two swaps, one in the memory core and one
in nvme.c).
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Kevin Wolf [Thu, 22 Nov 2018 14:52:20 +0000 (15:52 +0100)]
Revert "nvme: fix oob access issue(CVE-2018-16847)"
This reverts commit
5e3c0220d7e4f0361c4d36c697a8842f2b583402.
We have a better fix commited for this now.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Paolo Bonzini [Tue, 20 Nov 2018 18:41:48 +0000 (19:41 +0100)]
nvme: fix out-of-bounds access to the CMB
Because the CMB BAR has a min_access_size of 2, if you read the last
byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one
error. This is CVE-2018-16847.
Another way to fix this might be to register the CMB as a RAM memory
region, which would also be more efficient. However, that might be a
change for big-endian machines; I didn't think this through and I don't
know how real hardware works. Add a basic testcase for the CMB in case
somebody does this change later on.
Cc: Keith Busch <keith.busch@intel.com>
Cc: qemu-block@nongnu.org
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>