aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-12Merge remote-tracking branch 'mreitz/tags/pull-block-2018-11-12' into ↵Kevin Wolf
queue-block Block patches: - Added NULL checks found by static analysis - Allow more block drivers to not be included in the qemu build # gpg: Signature made Mon Nov 12 17:51:18 2018 CET # gpg: using RSA key F407DB0061D5CF40 # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * mreitz/tags/pull-block-2018-11-12: qcow2: Read outside array bounds in qcow2_pre_write_overlap_check() block: Fix potential Null pointer dereferences in vvfat.c qemu-img: assert block_job_get() does not return NULL in img_commit() block: Null pointer dereference in blk_root_get_parent_desc() job: Fix off-by-one assert checks for JobSTT and JobVerbTable block: Make more block drivers compile-time configurable Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()Liam Merwick
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[]. As a result, an array dereference of metadata_ol_names[8] in qcow2_pre_write_overlap_check() could result in a read outside of the array bounds. Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory') Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1541453919-25973-6-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12block: Fix potential Null pointer dereferences in vvfat.cLiam Merwick
The calls to find_mapping_for_cluster() may return NULL but it isn't always checked for before dereferencing the value returned. Additionally, add some asserts to cover cases where NULL can't be returned but which might not be obvious at first glance. Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Message-id: 1541453919-25973-5-git-send-email-Liam.Merwick@oracle.com [mreitz: Dropped superfluous check of "mapping" following an assertion that it is not NULL, and fixed some indentation] Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12qemu-img: assert block_job_get() does not return NULL in img_commit()Liam Merwick
Although the function block_job_get() can return NULL, it would be a serious bug if it did so (because the job yields before executing anything (if it started successfully); but otherwise, commit_active_start() would have returned an error). However, as a precaution, before dereferencing the 'job' pointer in img_commit() assert it is not NULL. Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1541453919-25973-4-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12block: Null pointer dereference in blk_root_get_parent_desc()Liam Merwick
The dev_id returned by the call to blk_get_attached_dev_id() in blk_root_get_parent_desc() can be NULL (an internal call to object_get_canonical_path may have returned NULL). Instead of just checking this case before before dereferencing, adjust blk_get_attached_dev_id() to return the empty string if no object path can be found (similar to the case when blk->dev is NULL and an empty string is returned). Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Message-id: 1541453919-25973-3-git-send-email-Liam.Merwick@oracle.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12job: Fix off-by-one assert checks for JobSTT and JobVerbTableLiam Merwick
In the assert checking the array dereference of JobVerbTable[verb] in job_apply_verb() the check of the index, verb, allows an overrun because an index equal to the array size is permitted. Similarly, in the assert check of JobSTT[s0][s1] with index s1 in job_state_transition(), an off-by-one overrun is not flagged either. This is not a run-time issue as there are no callers actually passing in the max value. Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Darren Kenny <Darren.Kenny@oracle.com> Reviewed-by: Mark Kanda <Mark.Kanda@oracle.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1541453919-25973-2-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12block: Make more block drivers compile-time configurableJeff Cody
This adds configure options to control the following block drivers: * Bochs * Cloop * Dmg * Qcow (V1) * Vdi * Vvfat * qed * parallels * sheepdog Each of these defaults to being enabled. Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181107063644.2254-1-armbru@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2018-11-12tests: Add unit tests for image lockingFam Zheng
Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12file-posix: Drop s->lock_fdFam Zheng
The lock_fd field is not strictly necessary because transferring locked bytes from old fd to the new one shouldn't fail anyway. This spares the user one fd per image. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12file-posix: Skip effectiveless OFD lock operationsFam Zheng
If we know we've already locked the bytes, don't do it again; similarly don't unlock a byte if we haven't locked it. This doesn't change the behavior, but fixes a corner case explained below. Libvirt had an error handling bug that an image can get its (ownership, file mode, SELinux) permissions changed (RHBZ 1584982) by mistake behind QEMU. Specifically, an image in use by Libvirt VM has: $ ls -lhZ b.img -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c600,c690 b.img Trying to attach it a second time won't work because of image locking. And after the error, it becomes: $ ls -lhZ b.img -rw-r--r--. root root system_u:object_r:virt_image_t:s0 b.img Then, we won't be able to do OFD lock operations with the existing fd. In other words, the code such as in blk_detach_dev: blk_set_perm(blk, 0, BLK_PERM_ALL, &error_abort); can abort() QEMU, out of environmental changes. This patch is an easy fix to this and the change is regardlessly reasonable, so do it. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12nvme: free cmbuf in nvme_exitLi Qiang
This avoid a memory leak in unhotplug nvme device. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12nvme: don't unref ctrl_mem when device unrealizedLi Qiang
Currently, when hotplug/unhotplug nvme device, it will cause an assert in object.c. Following is the backtrack: ERROR:qom/object.c:981:object_unref: assertion failed: (obj->ref > 0) Thread 2 "qemu-system-x86" received signal SIGABRT, Aborted. [Switching to Thread 0x7fffcbd32700 (LWP 18844)] 0x00007fffdb9e4fff in raise () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) bt /lib/x86_64-linux-gnu/libglib-2.0.so.0 /lib/x86_64-linux-gnu/libglib-2.0.so.0 qom/object.c:981 /home/liqiang02/qemu-upstream/qemu/memory.c:1732 /home/liqiang02/qemu-upstream/qemu/memory.c:285 util/qemu-thread-posix.c:504 /lib/x86_64-linux-gnu/libpthread.so.0 This is caused by memory_region_unref in nvme_exit. Remove it to make the PCIdevice refcount correct. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12blockdev: Consistently use snapshot_node_name in external_snapshot_prepare()Peter Maydell
In the function external_snapshot_prepare() we have a BlockdevSnapshotSync struct, which has the usual combination of has_snapshot_node_name and snapshot_node_name fields for an optional field. We set up a local variable const char *snapshot_node_name = s->has_snapshot_node_name ? s->snapshot_node_name : NULL; and then mostly use "if (!snapshot_node_name)" for checking whether we have a snapshot node name. The exception is that in one place we check s->has_snapshot_node_name instead. This confuses Coverity (CID 1396473), which thinks it might be possible to get here with s->has_snapshot_node_name true but snapshot_node_name NULL, and warns that the call to qdict_put_str() will segfault in that case. Make the code consistent and unconfuse Coverity by using the same check for this conditional that we do in the rest of the surrounding code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12blockdev: handle error on block latency histogram set errorzhenwei pi
Function block_latency_histogram_set may return error, but qapi ignore this. This can be reproduced easily by qmp command: virsh qemu-monitor-command INSTANCE '{"execute":"x-block-latency-histogram-set", "arguments":{"device":"drive-virtio-disk1","boundaries":[10,200,40]}}' In fact this command does not work, but we still get success result. qmp_x_block_latency_histogram_set is a batch setting API, report error ASAP. Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12file-posix: Use error API properlyFam Zheng
Use error_report for situations that affect user operation (i.e. we're actually returning error), and warn_report/warn_report_err when some less critical error happened but the user operation can still carry on. For raw_normalize_devicepath, add Error parameter to propagate to its callers. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-12Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging fixes for 3.1: mark bt as deprecated, bugfixes for pulse, gtk and edid. # gpg: Signature made Mon 12 Nov 2018 15:14:58 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181112-pull-request: ui/gtk: fix cursor in egl mode pulseaudio: process audio data in smaller chunks edid: silence a stringop-overflow warning bt: Mark the bluetooth subsystem as deprecated Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12linux-user: Add support for SO_REUSEPORTYunqiang Su
Add support for SO_REUSEPORT, including strace support. SO_REUSEPORT was introduced relatively recently, since Linux 3.9, so use '#if defined SO_REUSEPORT'. Signed-off-by: Yunqiang Su <ysu@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <1540904108-30873-4-git-send-email-aleksandar.markovic@rt-rk.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-11-12hw/acpi/nvdimm: Don't take address of fields in packed structsPeter Maydell
Taking the address of a field in a packed struct is a bad idea, because it might not be actually aligned enough for that pointer type (and thus cause a crash on dereference on some host architectures). Newer versions of clang warn about this. Avoid the bug by not using the "modify in place" byte swapping functions. Patch produced with scripts/coccinelle/inplace-byteswaps.cocci. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20181016175236.5840-1-peter.maydell@linaro.org
2018-11-12linux-user: Clean up nios2 main loop signal handlingPeter Maydell
The nios2 main loop code's code does some odd things with gdb_handlesig() that no other target CPU does: it has some signals that are delivered to gdb and only to gdb. Stop doing this, and instead behave like all the other targets: * a trap instruction becomes a SIGTRAP * an unhandled exception type returned from cpu_exec() causes us to abort(), not to try to hand gdb a SIGILL This fixes in passing Coverity issue CID 1390853, which was a complaint that the old code failed to check the return value from gdb_handlesig(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181019174958.26616-3-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [lv: removed gdbsig unused variable] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-11-12linux-user: Don't call gdb_handlesig() before queue_signal()Peter Maydell
The CPU main-loop routines for linux-user generally call gdb_handlesig() when they're about to queue a SIGTRAP signal. This is wrong, because queue_signal() will cause us to pend a signal, and process_pending_signals() will then call gdb_handlesig() itself. So the effect is that we notify gdb of the SIGTRAP, and then if gdb says "OK, continue with signal X" we will incorrectly notify gdb of the signal X as well. We don't do this double-notify for anything else, only SIGTRAP. Remove this unnecessary and incorrect code from all the targets except for nios2 (whose main loop is doing something different and broken, and will be handled in a separate patch). This bug only manifests if the user responds to the reported SIGTRAP using "signal SIGFOO" rather than "continue"; since the latter is the overwhelmingly common thing to do after a breakpoint most people won't have hit this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20181019174958.26616-2-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-11-12linux-user: Remove dead error-checking codePeter Maydell
Remove some dead code spotted by Coverity (CID 1009855, 1390854, 1390847). The underlying cause in all these cases is the same: QEMU's put_user operations can't result in errors, but the kernel's equivalent does. So when code was copied from the kernel signal-frame-setup/teardown code, checks on error flags that were needed in the kernel became dead code for us. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20181019161715.12122-1-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-11-12ui/gtk: fix cursor in egl modeGerd Hoffmann
In egl mode the scale_x and scale_y variables are not set, so the scaling logic in the mouse motion event handler does not work. Fix that. Also scale the cursor position in gd_egl_cursor_position(). Reported-by: Chen Zhang <tgfbeta@icloud.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Chen Zhang <tgfbeta@icloud.com> Message-id: 20181107074949.13805-1-kraxel@redhat.com
2018-11-12pulseaudio: process audio data in smaller chunksGerd Hoffmann
The rate of pulseaudio absorbing the audio stream is used to control the the rate of the guests audio stream. When the emulated hardware uses small chunks (like intel-hda does) we need small chunks on the audio backend side too, otherwise that feedback loop doesn't work very well. Cc: Max Ehrlich <maxehr@umiacs.umd.edu> Cc: Martin Schrodt <martin@schrodt.org> Buglink: https://bugs.launchpad.net/bugs/1795527 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181109142032.1628-1-kraxel@redhat.com
2018-11-12edid: silence a stringop-overflow warningMarc-André Lureau
Simplify the code that doesn't need strncpy() since length of string is already computed. /home/elmarco/src/qemu/hw/display/edid-generate.c: In function 'edid_desc_text': /home/elmarco/src/qemu/hw/display/edid-generate.c:168:5: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=] strncpy((char *)(desc + 5), text, len); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/elmarco/src/qemu/hw/display/edid-generate.c:164:11: note: length computed here len = strlen(text); ^~~~~~~~~~~~ cc1: all warnings being treated as errors Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181110111623.31356-1-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-12bt: Mark the bluetooth subsystem as deprecatedThomas Huth
It has been unmaintained since years, and there were only trivial or tree-wide changes to the related files since many years, so the code is likely very bitrotten and broken. For example the following segfaults as soon as as you press a key: qemu-system-x86_64 -usb -device usb-bt-dongle -bt hci -bt device:keyboard Since we are not aware of anybody using bluetooth with the current version of QEMU, let's mark the subsystem as deprecated, with a special request for the users to write to the qemu-devel mailing list in case they still use it (so we could revert the deprecation status in that case). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1542016830-19189-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-12docker: use HTTPS git URL for virglrendererStefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20181108111531.30671-9-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12target-alpha: use HTTPS git URL for palcodeStefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Cc: Richard Henderson <rth@twiddle.net> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181108111531.30671-8-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12pc-testdev: use HTTPS git URLStefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Cc: Paolo Bonzini <pbonzini@redhat.com> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181108111531.30671-7-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12git: use HTTPS git URLs for repo.or.czStefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181108111531.30671-6-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12gitmodules: use 'https://' instead of 'git://'Stefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Also change git.qemu-project.org to git.qemu.org (we control both domain names but qemu.org is used more widely). Reported-by: Jann Horn <jannh@google.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181108111531.30671-5-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12MAINTAINERS: use 'https://' instead of 'git://' for GitHubStefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Reported-by: Jann Horn <jannh@google.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181108111531.30671-4-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12get_maintainer: use 'https://' instead of 'git://'Stefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Reported-by: Jann Horn <jannh@google.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181108111531.30671-3-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12README: use 'https://' instead of 'git://'Stefan Hajnoczi
When you clone the repository without previous commit history, 'git://' doesn't protect from man-in-the-middle attacks. HTTPS is more secure since the client verifies the server certificate. Reported-by: Jann Horn <jannh@google.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20181108111531.30671-2-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-12Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into ↵Peter Maydell
staging slirp updates Peter Maydell (4): slirp: Don't pass possibly -1 fd to send() slirp: Use g_new() to allocate sockets in socreate() slirp: Remove code that handles socreate() failure slirp: fork_exec(): create and connect child socket before fork() # gpg: Signature made Sat 10 Nov 2018 14:08:53 GMT # gpg: using RSA key E3F65A9E9560DB4C # gpg: Good signature from "Samuel Thibault <samuel.thibault@aquilenet.fr>" # gpg: aka "Samuel Thibault <sthibault@debian.org>" # gpg: aka "Samuel Thibault <samuel.thibault@gnu.org>" # gpg: aka "Samuel Thibault <samuel.thibault@inria.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@labri.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@ens-lyon.org>" # gpg: aka "Samuel Thibault <samuel.thibault@u-bordeaux.fr>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 900C B024 B679 31D4 0F82 304B D017 8C76 7D06 9EE6 # Subkey fingerprint: 33FA 7B64 6195 01F8 CE9C 8F97 E3F6 5A9E 9560 DB4C * remotes/thibault/tags/samuel-thibault: slirp: fork_exec(): create and connect child socket before fork() slirp: Remove code that handles socreate() failure slirp: Use g_new() to allocate sockets in socreate() slirp: Don't pass possibly -1 fd to send() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-10slirp: fork_exec(): create and connect child socket before fork()Peter Maydell
Currently fork_exec() fork()s, and then creates and connects the child socket which it uses for communication with the parent in the child process. This is awkward because the child has no mechanism to report failure back to the parent, which might end up blocked forever in accept(). The child code also has an issue pointed out by Coverity (CID 1005727), where if the qemu_socket() call fails it will pass -1 as a file descriptor to connect(). Fix these issues by moving the creation of the child's end of the socket to before the fork(), where we are in a position to handle a possible failure. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2018-11-10slirp: Remove code that handles socreate() failurePeter Maydell
Now that socreate() can never fail, we can remove the code that was trying to handle that situation. In particular this removes code in tcp_connect() that provoked Coverity to complain (CID 1005724): in closesocket(accept(inso->s, (struct sockaddr *)&addr, &addrlen)); if the accept() call fails then we pass closesocket() -1 instead of a valid file descriptor. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2018-11-10slirp: Use g_new() to allocate sockets in socreate()Peter Maydell
The slirp socreate() function can only fail if the attempt to malloc() the struct socket fails. Switch to using g_new() instead, which will allow us to remove the error-handling code from its callers. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2018-11-10slirp: Don't pass possibly -1 fd to send()Peter Maydell
Coverity complains (CID 1005726) that we might pass -1 as the fd argument to send() in slirp_send(), because we previously checked for "so->s == -1 && so->extra". The case of "so->s == -1 but so->extra NULL" should not in theory happen, but it is hard to guarantee because various places in the code do so->s = qemu_socket(...) and so will end up with so->s == -1 on failure, and not all the paths which call that always throw away the socket in that case (eg tcp_fconnect()). So just check specifically for the condition and fail slirp_send(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2018-11-09qga: Add multiple include guard to guest-agent-core.hPeter Maydell
The guest-agent-core.h header was missing the usual guards against multiple inclusion; add them. (Spotted by lgtm.com's static analyzer.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2018-11-09qga-win: fix leaks of build_guest_disk_info()Marc-André Lureau
Introduced in commit b1ba8890e63ce9432c41c5c3fc229f54c87c9c99, vol_h handle should be closed, and "out" cleanup should be done after DeviceIoControl() fails. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2018-11-09Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes a potential use-after-free issue that could be triggered by a misbehaving guest. # gpg: Signature made Thu 08 Nov 2018 20:36:48 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: write lock path in v9fs_co_open2() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-089p: write lock path in v9fs_co_open2()Greg Kurz
The assumption that the fid cannot be used by any other operation is wrong. At least, nothing prevents a misbehaving client to create a file with a given fid, and to pass this fid to some other operation at the same time (ie, without waiting for the response to the creation request). The call to v9fs_path_copy() performed by the worker thread after the file was created can race with any access to the fid path performed by some other thread. This causes use-after-free issues that can be detected by ASAN with a custom 9p client. Unlike other operations that only read the fid path, v9fs_co_open2() does modify it. It should hence take the write lock. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-08Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc1' ↵Peter Maydell
into staging A Single RISC-V Patch for 3.1-rc1 This tag contains a single patch that I'd like to target for rc1: a fix for a memory leak that was detected by static code analysis. There are still three patch sets that I'd like to try to get up for 3.1: * The patch set Basian just published that contains fixes for a pair of issues he found when converting our port to decodetree. * An as-of-yet-unwritten fix to the third issue that Basian pointed out. * A fix to our fflags bug, which is currently coupled to some CSR refactoring that I don't think is OK for 3.1. I'm at Plumbers next week (and I think Alistair is there too?), but I'll try to find a way to squeeze in as much as possible. # gpg: Signature made Thu 08 Nov 2018 16:50:27 GMT # gpg: using RSA key EF4CA1502CCBAB41 # gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" # gpg: aka "Palmer Dabbelt <palmer@sifive.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41 * remotes/riscv/tags/riscv-for-master-3.1-rc1: riscv: spike: Fix memory leak in the board init Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-08riscv: spike: Fix memory leak in the board initAlistair Francis
Coverity caught a malloc() call that was never freed. This patch ensures that we free the memory but also updates the allocation to use g_strdup_printf() instead of malloc(). Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
2018-11-08tcg/tcg-op.h: Add multiple include guardPeter Maydell
The tcg-op.h header was missing the usual guard against multiple inclusion; add it. (Spotted by lgtm.com's static analyzer.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181108125256.30986-1-peter.maydell@linaro.org
2018-11-08Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.1-20181108' ↵Peter Maydell
into staging ppc patch queue 2018-11-08 Here's another patch of accumulated ppc patches for qemu-3.1. Highlights are: * Support for nested HV KVM on POWER9 hosts * Remove Alex Graf as ppc maintainer * Emulation of external PID instructions # gpg: Signature made Thu 08 Nov 2018 12:14:27 GMT # gpg: using RSA key 6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-3.1-20181108: (22 commits) ppc/spapr_caps: Add SPAPR_CAP_NESTED_KVM_HV target/ppc: Add one reg id for ptcr This patch fixes processing of rfi instructions in icount mode. hw/ppc/ppc440_uc: Remove dead code in sdram_size() MAINTAINERS: PPC: Remove myself ppc/pnv: check size before data buffer access target/ppc: fix mtmsr instruction for icount hw/ppc/mac_newworld: Free openpic_irqs array after use macio/pmu: Fix missing vmsd terminator spapr_pci: convert g_malloc() to g_new() target/ppc: Split out float_invalid_cvt target/ppc: Split out float_invalid_op_div target/ppc: Split out float_invalid_op_mul target/ppc: Split out float_invalid_op_addsub target/ppc: Introduce fp number classification target/ppc: Remove float_check_status target/ppc: Split up float_invalid_op_excp hw/ppc/spapr_rng: Introduce CONFIG_SPAPR_RNG switch for spapr_rng.c PPC: e500: convert SysBus init method to a realize method ppc4xx_pci: convert SysBus init method to a realize method ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-08replay: Exit on errors reading from replay logPeter Maydell
Currently replay_get_byte() does not check for an error from getc(). Coverity points out (CID 1390622) that this could result in unexpected behaviour (such as looping forever, if we use the replay_get_dword() return value for a loop count). We don't expect reads from the replay log to fail, and if they do there is no way we can continue. So make them fatal errors. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-id: 20181106153330.5139-1-peter.maydell@linaro.org
2018-11-08Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* icount fix (Clement) * dumping fixes for non-volatile memory (Marc-André, myself) * x86 emulation fix (Rudolf) * recent Hyper-V CPUID flag (Vitaly) * Q35 doc fix (Daniel) * lsi fix (Prasad) * SCSI block limits emulation fixes (myself) * qemu_thread_atexit rework (Peter) * ivshmem memory leak fix (Igor) # gpg: Signature made Tue 06 Nov 2018 21:34:30 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: util/qemu-thread-posix: Fix qemu_thread_atexit* for OSX include/qemu/thread.h: Document qemu_thread_atexit* API scsi-generic: do not do VPD emulation for sense other than ILLEGAL_REQUEST scsi-generic: avoid invalid access to struct when emulating block limits scsi-generic: avoid out-of-bounds access to VPD page list scsi-generic: keep VPD page list sorted lsi53c895a: check message length value is valid scripts/dump-guest-memory: Synchronize with guest_phys_blocks_region_add memory-mapping: skip non-volatile memory regions in GuestPhysBlockList nvdimm: set non-volatile on the memory region memory: learn about non-volatile memory region target/i386: Clear RF on SYSCALL instruction MAINTAINERS: remove or downgrade myself to reviewer from some subsystems ivshmem: fix memory backend leak i386: clarify that the Q35 machine type implements a P35 chipset x86: hv_evmcs CPU flag support icount: fix deadlock when all cpus are sleeping Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-08ppc/spapr_caps: Add SPAPR_CAP_NESTED_KVM_HVSuraj Jitindar Singh
Add the spapr cap SPAPR_CAP_NESTED_KVM_HV to be used to control the availability of nested kvm-hv to the level 1 (L1) guest. Assuming a hypervisor with support enabled an L1 guest can be allowed to use the kvm-hv module (and thus run it's own kvm-hv guests) by setting: -machine pseries,cap-nested-hv=true or disabled with: -machine pseries,cap-nested-hv=false Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-11-08target/ppc: Add one reg id for ptcrSuraj Jitindar Singh
The ptcr (partition table control register) is used to store the address and size of the partition table. For nested kvm-hv we have a level 1 guest register the location of it's partition table with the hypervisor. Thus to support migration we need to be able to read this out of kvm and restore it post migration. Add the one reg id for the ptcr. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 16:17:57 +0000