aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-09-29Update version for 2.6.2 releasev2.6.2stable-2.6Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28s390x/css: handle cssid 255 correctlyCornelia Huck2-6/+4
The cssid 255 is reserved but still valid from an architectural point of view. However, feeding a bogus schid of 0xffffffff into the virtio hypercall will lead to a crash: Stack trace of thread 138363: #0 0x00000000100d168c css_find_subch (qemu-system-s390x) #1 0x00000000100d3290 virtio_ccw_hcall_notify #2 0x00000000100cbf60 s390_virtio_hypercall #3 0x000000001010ff7a handle_hypercall #4 0x0000000010079ed4 kvm_cpu_exec (qemu-system-s390x) #5 0x00000000100609b4 qemu_kvm_cpu_thread_fn #6 0x000003ff8b887bb4 start_thread (libpthread.so.0) #7 0x000003ff8b78df0a thread_start (libc.so.6) This is because the css array was only allocated for 0..254 instead of 0..255. Let's fix this by bumping MAX_CSSID to 255 and fencing off the reserved cssid of 255 during css image allocation. Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 882b3b97697affb36ca3d174f42f846232008979) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28ahci: clear aiocb in ncq_cbJohn Snow1-0/+1
Similar to existing fixes for IDE (87ac25fd) and ATAPI (7f951b2d), the AIOCB must be cleared in the callback. Otherwise, we may accidentally try to reset a dangling pointer in bdrv_aio_cancel() from a port reset. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1474575040-32079-2-git-send-email-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc: fix incorrect checking condition when updating clientGonglei1-1/+1
vs->disconnecting is set to TRUE and vs->ioc is closed, but vs->ioc isn't set to NULL, so that the vnc_disconnect_finish() isn't invoked when you update client in vnc_update_client() after vnc_disconnect_start invoked. Let's using change the checking condition to avoid resource leak. Signed-off-by: Haibin Wang <wanghaibin.wang@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1467949056-81208-1-git-send-email-arei.gonglei@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 5a693efda84d7df5136cc2bd31c959bb1530b0c9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc-enc-tight: fix off-by-one bugHerongguang (Stephen)1-1/+2
In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop, the logic is supposed to be that i is an index into src, i should be incremented when incrementing src. This is broken when src is incremented but i is not before while loop, resulting in off-by-one bug in while loop. Signed-off-by: He Rongguang <herongguang.he@huawei.com> Message-id: 5784B8EB.7010008@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 3f7e51bca3ef2d64c53b35ab9916c99e4a9e3c69) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc: make sure we finish disconnectGerd Hoffmann1-0/+5
It may happen that vnc connections linger in disconnecting state forever because VncState happens to be in a state where vnc_update_client() exists early and never reaches the vnc_disconnect_finish() call at the bottom of the function. Fix that by doing an additinal check at the start of the function. https://bugzilla.redhat.com/show_bug.cgi?id=1352799 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1468405280-2571-1-git-send-email-kraxel@redhat.com (cherry picked from commit 5a8be0f73d6f60ff08746377eb09ca459f39deab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc: don't crash getting server info if lsock is NULLDaniel P. Berrange1-0/+5
When VNC is started with '-vnc none' there will be no listener socket present. When we try to populate the VncServerInfo we'll crash accessing a NULL 'lsock' field. #0 qio_channel_socket_get_local_address (ioc=0x0, errp=errp@entry=0x7ffd5b8aa0f0) at io/channel-socket.c:33 #1 0x00007f4b9a297d6f in vnc_init_basic_info_from_server_addr (errp=0x7ffd5b8aa0f0, info=0x7f4b9d425460, ioc=<optimized out>) at ui/vnc.c:146 #2 vnc_server_info_get (vd=0x7f4b9e858000) at ui/vnc.c:223 #3 0x00007f4b9a29d318 in vnc_qmp_event (vs=0x7f4b9ef82000, vs=0x7f4b9ef82000, event=QAPI_EVENT_VNC_CONNECTED) at ui/vnc.c:279 #4 vnc_connect (vd=vd@entry=0x7f4b9e858000, sioc=sioc@entry=0x7f4b9e8b3a20, skipauth=skipauth@entry=true, websocket=websocket @entry=false) at ui/vnc.c:2994 #5 0x00007f4b9a29e8c8 in vnc_display_add_client (id=<optimized out>, csock=<optimized out>, skipauth=<optimized out>) at ui/v nc.c:3825 #6 0x00007f4b9a18d8a1 in qmp_marshal_add_client (args=<optimized out>, ret=<optimized out>, errp=0x7ffd5b8aa230) at qmp-marsh al.c:123 #7 0x00007f4b9a0b53f5 in handle_qmp_command (parser=<optimized out>, tokens=<optimized out>) at /usr/src/debug/qemu-2.6.0/mon itor.c:3922 #8 0x00007f4b9a348580 in json_message_process_token (lexer=0x7f4b9c78dfe8, input=0x7f4b9c7350e0, type=JSON_RCURLY, x=111, y=5 9) at qobject/json-streamer.c:94 #9 0x00007f4b9a35cfeb in json_lexer_feed_char (lexer=lexer@entry=0x7f4b9c78dfe8, ch=125 '}', flush=flush@entry=false) at qobj ect/json-lexer.c:310 #10 0x00007f4b9a35d0ae in json_lexer_feed (lexer=0x7f4b9c78dfe8, buffer=<optimized out>, size=<optimized out>) at qobject/json -lexer.c:360 #11 0x00007f4b9a348679 in json_message_parser_feed (parser=<optimized out>, buffer=<optimized out>, size=<optimized out>) at q object/json-streamer.c:114 #12 0x00007f4b9a0b3a1b in monitor_qmp_read (opaque=<optimized out>, buf=<optimized out>, size=<optimized out>) at /usr/src/deb ug/qemu-2.6.0/monitor.c:3938 #13 0x00007f4b9a186751 in tcp_chr_read (chan=<optimized out>, cond=<optimized out>, opaque=0x7f4b9c7add40) at qemu-char.c:2895 #14 0x00007f4b92b5c79a in g_main_context_dispatch () from /lib64/libglib-2.0.so.0 #15 0x00007f4b9a2bb0c0 in glib_pollfds_poll () at main-loop.c:213 #16 os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:258 #17 main_loop_wait (nonblocking=<optimized out>) at main-loop.c:506 #18 0x00007f4b9a0835cf in main_loop () at vl.c:1934 #19 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4667 Do an upfront check for a NULL lsock and report an error to the caller, which matches behaviour from before commit 04d2529da27db512dcbd5e99d0e26d333f16efcc Author: Daniel P. Berrange <berrange@redhat.com> Date: Fri Feb 27 16:20:57 2015 +0000 ui: convert VNC server to use QIOChannelSocket where getsockname() would be given a FD value -1 and thus report an error to the caller. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1470134726-15697-2-git-send-email-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 624cdd46d7f67fa2d23e87ffe0a36a569edde11a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc: ensure connection sharing/limits is always configuredDaniel P. Berrange1-0/+3
The connection sharing / limits are only set in the vnc_display_open() method and so missed when VNC is running with '-vnc none'. This in turn prevents clients being added to the VNC server with the QMP "add_client" command. This was introduced in commit e5f34cdd2da54f28d90889a3afd15fad2d6105ff Author: Gerd Hoffmann <kraxel@redhat.com> Date: Thu Oct 2 12:09:34 2014 +0200 vnc: track & limit connections Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1470134726-15697-4-git-send-email-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 12e29b1682e0a50ed57c324152addb585ae5ce69) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28vnc: fix crash when vnc_server_info_get has an errorDaniel P. Berrange1-1/+1
The vnc_server_info_get will allocate the VncServerInfo struct and then call vnc_init_basic_info_from_server_addr to populate the basic fields. If this returns an error though, the qapi_free_VncServerInfo call will then crash because the VncServerInfo struct instance was not properly NULL-initialized and thus contains random stack garbage. #0 0x00007f1987c8e6f5 in raise () at /lib64/libc.so.6 #1 0x00007f1987c902fa in abort () at /lib64/libc.so.6 #2 0x00007f1987ccf600 in __libc_message () at /lib64/libc.so.6 #3 0x00007f1987cd7d4a in _int_free () at /lib64/libc.so.6 #4 0x00007f1987cdb2ac in free () at /lib64/libc.so.6 #5 0x00007f198b654f6e in g_free () at /lib64/libglib-2.0.so.0 #6 0x0000559193cdcf54 in visit_type_str (v=v@entry= 0x5591972f14b0, name=name@entry=0x559193de1e29 "host", obj=obj@entry=0x5591961dbfa0, errp=errp@entry=0x7fffd7899d80) at qapi/qapi-visit-core.c:255 #7 0x0000559193cca8f3 in visit_type_VncBasicInfo_members (v=v@entry= 0x5591972f14b0, obj=obj@entry=0x5591961dbfa0, errp=errp@entry=0x7fffd7899dc0) at qapi-visit.c:12307 #8 0x0000559193ccb523 in visit_type_VncServerInfo_members (v=v@entry= 0x5591972f14b0, obj=0x5591961dbfa0, errp=errp@entry=0x7fffd7899e00) at qapi-visit.c:12632 #9 0x0000559193ccb60b in visit_type_VncServerInfo (v=v@entry= 0x5591972f14b0, name=name@entry=0x0, obj=obj@entry=0x7fffd7899e48, errp=errp@entry=0x0) at qapi-visit.c:12658 #10 0x0000559193cb53d8 in qapi_free_VncServerInfo (obj=<optimized out>) at qapi-types.c:3970 #11 0x0000559193c1e6ba in vnc_server_info_get (vd=0x7f1951498010) at ui/vnc.c:233 #12 0x0000559193c24275 in vnc_connect (vs=0x559197b2f200, vs=0x559197b2f200, event=QAPI_EVENT_VNC_CONNECTED) at ui/vnc.c:284 #13 0x0000559193c24275 in vnc_connect (vd=vd@entry=0x7f1951498010, sioc=sioc@entry=0x559196bf9c00, skipauth=skipauth@entry=tru e, websocket=websocket@entry=false) at ui/vnc.c:3039 #14 0x0000559193c25806 in vnc_display_add_client (id=<optimized out>, csock=<optimized out>, skipauth=<optimized out>) at ui/vnc.c:3877 #15 0x0000559193a90c28 in qmp_marshal_add_client (args=<optimized out>, ret=<optimized out>, errp=0x7fffd7899f90) at qmp-marshal.c:105 #16 0x000055919399c2b7 in handle_qmp_command (parser=<optimized out>, tokens=<optimized out>) at /home/berrange/src/virt/qemu/monitor.c:3971 #17 0x0000559193ce3307 in json_message_process_token (lexer=0x559194ab0838, input=0x559194a6d940, type=JSON_RCURLY, x=111, y=1 2) at qobject/json-streamer.c:105 #18 0x0000559193cfa90d in json_lexer_feed_char (lexer=lexer@entry=0x559194ab0838, ch=125 '}', flush=flush@entry=false) at qobject/json-lexer.c:319 #19 0x0000559193cfaa1e in json_lexer_feed (lexer=0x559194ab0838, buffer=<optimized out>, size=<optimized out>) at qobject/json-lexer.c:369 #20 0x0000559193ce33c9 in json_message_parser_feed (parser=<optimized out>, buffer=<optimized out>, size=<optimized out>) at qobject/json-streamer.c:124 #21 0x000055919399a85b in monitor_qmp_read (opaque=<optimized out>, buf=<optimized out>, size=<optimized out>) at /home/berrange/src/virt/qemu/monitor.c:3987 #22 0x0000559193a87d00 in tcp_chr_read (chan=<optimized out>, cond=<optimized out>, opaque=0x559194a7d900) at qemu-char.c:2895 #23 0x00007f198b64f703 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #24 0x0000559193c484b3 in main_loop_wait () at main-loop.c:213 #25 0x0000559193c484b3 in main_loop_wait (timeout=<optimized out>) at main-loop.c:258 #26 0x0000559193c484b3 in main_loop_wait (nonblocking=<optimized out>) at main-loop.c:506 #27 0x0000559193964c55 in main () at vl.c:1908 #28 0x0000559193964c55 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4603 This was introduced in commit 98481bfcd661daa3c160cc87a297b0e60a307788 Author: Eric Blake <eblake@redhat.com> Date: Mon Oct 26 16:34:45 2015 -0600 vnc: Hoist allocation of VncBasicInfo to callers which added error reporting for vnc_init_basic_info_from_server_addr but didn't change the g_malloc calls to g_malloc0. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1470134726-15697-3-git-send-email-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 3e7f136d8b4383d99f1b034a045b73f9b12a4eae) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-28ui: avoid crash if vnc client disconnects with writes pendingDaniel P. Berrange1-4/+9
The vnc_client_read() function is called from the vnc_client_io() event handler callback when there is incoming data to process. If it detects that the client has disconnected, then it will trigger cleanup and free'ing of the VncState client struct at a safe time. Unfortunately, the vnc_client_io() event handler will also call vnc_client_write() to handle any outgoing data writes. So if vnc_client_io() was invoked with both G_IO_IN and G_IO_OUT events set, and the client disconnects, we may try to write to a client which has just been freed. https://bugs.launchpad.net/qemu/+bug/1594861 Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1467042529-3372-1-git-send-email-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit ea697449884d83b83fefbc9cd87bdde0c94b49d6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20virtio-scsi: Don't abort when media is ejectedFam Zheng1-6/+9
With an ejected block backend, blk_get_aio_context() would return qemu_aio_context. In this case don't assert. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2a2d69f490c1b1dc6b6d2aef385ee7b654497a77) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi-disk: Cleaning up around tray open stateFam Zheng1-14/+8
Even if tray is not open, it can be empty (blk_is_inserted() == false). Handle both cases correctly by replacing the s->tray_open checks with blk_is_available(), which is an AND of the two. Also simplify successive checks of them into blk_is_available(), in a couple cases. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit cd723b85601baa7a0eeffbac83421357a70d81ee) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20iothread: Stop threads before main() quitsFam Zheng3-4/+23
Right after main_loop ends, we release various things but keep iothread alive. The latter is not prepared to the sudden change of resources. Specifically, after bdrv_close_all(), virtio-scsi dataplane get a surprise at the empty BlockBackend: (gdb) bt at /usr/src/debug/qemu-2.6.0/hw/scsi/virtio-scsi.c:543 at /usr/src/debug/qemu-2.6.0/hw/scsi/virtio-scsi.c:577 It is because the d->conf.blk->root is set to NULL, then blk_get_aio_context() returns qemu_aio_context, whereas s->ctx is still pointing to the iothread: hw/scsi/virtio-scsi.c:543: if (s->dataplane_started) { assert(blk_get_aio_context(d->conf.blk) == s->ctx); } To fix this, let's stop iothreads before doing bdrv_close_all(). Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1473326931-9699-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit dce8921b2baaf95974af8176406881872067adfa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20crypto: ensure XTS is only used with ciphers with 16 byte blocksDaniel P. Berrange3-13/+48
The XTS cipher mode needs to be used with a cipher which has a block size of 16 bytes. If a mis-matching block size is used, the code will either corrupt memory beyond the IV array, or not fully encrypt/decrypt the IV. This fixes a memory corruption crash when attempting to use cast5-128 with xts, since the former has an 8 byte block size. A test case is added to ensure the cipher creation fails with such an invalid combination. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> (cherry picked from commit a5d2f44d0d3e7523670e103a8c37faed29ff2b76) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACKPaolo Bonzini1-2/+2
These issues cause respectively a QEMU crash and a leak of 2 bytes of stack. They were discovered by VictorV of 360 Marvel Team. Reported-by: Tom Victor <i-tangtianwen@360.cm> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 65a8e1f6413a0f6f79894da710b5d6d43361d27d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi: mptconfig: fix an assert expressionPrasad J Pandit1-1/+1
When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit cf2bce203a45d7437029d108357fb23fea0967b6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20vmw_pvscsi: check page count while initialising descriptor ringsPrasad J Pandit1-10/+9
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by: Tom Victor <vv474172261@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7f61f4690dd153be98900a2a508b88989e692753) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi-disk: change disk serial length from 20 to 36Rony Weng1-2/+2
Openstack Cinder assigns volume a 36 characters uuid as serial. QEMU will shrinks the uuid to 20 characters, which does not match the original uuid. Note that there is no limit to the length of the serial number in the SCSI spec. 20 was copy-pasted from virtio-blk which in turn was copy-pasted from ATA; 36 is even more arbitrary. However, bumping it up too much might cause issues (e.g. 252 seems to make sense because then the maximum amount of returned data is 256; but who knows there's no off-by-one somewhere for such a nicely rounded number). Signed-off-by: Rony Weng <ronyweng@synology.com> Message-Id: <1472457138-23386-1-git-send-email-ronyweng@synology.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 48b6206305b8d56524ac2ee347b68e6e0a528559) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20qemu-char: avoid segfault if user lacks of permisson of a given logfileLin Ma1-0/+6
Function qemu_chr_alloc returns NULL if it failed to open logfile by any reason, says no write permission. For backends tty, stdio and msmouse, They need to check this return value to avoid segfault in this case. Signed-off-by: Lin Ma <lma@suse.com> Cc: qemu-stable <qemu-stable@nongnu.org> Message-Id: <20160914062250.22226-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 71200fb9664c2967a1cdd22b68b0da3a8b2b3eb7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi: pvscsi: limit process IO loop to ring sizePrasad J Pandit1-1/+4
Vmware Paravirtual SCSI emulator while processing IO requests could run into an infinite loop if 'pvscsi_ring_pop_req_descr' always returned positive value. Limit IO loop to the ring size. Cc: qemu-stable@nongnu.org Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d251157ac1928191af851d199a9ff255d330bec9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20scsi: mptsas: use g_new0 to allocate MPTSASRequest objectLi Qiang1-1/+1
When processing IO request in mptsas, it uses g_new to allocate a 'req' object. If an error occurs before 'req->sreq' is allocated, It could lead to an OOB write in mptsas_free_request function. Use g_new0 to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 670e56d3ed2918b3861d9216f2c0540d9e9ae0d5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-209pfs: fix potential segfault during walkGreg Kurz1-2/+3
If the call to fid_to_qid() returns an error, we will call v9fs_path_free() on uninitialized paths. It is a regression introduced by the following commit: 56f101ecce0e 9pfs: handle walk of ".." in the root directory Let's fix this by initializing dpath and path before calling fid_to_qid(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> [groug: updated the changelog to indicate this is regression and to provide the offending commit SHA1] Signed-off-by: Greg Kurz <groug@kaod.org> (cherry picked from commit 13fd08e631ec0c3ff5ad1bdcb6a4474c7d9a024f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-20vnc: fix qemu crash because of SIGSEGVGonglei1-0/+4
The backtrace is: 0x00007f0b75cdf880 in pixman_image_get_stride () from /lib64/libpixman-1.so.0 0x00007f0b77bcb3cf in vnc_server_fb_stride (vd=0x7f0b7a1a2bb0) at ui/vnc.c:680 vnc_dpy_copy (dcl=0x7f0b7a1a2c00, src_x=224, src_y=263, dst_x=319, dst_y=363, w=1, h=1) at ui/vnc.c:915 0x00007f0b77bbcc35 in dpy_gfx_copy (con=0x7f0b7a146210, src_x=src_x@entry=224, src_y=src_y@entry=263, dst_x=dst_x@entry=319, dst_y=dst_y@entry=363, w=1, h=1) at ui/console.c:1575 0x00007f0b77bbda4e in qemu_console_copy (con=<optimized out>, src_x=src_x@entry=224, src_y=src_y@entry=263, dst_x=dst_x@entry=319, dst_y=dst_y@entry=363, w=<optimized out>, h=<optimized out>) at ui/console.c:2111 0x00007f0b77ac0980 in cirrus_do_copy (h=<optimized out>, w=<optimized out>, src=<optimized out>, dst=<optimized out>, s=0x7f0b7b086090) at hw/display/cirrus_vga.c:774 cirrus_bitblt_videotovideo_copy (s=0x7f0b7b086090) at hw/display/cirrus_vga.c:793 cirrus_bitblt_videotovideo (s=0x7f0b7b086090) at hw/display/cirrus_vga.c:915 cirrus_bitblt_start (s=0x7f0b7b086090) at hw/display/cirrus_vga.c:1056 0x00007f0b77965cfb in memory_region_write_accessor (mr=0x7f0b7b096e40, addr=320, value=<optimized out>, size=1, shift=<optimized out>,mask=<optimized out>, attrs=...) at /root/rpmbuild/BUILD/master/qemu/memory.c:525 0x00007f0b77963f59 in access_with_adjusted_size (addr=addr@entry=320, value=value@entry=0x7f0b69a268d8, size=size@entry=4, access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=0x7f0b77965c80 <memory_region_write_accessor>, mr=mr@entry=0x7f0b7b096e40, attrs=attrs@entry=...) at /root/rpmbuild/BUILD/master/qemu/memory.c:591 0x00007f0b77968315 in memory_region_dispatch_write (mr=mr@entry=0x7f0b7b096e40, addr=addr@entry=320, data=18446744073709551362, size=size@entry=4, attrs=attrs@entry=...) at /root/rpmbuild/BUILD/master/qemu/memory.c:1262 0x00007f0b779256a9 in address_space_write_continue (mr=0x7f0b7b096e40, l=4, addr1=320, len=4, buf=0x7f0b77713028 "\002\377\377\377", attrs=..., addr=4273930560, as=0x7f0b7827d280 <address_space_memory>) at /root/rpmbuild/BUILD/master/qemu/exec.c:2544 address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>) at /root/rpmbuild/BUILD/master/qemu/exec.c:2601 0x00007f0b77925c1d in address_space_rw (as=<optimized out>, addr=<optimized out>, attrs=..., attrs@entry=..., buf=buf@entry=0x7f0b77713028 "\002\377\377\377", len=<optimized out>, is_write=<optimized out>) at /root/rpmbuild/BUILD/master/qemu/exec.c:2703 0x00007f0b77962f53 in kvm_cpu_exec (cpu=cpu@entry=0x7f0b79fcc2d0) at /root/rpmbuild/BUILD/master/qemu/kvm-all.c:1965 0x00007f0b77950cc6 in qemu_kvm_cpu_thread_fn (arg=0x7f0b79fcc2d0) at /root/rpmbuild/BUILD/master/qemu/cpus.c:1078 0x00007f0b744b3dc5 in start_thread (arg=0x7f0b69a27700) at pthread_create.c:308 0x00007f0b70d3d66d in clone () from /lib64/libc.so.6 The code path while meeting segfault: vnc_dpy_copy vnc_update_client vnc_disconnect_finish [while vnc_disconnect_start() is invoked because somethins wrong] vnc_update_server_surface vd->server = NULL; vnc_server_fb_stride pixman_image_get_stride(vd->server) Let's add a non-NULL check before calling vnc_server_fb_stride() to avoid segmentation fault. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Daniel P. Berrange <berrange@redhat.com> Reported-by: Yanying Zhuang <ann.zhuangyanying@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1472788698-120964-1-git-send-email-arei.gonglei@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 3e10c3ecfcaf604d8b400d6e463e1a186ce97d9b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-14virtio-balloon: discard virtqueue element on resetLadi Prosek1-0/+1
The one pending element is being freed but not discarded on device reset, which causes svq->inuse to creep up, eventually hitting the "Virtqueue size exceeded" error. Properly discarding the element on device reset makes sure that its buffers are unmapped and the inuse counter stays balanced. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Roman Kagan <rkagan@virtuozzo.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 104e70cae78bd4afd95d948c6aff188f10508a9c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-14virtio: zero vq->inuse in virtio_reset()Stefan Hajnoczi1-0/+1
vq->inuse must be zeroed upon device reset like most other virtqueue fields. In theory, virtio_reset() just needs assert(vq->inuse == 0) since devices must clean up in-flight requests during reset (requests cannot not be leaked!). In practice, it is difficult to achieve vq->inuse == 0 across reset because balloon, blk, 9p, etc implement various different strategies for cleaning up requests. Most devices call g_free(elem) directly without telling virtio.c that the VirtQueueElement is cleaned up. Therefore vq->inuse is not decremented during reset. This patch zeroes vq->inuse and trusts that devices are not leaking VirtQueueElements across reset. I will send a follow-up series that refactors request life-cycle across all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but this more invasive approach is not appropriate for stable trees. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Cc: qemu-stable <qemu-stable@nongnu.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Ladi Prosek <lprosek@redhat.com> (cherry picked from commit 4b7f91ed0270a371e1933efa21ba600b6da23ab9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-089pfs: handle walk of ".." in the root directoryGreg Kurz2-9/+32
The 9P spec at http://man.cat-v.org/plan_9/5/intro says: All directories must support walks to the directory .. (dot-dot) meaning parent directory, although by convention directories contain no explicit entry for .. or . (dot). The parent of the root directory of a server's tree is itself. This means that a client cannot walk further than the root directory exported by the server. In other words, if the client wants to walk "/.." or "/foo/../..", the server should answer like the request was to walk "/". This patch just does that: - we cache the QID of the root directory at attach time - during the walk we compare the QID of each path component with the root QID to detect if we're in a "/.." situation - if so, we skip the current component and go to the next one Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 56f101ecce0eafd09e2daf1c4eeb1377d6959261) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-089pfs: forbid . and .. in file namesGreg Kurz1-0/+51
According to the 9P spec http://man.cat-v.org/plan_9/5/open about the create request: The names . and .. are special; it is illegal to create files with these names. This patch causes the create and lcreate requests to fail with EINVAL if the file name is either "." or "..". Even if it isn't explicitly written in the spec, this patch extends the checking to all requests that may cause a directory entry to be created: - mknod - rename - renameat - mkdir - link - symlink The unlinkat request also gets patched for consistency (even if rmdir("foo/..") is expected to fail according to POSIX.1-2001). The various error values come from the linux manual pages. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 805b5d98c649d26fc44d2d7755a97f18e62b438a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-089pfs: forbid illegal path namesGreg Kurz1-0/+56
Empty path components don't make sense for most commands and may cause undefined behavior, depending on the backend. Also, the walk request described in the 9P spec [1] clearly shows that the client is supposed to send individual path components: the official linux client never sends portions of path containing the / character for example. Moreover, the 9P spec [2] also states that a system can decide to restrict the set of supported characters used in path components, with an explicit mention "to remove slashes from name components". This patch introduces a new name_is_illegal() helper that checks the names sent by the client are not empty and don't contain unwanted chars. Since 9pfs is only supported on linux hosts, only the / character is checked at the moment. When support for other hosts (AKA. win32) is added, other chars may need to be blacklisted as well. If a client sends an illegal path component, the request will fail and ENOENT is returned to the client. [1] http://man.cat-v.org/plan_9/5/walk [2] http://man.cat-v.org/plan_9/5/intro Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit fff39a7ad09da07ef490de05c92c91f22f8002f2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08net: vmxnet: use g_new for pkt initialisationLi Qiang1-3/+2
When vmxnet transport abstraction layer initialises pkt, the maximum fragmentation count is not checked. This could lead to an integer overflow causing a NULL pointer dereference. Replace g_malloc() with g_new() to catch the multiplication overflow. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08net: vmxnet: check IP header lengthLi Qiang1-0/+5
Vmxnet3 device emulator when parsing packet headers does not check for IP header length. It could lead to a OOB access when reading further packet data. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08iscsi: pass SCSI status back for SG_IOVadim Rozenfeld1-0/+1
Signed-off-by: Vadim Rozenfeld <vrozenfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 644c6869d335e10bc10b8399646f767763c4977f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08virtio: decrement vq->inuse in virtqueue_discard()Stefan Hajnoczi1-0/+1
virtqueue_discard() moves vq->last_avail_idx back so the element can be popped again. It's necessary to decrement vq->inuse to avoid "leaking" the element count. Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 58a83c61496eeb0d31571a07a51bc1947e3379ac) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08virtio: recalculate vq->inuse after migrationStefan Hajnoczi1-0/+15
The vq->inuse field is not migrated. Many devices don't hold VirtQueueElements across migration so it doesn't matter that vq->inuse starts at 0 on the destination QEMU. At least virtio-serial, virtio-blk, and virtio-balloon migrate while holding VirtQueueElements. For these devices we need to recalculate vq->inuse upon load so the value is correct. Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit bccdef6b1a204db0f41ffb6e24ce373e4d7890d4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08ui: fix refresh of VNC server surfaceDaniel P. Berrange1-9/+11
In previous commit commit c7628bff4138ce906a3620d12e0820c1cf6c140d Author: Gerd Hoffmann <kraxel@redhat.com> Date: Fri Oct 30 12:10:09 2015 +0100 vnc: only alloc server surface with clients connected the VNC server was changed so that the 'vd->server' pixman image was only allocated when a client is connected. Since then if a client disconnects and then reconnects to the VNC server all they will see is a black screen until they do something that triggers a refresh. On a graphical desktop this is not often noticed since there's many things going on which cause a refresh. On a plain text console it is really obvious since nothing refreshes frequently. The problem is that the VNC server didn't update the guest dirty bitmap, so still believes its server image is in sync with the guest contents. To fix this we must explicitly mark the entire guest desktop as dirty after re-creating the server surface. Move this logic into vnc_update_server_surface() so it is guaranteed to be call in all code paths that re-create the surface instead of only in vnc_dpy_switch() Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Peter Lieven <pl@kamp.de> Tested-by: Peter Lieven <pl@kamp.de> Message-id: 1471365032-18096-1-git-send-email-berrange@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit b69a553b4af9bc87a8b2e0a7b7a7de4cc7f0557e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-09-08net: check fragment length during fragmentationPrasad J Pandit1-1/+1
Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-17Update version for 2.6.1 releasev2.6.1Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-15timer: set vm_clock disabled defaultGonglei2-3/+3
(commit 80dcfb8532ae76343109a48f12ba8ca1c505c179) Upon migration, the code use a timer based on vm_clock for 1ns in the future from post_load to do the event send in case host_connected differs between migration source and target. However, it's not guaranteed that the apic is ready to inject irqs into the guest, and the irq line remained high, resulting in any future interrupts going unnoticed by the guest as well. That's because 1) the migration coroutine is not blocked when it get EAGAIN while reading QEMUFile. 2) The vm_clock is enabled default currently, it doesn't rely on the calling of vm_start(), that means vm_clock timers can run before VCPUs are running. So, let's set the vm_clock disabled default, keep the initial intention of design for vm_clock timers. Meanwhile, change the test-aio usecase, using QEMU_CLOCK_REALTIME instead of QEMU_CLOCK_VIRTUAL as the block code does. CC: Paolo Bonzini <pbonzini@redhat.com> CC: Dr. David Alan Gilbert <dgilbert@redhat.com> CC: qemu-stable@nongnu.org Signed-off-by: Gonglei <arei.gonglei@huawei.com> Message-Id: <1470728955-90600-1-git-send-email-arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3fdd0ee393e26178a4892e101e60b011bbfaa9ea) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-15Xen PCI passthrough: fix passthrough failure when no interrupt pinBruce Rogers1-1/+1
Commit 5a11d0f7 mistakenly converted a log message into an error condition when no pin interrupt is found for the pci device being passed through. Revert that part of the commit. Signed-off-by: Bruce Rogers <brogers@suse.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Anthony PERARD <anthony.perard@citrix.com> (cherry picked from commit 0968c91ce00f42487fb11de5da38e53b5dc6bc7f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-15ppc64: fix compressed dump with pseries kernelLaurent Vivier1-0/+5
If we don't provide the page size in target-ppc:cpu_get_dump_info(), the default one (TARGET_PAGE_SIZE, 4KB) is used to create the compressed dump. It works fine with Macintosh, but not with pseries as the kernel default page size is 64KB. Without this patch, if we generate a compressed dump in the QEMU monitor: (qemu) dump-guest-memory -z qemu.dump This dump cannot be read by crash: # crash vmlinux qemu.dump ... WARNING: cannot translate vmemmap kernel virtual addresses: commands requiring page structure contents will fail ... Page_size is used to determine the dumpfile's block size. The block size needs to be at least the page size, but a multiple of page size works fine too. For PPC64, linux supports either 4KB or 64KB software page size. So we define the page_size to 64KB. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit 760d88d1d0c409f1afe6f1c91539487413e8b2a9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: esp: check TI buffer index before read/writePrasad J Pandit1-11/+9
The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte FIFO buffers. One is used to handle commands and other is for information transfer. Three control variables 'ti_rptr', 'ti_wptr' and 'ti_size' are used to control r/w access to the information transfer buffer ti_buf[TI_BUFSZ=16]. In that, 'ti_rptr' is used as read index, where read occurs. 'ti_wptr' is a write index, where write would occur. 'ti_size' indicates total bytes to be read from the buffer. While reading/writing to this buffer, index could exceed its size. Add check to avoid OOB r/w access. Reported-by: Huawei PSIRT <psirt@huawei.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1465230883-22303-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit ff589551c8e8e9e95e211b9d8daafb4ed39f1aec) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: megasas: null terminate bios version bufferPrasad J Pandit1-0/+1
While reading information via 'megasas_ctrl_get_info' routine, a local bios version buffer isn't null terminated. Add the terminating null byte to avoid any OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 844864fbae66935951529408831c2f22367a57b6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: esp: make cmdbuf big enough for maximum CDB sizePrasad J Pandit2-3/+6
While doing DMA read into ESP command buffer 's->cmdbuf', it could write past the 's->cmdbuf' area, if it was transferring more than 16 bytes. Increase the command buffer size to 32, which is maximum when 's->do_cmd' is set, and add a check on 'len' to avoid OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 926cde5f3e4d2504ed161ed0cb771ac7cad6fd11) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: esp: clean up handle_ti/esp_do_dma if s->do_cmdPaolo Bonzini1-7/+4
Avoid duplicated code between esp_do_dma and handle_ti. esp_do_dma has the same code that handle_ti contains after the call to esp_do_dma; but the code in handle_ti is never reached because it is in an "else if". Remove the else and also the pointless return. esp_do_dma also has a partially dead assignment of the to_device variable. Sink it to the point where it's actually used. Finally, assert that the other caller of esp_do_dma (esp_transfer_data) only transfers data and not a command. This is true because get_cmd cancels the old request synchronously before its caller handle_satn_stop sets do_cmd to 1. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7f0b6e114ae4e142e2b3dfc9fac138f4a30edc4f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: esp: respect FIFO invariant after message phasePaolo Bonzini1-1/+1
The FIFO contains two bytes; hence the write ptr should be two bytes ahead of the read pointer. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d020aa504cec8f525b55ba2ef982c09dc847c72e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: esp: check buffer length before reading scsi commandPrasad J Pandit1-0/+3
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() in non-DMA mode, uses 'ti_size' to read scsi command into a buffer. Add check to validate command length against buffer size to avoid any overrun. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464717207-7549-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d3cdc49138c30be1d3c2f83d18f85d9fdee95f1a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: megasas: check 'read_queue_head' index valuePrasad J Pandit1-0/+2
While doing MegaRAID SAS controller command frame lookup, routine 'megasas_lookup_frame' uses 'read_queue_head' value as an index into 'frames[MEGASAS_MAX_FRAMES=2048]' array. Limit its value within array bounds to avoid any OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464179110-18593-1-git-send-email-ppandit@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit b60bdd1f1ee1616b7a9aeeffb4088e1ce2710fb2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: megasas: initialise local configuration data bufferPrasad J Pandit1-1/+1
When reading MegaRAID SAS controller configuration via MegaRAID Firmware Interface(MFI) commands, routine megasas_dcmd_cfg_read uses an uninitialised local data buffer. Initialise this buffer to avoid stack information leakage. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464178304-12831-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d37af740730dbbb93960cd318e040372d04d6dcf) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09scsi: megasas: use appropriate property buffer sizePrasad J Pandit1-1/+1
When setting MegaRAID SAS controller properties via MegaRAID Firmware Interface(MFI) commands, a user supplied size parameter is used to set property value. Use appropriate size value to avoid OOB access issues. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464172291-2856-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 1b85898025c4cd95dce673d15e67e60e98e91731) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09net: mipsnet: check packet length against bufferPrasad J Pandit1-0/+3
When receiving packets over MIPSnet network device, it uses receive buffer of size 1514 bytes. In case the controller accepts large(MTU) packets, it could lead to memory corruption. Add check to avoid it. Reported by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 3af9187fc6caaf415ab9c0c6d92c9678f65cb17f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09hw/arm/virt: Reject gic-version=host for non-KVMCole Robinson1-1/+5
If you try to gic-version=host with TCG on a KVM aarch64 host, qemu segfaults, since host requires KVM APIs. Explicitly reject gic-version=host if KVM is not enabled https://bugzilla.redhat.com/show_bug.cgi?id=1339977 Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-id: b1b3b0dd143b7995a7f4062966b80a2cf3e3c71e.1464273085.git.crobinso@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 0bf8039dca6bfecec243a13ebcd224d3941d9242) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.1 at 2024-11-16 23:29:03 +0000