aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-03-07test-qobject-input-visitor: Abort earlier on bad test inputMarkus Armbruster1-1/+1
visitor_input_test_init_internal() parses test input with qobject_from_jsonv(), and asserts it succeeds. Pass &error_abort for good measure. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-12-git-send-email-armbru@redhat.com>
2017-03-07qjson: Abort earlier on qobject_from_jsonf() misuseMarkus Armbruster1-1/+1
Ignoring errors first, then asserting success is suboptimal. Pass &error_abort instead, so we abort earlier, and hopefully get more useful clues on what's wrong. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-11-git-send-email-armbru@redhat.com>
2017-03-07libqtest: Fix qmp() & friends to abort on JSON parse errorsMarkus Armbruster1-1/+2
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-10-git-send-email-armbru@redhat.com>
2017-03-07qobject: Propagate parse errors through qobject_from_jsonv()Markus Armbruster4-7/+12
The next few commits will put the errors to use where appropriate. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-9-git-send-email-armbru@redhat.com>
2017-03-07qapi: Factor out common qobject_input_get_keyval()Markus Armbruster1-52/+35
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1488317230-26248-8-git-send-email-armbru@redhat.com>
2017-03-07qapi: Factor out common part of qobject input visitor creationMarkus Armbruster1-25/+16
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-7-git-send-email-armbru@redhat.com>
2017-03-07test-keyval: Cover use with qobject input visitorMarkus Armbruster1-0/+312
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-6-git-send-email-armbru@redhat.com>
2017-03-07qapi: qobject input visitor variant for use with keyval_parse()Daniel P. Berrange3-5/+358
Currently the QObjectInputVisitor assumes that all scalar values are directly represented as the final types declared by the thing being visited. i.e. it assumes an 'int' is using QInt, and a 'bool' is using QBool, etc. This is good when QObjectInputVisitor is fed a QObject that came from a JSON document on the QMP monitor, as it will strictly validate correctness. To allow QObjectInputVisitor to be reused for visiting a QObject originating from keyval_parse(), an alternative mode is needed where all the scalars types are represented as QString and converted on the fly to the final desired type. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1475246744-29302-8-git-send-email-berrange@redhat.com> Rebased, conflicts resolved, commit message updated to refer to keyval_parse(). autocast replaced by keyval in identifiers, noautocast replaced by fail in tests. Fix qobject_input_type_uint64_keyval() not to reject '-', for QemuOpts compatibility: replace parse_uint_full() by open-coded parse_option_number(). The next commit will add suitable tests. Leave out the fancy ERANGE error reporting for now, but add a TODO comment. Add it qobject_input_type_int64_keyval() and qobject_input_type_number_keyval(), too. Open code parse_option_bool() and parse_option_size() so we have to call qobject_input_get_name() only when actually needed. Again, leave out ERANGE error reporting for now. QAPI/QMP downstream extension prefixes __RFQDN_ don't work, because keyval_parse() splits them at '.'. This will be addressed later in the series. qobject_input_type_int64_keyval(), qobject_input_type_uint64_keyval(), qobject_input_type_number_keyval() tweaked for style. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-5-git-send-email-armbru@redhat.com>
2017-03-07keyval: New keyval_parse()Markus Armbruster6-0/+419
keyval_parse() parses KEY=VALUE,... into a QDict. Works like qemu_opts_parse(), except: * Returns a QDict instead of a QemuOpts (d'oh). * Supports nesting, unlike QemuOpts: a KEY is split into key fragments at '.' (dotted key convention; the block layer does something similar on top of QemuOpts). The key fragments are QDict keys, and the last one's value is updated to VALUE. * Each key fragment may be up to 127 bytes long. qemu_opts_parse() limits the entire key to 127 bytes. * Overlong key fragments are rejected. qemu_opts_parse() silently truncates them. * Empty key fragments are rejected. qemu_opts_parse() happily accepts empty keys. * It does not store the returned value. qemu_opts_parse() stores it in the QemuOptsList. * It does not treat parameter "id" specially. qemu_opts_parse() ignores all but the first "id", and fails when its value isn't id_wellformed(), or duplicate (a QemuOpts with the same ID is already stored). It also screws up when a value contains ",id=". * Implied value is not supported. qemu_opts_parse() desugars "foo" to "foo=on", and "nofoo" to "foo=off". * An implied key's value can't be empty, and can't contain ','. I intend to grow this into a saner replacement for QemuOpts. It'll take time, though. Note: keyval_parse() provides no way to do lists, and its key syntax is incompatible with the __RFQDN_ prefix convention for downstream extensions, because it blindly splits at '.', even in __RFQDN_. Both issues will be addressed later in the series. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1488317230-26248-4-git-send-email-armbru@redhat.com>
2017-03-07tests: Fix gcov-files-test-qemu-opts-y, gcov-files-test-logging-yMarkus Armbruster1-2/+2
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-3-git-send-email-armbru@redhat.com>
2017-03-07test-qemu-opts: Cover qemu_opts_parse() of "no"Markus Armbruster1-0/+5
qemu_opts_parse() interprets "no" as negated empty key. Consistent with its acceptance of empty keys elsewhere, whatever that's worth. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-2-git-send-email-armbru@redhat.com>
2017-03-07disas/arm: Avoid unintended sign extensionPeter Maydell1-2/+2
When assembling 'given' from the instruction bytes, C's integer promotion rules mean we may promote an unsigned char to a signed integer before shifting it, and then sign extend to a 64-bit long, which can set the high bits of the long. The code doesn't in fact care about the high bits if the long is 64 bits, but this is surprising, so don't do it. (Spotted by Coverity, CID 1005404.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1488556233-31246-7-git-send-email-peter.maydell@linaro.org
2017-03-07disas/cris: Avoid unintended sign extensionPeter Maydell1-2/+2
In the cris disassembler we were using 'unsigned long' to calculate addresses which are supposed to be 32 bits. This meant that we might accidentally sign extend or calculate a value that was outside the 32 bit range of the guest CPU. Use 'uint32_t' instead so we give the right answers on 64-bit hosts. (Spotted by Coverity, CID 1005402, 1005403.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1488556233-31246-6-git-send-email-peter.maydell@linaro.org
2017-03-07disas/microblaze: Avoid unintended sign extensionPeter Maydell1-2/+4
In read_insn_microblaze() we assemble 4 bytes into an 'unsigned long'. If 'unsigned long' is 64 bits and the high byte has its top bit set, then C's implicit conversion from 'unsigned char' to 'int' for the shift will result in an unintended sign extension which sets the top 32 bits in 'inst'. Add casts to prevent this. (Spotted by Coverity, CID 1005401.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1488556233-31246-5-git-send-email-peter.maydell@linaro.org
2017-03-07disas/m68k: Avoid unintended sign extension in get_field()Peter Maydell1-2/+3
In get_field(), we take an 'unsigned char' value and shift it left, which implicitly promotes it to 'signed int', before ORing it into an 'unsigned long' type. If 'unsigned long' is 64 bits then this will result in a sign extension and the top 32 bits of the result will be 1s. Add explicit casts to unsigned long before shifting to prevent this. (Spotted by Coverity, CID 715697.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 1488556233-31246-4-git-send-email-peter.maydell@linaro.org
2017-03-07disas/i386: Avoid NULL pointer dereference in error casePeter Maydell1-1/+1
In a code path where we hit an internal disassembler error, execution would subsequently attempt to dereference a NULL pointer. This should never happen, but avoid the crash. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1488556233-31246-3-git-send-email-peter.maydell@linaro.org
2017-03-07disas/hppa: Remove dead codePeter Maydell1-2/+1
Coverity complains (CID 1302705) that the "fr0" part of the ?: in fput_fp_reg_r() is dead. This looks like cut-n-paste error from fput_fp_reg(); delete the dead code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1488556233-31246-2-git-send-email-peter.maydell@linaro.org
2017-03-07commit: Don't use error_abort in commit_startFam Zheng1-2/+14
bdrv_set_backing_hd failure needn't be abort. Since we already have error parameter, use it. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07block: Don't use error_abort in blk_new_openFam Zheng1-1/+6
We have an errp and bdrv_root_attach_child can fail permission check, error_abort is not the best choice here. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Support blockdev-addMarkus Armbruster1-3/+24
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07qapi-schema: Rename SocketAddressFlat's variant tcp to inetMarkus Armbruster2-32/+35
QAPI type SocketAddressFlat differs from SocketAddress pointlessly: the discriminator value for variant InetSocketAddress is 'tcp' instead of 'inet'. Rename. The type is so far only used by the Gluster block drivers. Take care to keep 'tcp' working in things like -drive's file.server.0.type=tcp. The "gluster+tcp" URI scheme in pseudo-filenames stays the same. blockdev-add changes, but it has changed incompatibly since 2.8 already. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07qapi-schema: Rename GlusterServer to SocketAddressFlatMarkus Armbruster3-64/+58
As its documentation says, it's not specific to Gluster. Rename it, as I'm going to use it for something else. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07gluster: Plug memory leaks in qemu_gluster_parse_json()Markus Armbruster1-11/+11
To reproduce, run $ valgrind qemu-system-x86_64 --nodefaults -S --drive driver=gluster,volume=testvol,path=/a/b/c,server.0.type=xxx Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Niels de Vos <ndevos@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07gluster: Don't duplicate qapi-util.c's qapi_enum_parse()Markus Armbruster1-21/+9
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Niels de Vos <ndevos@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07gluster: Drop assumptions on SocketTransport namesMarkus Armbruster1-4/+2
qemu_gluster_glfs_init() passes the names of QAPI enumeration type SocketTransport to glfs_set_volfile_server(). Works, because they were chosen to match. But the coupling is artificial. Use the appropriate literal strings instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Niels de Vos <ndevos@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Implement bdrv_parse_filename()Markus Armbruster1-56/+174
This permits configuration with driver-specific options in addition to pseudo-filename parsed as URI. For instance, --drive driver=sheepdog,host=fido,vdi=dolly instead of --drive driver=sheepdog,file=sheepdog://fido/dolly It's also a first step towards supporting blockdev-add. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Use SocketAddress and socket_connect()Markus Armbruster1-23/+30
sd_parse_uri() builds a string from host and port parts for inet_connect(). inet_connect() parses it into host, port and options. Whether this gets exactly the same host, port and no options for all inputs is not obvious. Cut out the string middleman and build a SocketAddress for socket_connect() instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Report errors in pseudo-filename more usefullyMarkus Armbruster1-29/+59
Errors in the pseudo-filename are all reported with the same laconic "Can't parse filename" message. Add real error reporting, such as: $ qemu-system-x86_64 --drive driver=sheepdog,filename=sheepdog:/// qemu-system-x86_64: --drive driver=sheepdog,filename=sheepdog:///: missing file path in URI $ qemu-system-x86_64 --drive driver=sheepdog,filename=sheepgod:///vdi qemu-system-x86_64: --drive driver=sheepdog,filename=sheepgod:///vdi: URI scheme must be 'sheepdog', 'sheepdog+tcp', or 'sheepdog+unix' $ qemu-system-x86_64 --drive driver=sheepdog,filename=sheepdog+unix:///vdi?socke=sheepdog.sock qemu-system-x86_64: --drive driver=sheepdog,filename=sheepdog+unix:///vdi?socke=sheepdog.sock: unexpected query parameters The code to translate legacy syntax to URI fails to escape URI meta-characters. The new error messages are misleading then. Replace them by the old "Can't parse filename" message. "Internal error" would be more honest. Anyway, no worse than before. Also add a FIXME comment. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Don't truncate long VDI name in _open(), _create()Markus Armbruster1-1/+4
sd_parse_uri() truncates long VDI names silently. Reject them instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Fix snapshot ID parsing in _open(), _create, _goto()Markus Armbruster1-11/+55
sd_parse_uri() and sd_snapshot_goto() screw up error checking after strtoul(), and truncate long tag names silently. Fix by replacing those parts by new sd_parse_snapid_or_tag(), which checks more carefully. sd_snapshot_delete() also parses snapshot IDs, but is currently too broken for me to touch. Mark TODO. Two calls of strtol() without error checking remain in parse_redundancy(). Mark them FIXME. More silent truncation of configuration strings remains elsewhere. Not marked. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Mark sd_snapshot_delete() lossage FIXMEMarkus Armbruster1-0/+10
sd_snapshot_delete() should delete the snapshot whose ID matches @snapshot_id and whose name matches @name. But that's not what it does. If @snapshot_id is a valid ID, it deletes the snapshot with that ID, else it deletes the snapshot with that name. It doesn't use @name at all. Add suitable FIXME comments, so someone who actually knows Sheepdog can fix it. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Fix error handling sd_create()Markus Armbruster1-4/+2
As a bdrv_create() method, sd_create() must set an error and return negative errno on failure. It prints the error instead of setting it when connect_to_sdog() fails. Fix that. While there, return the value of connect_to_sdog() like we do elsewhere, instead of -EIO. No functional change, as connect_to_sdog() returns no other error code. Many more suspicious uses of error_report() and error_report_err() remain in other functions. Left for another day. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Fix error handling in sd_snapshot_delete()Markus Armbruster1-22/+19
As a bdrv_snapshot_delete() method, sd_snapshot_delete() must set an error and return negative errno on failure. It sometimes returns -1, and sometimes neglects to set an error. It also prints error messages with error_report(). Fix all that. Moreover, its handling of an attempt to delete a nonexistent snapshot is wrong: it error_report()s and succeeds. Fix it to set an error and return -ENOENT instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07sheepdog: Defuse time bomb in sd_open() error handlingMarkus Armbruster1-10/+10
When qemu_opts_absorb_qdict() fails, sd_open() closes stdin, because sd->fd is still zero. Fortunately, qemu_opts_absorb_qdict() can't fail, because: 1. it only fails when qemu_opt_parse() fails, and 2. the only member of runtime_opts.desc[] is a QEMU_OPT_STRING, and 3. qemu_opt_parse() can't fail for QEMU_OPT_STRING. Defuse this ticking time bomb by jumping behind the file descriptor cleanup on error. Also do that for the error paths where sd->fd is still -1. The file descriptor cleanup happens to do nothing then, but let's not rely on that here. While there, rename label out to err, because it's on the error path, not the normal path out of the function. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-03-07block: Fix error handling in bdrv_replace_in_backing_chain()Kevin Wolf5-30/+20
When adding an Error parameter, bdrv_replace_in_backing_chain() would become nothing more than a wrapper around change_parent_backing_link(). So make the latter public, renamed as bdrv_replace_node(), and remove bdrv_replace_in_backing_chain(). Most of the callers just remove a node from the graph that they just inserted, so they can use &error_abort, but completion of a mirror job with 'replaces' set can actually fail. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07block: Handle permission errors in change_parent_backing_link()Kevin Wolf1-6/+44
Instead of just trying to change parents by parent over to reference @to instead of @from, and abort()ing whenever the permissions don't allow this, do proper permission checking beforehand and pass any error to the callers. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07block: Ignore multiple children in bdrv_check_update_perm()Kevin Wolf2-14/+23
change_parent_backing_link() will need to update multiple BdrvChild objects at once. Checking permissions reference by reference doesn't work because permissions need to be consistent only with all parents moved to the new child. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07block: Factor out bdrv_replace_child_noperm()Kevin Wolf1-13/+25
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07block: Factor out should_update_child()Kevin Wolf1-15/+27
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-07block: Fix blockdev-snapshot error handlingKevin Wolf1-1/+3
For blockdev-snapshot, external_snapshot_prepare() accepts an arbitrary node reference at first and only checks later whether it already has a backing file. Between those places, other errors can occur. Therefore checking in external_snapshot_abort() whether state->new_bs has a backing file is not sufficient to tell whether bdrv_append() was already completed or not. Trying to undo the bdrv_append() when it wasn't even executed is wrong. Introduce a new boolean flag in the state to fix this. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07mirror: Fix error path for dirty bitmap creationKevin Wolf1-4/+1
mirror_top_bs must be removed from the graph again when creating the dirty bitmap fails. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07mirror: Fix permissions for removing mirror_top_bsKevin Wolf1-1/+4
mirror_top_bs takes write permissions on its backing file, which can make it impossible to attach that backing file node to another parent. However, this is exactly what needs to be done in order to remove mirror_top_bs from the backing chain. So give up the write permission first. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07mirror: Fix permission problem with 'replaces'Kevin Wolf1-2/+8
The 'replaces' option of drive-mirror can be used to mirror a Quorum node to a new image and then let the target image replace one of the Quorum children. In order for this graph modification to succeed, the mirror job needs to lift its restrictions on the target node first before actually replacing the child. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-07commit: Fix error handlingKevin Wolf1-1/+1
Apparently some kind of mismerge happened in commit 8dfba279, which broke the error handling without any real reason by removing the assignment of the return value to ret in a blk_insert_bs() call. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-07tests/docker: support proxy / corporate firewallPhilippe Mathieu-Daudé1-0/+6
if ftp_proxy/http_proxy/https_proxy standard environment variables available, pass them to the docker daemon to build images. this is required when building behind corporate proxy/firewall, but also help when using local cache server (ie: apt/yum). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20170306205520.32311-1-f4bug@amsat.org> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2017-03-07Merge remote-tracking branch 'remotes/xtensa/tags/20170306-xtensa' into stagingPeter Maydell4-9/+209
target/xtensa updates: - instantiate local memories in xtensa sim machine; - add two missing include files to xtensa core importing script. # gpg: Signature made Mon 06 Mar 2017 22:32:45 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170306-xtensa: target/xtensa: add two missing headers to core import script target/xtensa: sim: instantiate local memories Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-07Merge remote-tracking branch 'remotes/gkurz/tags/fixes-for-2.9' into stagingPeter Maydell2-4/+14
Fixes issues that got merged with the latest pull request: - missing O_NOFOLLOW flag for CVE-2016-960 - build break with older glibc that don't have O_PATH and AT_EMPTY_PATH - various bugs reported by Coverity # gpg: Signature made Mon 06 Mar 2017 17:51:29 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/fixes-for-2.9: 9pfs: fix vulnerability in openat_dir() and local_unlinkat_common() 9pfs: fix O_PATH build break with older glibc versions 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough() 9pfs: fail local_statfs() earlier 9pfs: fix fd leak in local_opendir() 9pfs: fix bogus fd check in local_remove() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-07Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2017-03-06-tag' ↵Peter Maydell6-39/+117
into staging qemu-ga patch queue for 2.9 * fix fsfreeze for filesystems mounted in multiple locations * fix test failure when running in a chroot * support for socket-based activation # gpg: Signature made Mon 06 Mar 2017 07:54:17 GMT # gpg: using RSA key 0x3353C9CEF108B584 # gpg: Good signature from "Michael Roth <flukshun@gmail.com>" # gpg: aka "Michael Roth <mdroth@utexas.edu>" # gpg: aka "Michael Roth <mdroth@linux.vnet.ibm.com>" # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D 3FA0 3353 C9CE F108 B584 * remotes/mdroth/tags/qga-pull-2017-03-06-tag: tests: check path to avoid a failing qga/get-vcpus test qga: ignore EBUSY when freezing a filesystem qga: add systemd socket activation support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-069pfs: fix vulnerability in openat_dir() and local_unlinkat_common()Greg Kurz2-2/+3
We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make QEMU vulnerable. While here, we also fix local_unlinkat_common() to use openat_dir() for the same reasons (it was a leftover in the original patchset actually). This fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-069pfs: fix O_PATH build break with older glibc versionsGreg Kurz1-1/+6
When O_PATH is used with O_DIRECTORY, it only acts as an optimization: the openat() syscall simply finds the name in the VFS, and doesn't trigger the underlying filesystem. On systems that don't define O_PATH, because they have glibc version 2.13 or older for example, we can safely omit it. We don't want to deactivate O_PATH globally though, in case it is used without O_DIRECTORY. The is done with a dedicated macro. Systems without O_PATH may thus fail to resolve names that involve unreadable directories, compared to newer systems succeeding, but such corner case failure is our only option on those older systems to avoid the security hole of chasing symlinks inappropriately. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> (added last paragraph to changelog as suggested by Eric Blake) Signed-off-by: Greg Kurz <groug@kaod.org>
generated by cgit v1.1 at 2025-01-10 09:30:51 +0000