summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-07-21Update VERSION for 1.7.2 releasev1.7.2Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15Allow mismatched virtio config-lenDr. David Alan Gilbert1-5/+11
Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 2f5732e9648fcddc8759a8fd25c0b41a38352be6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15pci: assign devfn to pci_dev before calling pci_device_iommu_address_space()Le Tan1-1/+1
In function do_pci_register_device() in file hw/pci/pci.c, move the assignment of pci_dev->devfn to the position before the call to pci_device_iommu_address_space(pci_dev) which will use the value of pci_dev->devfn. Fixes: 9eda7d373e9c691c070eddcbe3467b991f67f6bd pci: Introduce helper to retrieve a PCI device's DMA address space Cc: qemu-stable@nongnu.org Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit efc8188e9398e54567b238b756eec2cc746cd2a4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15hw: Fix qemu_allocate_irqs() leaksAndreas Färber14-29/+28
Replace qemu_allocate_irqs(foo, bar, 1)[0] with qemu_allocate_irq(foo, bar, 0). This avoids leaking the dereferenced qemu_irq *. Cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de> [PC Changes: * Applied change to instance in sh4/sh7750.c ] Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Kirill Batuzov <batuzovk@ispras.ru> [AF: Fix IRQ index in sh4/sh7750.c] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit f3c7d0389fe8a2792fd4c1cf151b885de03c8f62) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15sdhci: Fix misuse of qemu_free_irqs()Andreas Färber1-2/+2
It does a g_free() on the pointer, so don't pass a local &foo reference. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 127a4e1a51c038ec9167083b65d376dddcc64530) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15vnc: Fix tight_detect_smooth_image() for lossless caseMarkus Armbruster1-1/+1
VncTight member uint8_t quality is either (uint8_t)-1 for lossless or less than 10 for lossy. tight_detect_smooth_image() first promotes it to int, then compares with -1. Always unequal, so we always execute the lossy code. Reads beyond tight_conf[] and returns crap when quality is actually lossless. Compare to (uint8_t)-1 instead, like we do elsewhere. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 2e7bcdb99adbd8fc10ad9ddcf93bd2bf3c0f1f2d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15qapi: zero-initialize all QMP command parametersMichael Roth1-1/+1
In general QMP command parameter values are specified by consumers of the QMP/HMP interface, but in the case of optional parameters these values may be left uninitialized. It is considered a bug for code to make use of optional parameters that have not been flagged as being present by the marshalling code (via corresponding has_<parameter> parameter), however our marshalling code will still pass these uninitialized values on to the corresponding QMP function (to then be ignored). Some compilers (clang in particular) consider this unsafe however, and generate warnings as a result. As reported by Peter Maydell: This is something clang's -fsanitize=undefined spotted. The code generated by qapi-commands.py in qmp-marshal.c for qmp_marshal_* functions where there are some optional arguments looks like this: bool has_force = false; bool force; mi = qmp_input_visitor_new_strict(QOBJECT(args)); v = qmp_input_get_visitor(mi); visit_type_str(v, &device, "device", errp); visit_start_optional(v, &has_force, "force", errp); if (has_force) { visit_type_bool(v, &force, "force", errp); } visit_end_optional(v, errp); qmp_input_visitor_cleanup(mi); if (error_is_set(errp)) { goto out; } qmp_eject(device, has_force, force, errp); In the case where has_force is false, we never initialize force, but then we use it by passing it to qmp_eject. I imagine we don't then actually use the value, but clang complains in particular for 'bool' variables because the value that ends up being loaded from memory for 'force' is not either 0 or 1 (being uninitialized stack contents). Fix this by initializing all QMP command parameters to {0} in the marshalling code prior to passing them on to the QMP functions. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit fc13d937269c1cd01a4b7720c1dcce01722727a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15nbd: Shutdown socket before closing.Hani Benhabiles2-0/+2
This forces finishing data sending to client before closing the socket like in exports listing or replying with NBD_REP_ERR_UNSUP cases. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 27e5eae4577316f7e86a56eb7363d4e78f79e3e5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15nbd: Close socket on negotiation failure.Hani Benhabiles2-3/+5
Otherwise, the nbd client may hang waiting for the server response. Signed-off-by: Hani Benhabiles <hani@linux.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 36af599417dde11747a27dc8550ff2281657a8ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15nbd: Don't validate from and len in NBD_CMD_DISC.Hani Benhabiles1-3/+4
These values aren't used in this case. Currently, the from field in the request sent by the nbd kernel module leading to a false error message when ending the connection with the client. $ qemu-nbd some.img -v // After nbd-client -d /dev/nbd0 nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520, Offset: 0 nbd.c:nbd_trip():L1032: requested operation past EOF--bad client? nbd.c:nbd_receive_request():L638: read failed Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8c5d1abbb79193dca8e4823ef53d8d1e650362ae) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15nbd: Don't export a block device with no medium.Hani Benhabiles1-0/+4
The device is exported with erroneous values and can't be read. Before the patch: $ sudo nbd-client localhost -p 10809 /dev/nbd0 -name floppy0 Negotiation: ..size = 17592186044415MB bs=1024, sz=18446744073709547520 bytes $ sudo mount /dev/nbd0 /mnt/tmp/ mount: block device /dev/nbd0 is write-protected, mounting read-only mount: /dev/nbd0: can't read superblock After the patch: (qemu) nbd_server_add ide0-hd0 (qemu) nbd_server_add floppy0 Device 'floppy0' has no medium Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 60fe4fac22895576973e317d7148b084c31cc64c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15virtio-serial: don't migrate the config spaceAlexander Graf1-10/+6
The device configuration is set at realize time and never changes. It should not be migrated as it is done today. For the sake of compatibility, let's just skip them at load time. Signed-off-by: Alexander Graf <agraf@suse.de> [ added missing casts to uint16_t *, added From, SoB and commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit e38e943a1fa20d04deb1899be19b12aadec7a585) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15virtio-net: byteswap virtio-net headerCédric Le Goater1-0/+17
TCP connectivity fails when the guest has a different endianness. The packets are silently dropped on the host by the tap backend when they are read from user space because the endianness of the virtio-net header is in the wrong order. These lines may appear in the guest console: [ 454.709327] skbuff: bad partial csum: csum=8704/4096 len=74 [ 455.702554] skbuff: bad partial csum: csum=8704/4096 len=74 The issue that got first spotted with a ppc64le PowerKVM guest, but it also exists for the less common case of a x86_64 guest run by a big-endian ppc64 TCG hypervisor. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> [ Ported from PowerKVM, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15target-i386: Filter FEAT_7_0_EBX TCG features tooEduardo Habkost1-1/+2
The TCG_7_0_EBX_FEATURES macro was defined but never used (it even had a typo that was never noticed). Make the existing TCG feature filtering code use it. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit d0a70f46fa9a3257089a56f2f620b0eff868557f) Conflicts: target-i386/cpu.c *fixed simple context mismatch Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15coroutine-win32.c: Add noinline attribute to work around gcc bugPeter Maydell1-2/+11
A gcc codegen bug in x86_64-w64-mingw32-gcc (GCC) 4.6.3 means that non-debug builds of QEMU for Windows tend to assert when using coroutines. Work around this by marking qemu_coroutine_switch as noinline. If we allow gcc to inline qemu_coroutine_switch into coroutine_trampoline, then it hoists the code to get the address of the TLS variable "current" out of the while() loop. This is an invalid transformation because the SwitchToFiber() call may be called when running thread A but return in thread B, and so we might be in a different thread context each time round the loop. This can happen quite often. Typically. a coroutine is started when a VCPU thread does bdrv_aio_readv: VCPU thread main VCPU thread coroutine I/O coroutine bdrv_aio_readv -----> start I/O operation thread_pool_submit_co <------------ yields back to emulation Then I/O finishes and the thread-pool.c event notifier triggers in the I/O thread. event_notifier_ready calls thread_pool_co_cb, and the I/O coroutine now restarts *in another thread*: iothread main iothread coroutine I/O coroutine (formerly in VCPU thread) event_notifier_ready thread_pool_co_cb -----> current = I/O coroutine; call AIO callback But on Win32, because of the bug, the "current" being set here the current coroutine of the VCPU thread, not the iothread. noinline is a good-enough workaround, and quite unlikely to break in the future. (Thanks to Paolo Bonzini for assistance in diagnosing the problem and providing the detailed example/ascii art quoted above.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1403535303-14939-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit ff4873cb8c81db89668d8b56e19e57b852edb5f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15KVM: Fix GSI number space limitAlexander Graf1-1/+1
KVM tells us the number of GSIs it can handle inside the kernel. That value is basically KVM_MAX_IRQ_ROUTES. However when we try to set the GSI mapping table, it checks for r = -EINVAL; if (routing.nr >= KVM_MAX_IRQ_ROUTES) goto out; erroring out even when we're only using all of the GSIs. To make sure we never hit that limit, let's reduce the number of GSIs we get from KVM by one. Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 00008418aa22700f6c49e794e79f53aeb157d10f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15usb: Fix usb-bt-dongle initialization.Hani Benhabiles1-8/+16
Due to an incomplete initialization, adding a usb-bt-dongle device through HMP or QMP will cause a segmentation fault. Signed-off-by: Hani Benhabiles <hani@linux.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c340a284f382a5f40774521f41b4bade76ddfa58) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15vhost: fix resource leak in error handlingMichael S. Tsirkin1-4/+6
vhost_verify_ring_mappings leaks mappings on error. Fix this up. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 8617343faae6ba7e916137c6c9e3ef22c00565d8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15scsi-disk: fix bug in scsi_block_new_request() introduced by commit 137745cUlrich Obergfell1-1/+1
This patch fixes a bug in scsi_block_new_request() that was introduced by commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8. If the host cache is used - i.e. if BDRV_O_NOCACHE is _not_ set - the 'break' statement needs to be executed to 'fall back' to SG_IO. Cc: qemu-stable@nongnu.org Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2fe5a9f73b3446690db2cae8a58473b0b4beaa32) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15rdma: bug fixesMichael R. Hines1-10/+10
1. Fix small memory leak in parsing inet address from command line in data_init() 2. Fix ibv_post_send() return value check and pass error code back up correctly. 3. Fix rdma_destroy_qp() segfault after failure to connect to destination. Reported-by: frank.yangjie@gmail.com Reported-by: dgilbert@redhat.com Signed-off-by: Michael R. Hines <mrhines@us.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit e325b49a320b493cc5d69e263751ff716dc458fe) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-15qga: Fix handle fd leak in acquire_privilege()Gonglei1-2/+4
token should be closed in all conditions. So move CloseHandle(token) to "out" branch. Signed-off-by: Wang Rui <moon.wangrui@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 374044f08fe18a18469b981812cd8695f5b3569c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03aio: fix qemu_bh_schedule() bh->ctx race conditionStefan Hajnoczi1-4/+10
qemu_bh_schedule() is supposed to be thread-safe at least the first time it is called. Unfortunately this is not quite true: bh->scheduled = 1; aio_notify(bh->ctx); Since another thread may run the BH callback once it has been scheduled, there is a race condition if the callback frees the BH before aio_notify(bh->ctx) has a chance to run. Reported-by: Stefan Priebe <s.priebe@profihost.ag> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Stefan Priebe <s.priebe@profihost.ag> (cherry picked from commit 924fe1293c3e7a3c787bbdfb351e7f168caee3e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03s390x/css: handle emw correctly for tschCornelia Huck1-4/+20
We should not try to store the emw portion of the irb if extended measurements are not applicable. In particular, we should not surprise the guest by storing a larger irb if it did not enable extended measurements. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit f068d320def7fd83bf0fcdca37b305f1c2ac5413) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03target-arm: Fix errors in writes to generic timer control registersPeter Maydell1-3/+3
The code for handling writes to the generic timer control registers had several bugs: * ISTATUS (bit 2) is read-only but we forced it to zero on any write * the check for "was IMASK (bit 1) toggled?" incorrectly used '&' where it should be '^' * the handling of IMASK was inverted: we should set the IRQ if ISTATUS is set and IMASK is clear, not if both are set The combination of these bugs meant that when running a Linux guest that uses the generic timers we would fairly quickly end up either forgetting that the timer output should be asserted, or failing to set the IRQ when the timer was unmasked. The result is that the guest never gets any more timer interrupts. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1401803208-1281-1-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org (cherry picked from commit d3afacc7269fee45d54d1501a46b51f12ea7bb15) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03tcg-i386: Fix win64 qemu storeRichard Henderson1-1/+2
The first non-register argument isn't placed at offset 0. Cc: qemu-stable@nongnu.org Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit 0b919667302aa395bfde0328749dc21a0b123c44) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03linux-user: Don't overrun guest buffer in sched_getaffinityPeter Maydell1-0/+16
If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit be3bd286bc06bb68cdc71748d9dd4edcd57b2b24) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qemu-img: Plug memory leak in convert commandMarkus Armbruster1-1/+1
Introduced in commit 661a0f7. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit bb9cd2ee99f6537c072d5f4bac441717d3cd2bed) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/sheepdog: Plug memory leak in sd_snapshot_create()Markus Armbruster1-2/+2
Has always been leaky. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 2df5fee2dbd56a9c34afd6d7df6744da2d951ccb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/vvfat: Plug memory leak in read_directory()Markus Armbruster1-1/+3
Has always been leaky. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit b122c3b6d020e529b203836efb8f611ece787293) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/vvfat: Plug memory leak in check_directory_consistency()Markus Armbruster1-1/+1
On error path. Introduced in commit a046433a. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 6262bbd363b53a1f19c473345d7cc40254dd5c73) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERRORMarkus Armbruster1-0/+1
Introduced in commit a8d8ecb. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit f25391c2a6ef1674384204265429520ea50e82bc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03blockdev: Plug memory leak in drive_init()Markus Armbruster1-0/+2
bs_opts is leaked on all paths from its qdev_new() that don't got through blockdev_init(). Add the missing QDECREF(), and zap bs_opts after blockdev_init(), so the new QDECREF() does nothing when we go through blockdev_init(). Leak introduced in commit f298d07. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 3cb0e25c4b417b7336816bd92de458f0770d49ff) Conflicts: blockdev.c *fixed trivial context mismatch due to blockdev_init signature change Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03blockdev: Plug memory leak in blockdev_init()Markus Armbruster1-2/+3
blockdev_init() leaks bs_opts when qemu_opts_create() fails, i.e. when the ID is bad. Missed in commit ec9c10d. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 6376f9522372d589f3efe60001dc0486237dd375) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03cputlb: Fix regression with TCG interpreter (bug 1310324)Stefan Weil1-2/+4
Commit 0f842f8a246f2b5b51a11c13f933bf7a90ae8e96 replaced GETPC_EXT() which was derived from GETPC() by GETRA_EXT() without fixing cputlb.c. A later patch replaced GETRA_EXT() by GETRA() in exec/softmmu_template.h which is included in cputlb.c. The TCG interpreter failed because the values returned by GETRA() were no longer explicitly set to 0. The redefinition of GETRA() introduced here fixes this. In addition, GETPC_ADJ which is also used in exec/softmmu_template.h is set to 0. Both changes reduce the compiled code size for cputlb.c by more than 100 bytes, so the normal TCG without interpreter also profits from the reduced code size and slightly faster code. Cc: qemu-stable@nongnu.org Reported-by: Giovanni Mascellani <gio@debian.org> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7e4e88656c1e6192e9e47a2054d2dc190c1b840b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03target-xtensa: fix cross-page jumps/calls at the end of TBMax Filippov1-2/+2
Use tb->pc instead of dc->pc to check for cross-page jumps. When TB translation stops at the page boundary dc->pc points to the next page allowing chaining to TBs in it, which is wrong. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 433d33c555deeed375996e338df1a9510df401c6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03virtio-scsi: Plug memory leak on virtio_scsi_push_event() error pathMarkus Armbruster1-1/+2
Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91e7fcca4743cf694eb0c8e7a8d938cf359b5bd8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow1: Stricter backing file length checkKevin Wolf3-2/+23
Like qcow2 since commit 6d33e8e7, error out on invalid lengths instead of silently truncating them to 1023. Also don't rely on bdrv_pread() catching integer overflows that make len negative, but use unsigned variables in the first place. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit d66e5cee002c471b78139228a4e7012736b375f9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow1: Validate image size (CVE-2014-0223)Kevin Wolf3-2/+30
A huge image size could cause s->l1_size to overflow. Make sure that images never require a L1 table larger than what fits in s->l1_size. This cannot only cause unbounded allocations, but also the allocation of a too small L1 table, resulting in out-of-bounds array accesses (both reads and writes). Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 46485de0cb357b57373e1ca895adedf1f3ed46ec) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow1: Validate L2 table size (CVE-2014-0222)Kevin Wolf3-0/+34
Too large L2 table sizes cause unbounded allocations. Images actually created by qemu-img only have 512 byte or 4k L2 tables. To keep things consistent with cluster sizes, allow ranges between 512 bytes and 64k (in fact, down to 1 entry = 8 bytes is technically working, but L2 table sizes smaller than a cluster don't make a lot of sense). This also means that the number of bytes on the virtual disk that are described by the same L2 table is limited to at most 8k * 64k or 2^29, preventively avoiding any integer overflows. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit 42eb58179b3b215bb507da3262b682b8a2ec10b5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow1: Check maximum cluster sizeKevin Wolf4-1/+85
Huge values for header.cluster_bits cause unbounded allocations (e.g. for s->cluster_cache) and crash qemu this way. Less huge values may survive those allocations, but can cause integer overflows later on. The only cluster sizes that qemu can create are 4k (for standalone images) and 512 (for images with backing files), so we can limit it to 64k. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit 7159a45b2bf2dcb9f49f1e27d1d3d135a0247a2f) Conflicts: block/qcow.c tests/qemu-iotests/group *removed mismatch due to error msgs from upstream's b6d5066d *removed context from upstream block tests Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow1: Make padding in the header explicitKevin Wolf1-1/+2
We were relying on all compilers inserting the same padding in the header struct that is used for the on-disk format. Let's not do that. Mark the struct as packed and insert an explicit padding field for compatibility. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit ea54feff58efedc809641474b25a3130309678e7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03parallels: Sanity check for s->tracks (CVE-2014-0142)Kevin Wolf3-1/+17
This avoids a possible division by zero. Convert s->tracks to unsigned as well because it feels better than surviving just because the results of calculations with s->tracks are converted to unsigned anyway. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 9302e863aa8baa5d932fc078967050c055fa1a7f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03parallels: Fix catalog size integer overflow (CVE-2014-0143)Kevin Wolf6-1/+97
The first test case would cause a huge memory allocation, leading to a qemu abort; the second one to a too small malloc() for the catalog (smaller than s->catalog_size), which causes a read-only out-of-bounds array access and on big endian hosts an endianess conversion for an undefined memory area. The sample image used here is not an original Parallels image. It was created using an hexeditor on the basis of the struct that qemu uses. Good enough for trying to crash the driver, but not for ensuring compatibility. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit afbcc40bee4ef51731102d7d4b499ee12fc182e1) Conflicts: tests/qemu-iotests/group *fixed mismatches in group file Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() (CVE-2014-0143)Kevin Wolf5-4/+29
This avoids an unbounded allocation. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)Kevin Wolf3-2/+22
For the L1 table to loaded for an internal snapshot, the code allocated only enough memory to hold the currently active L1 table. If the snapshot's L1 table is actually larger than the current one, this leads to a buffer overflow. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit c05e4667be91b46ab42b5a11babf8e84d476cc6b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix copy_sectors() with VM stateKevin Wolf3-11/+33
bs->total_sectors is not the highest possible sector number that could be involved in a copy on write operation: VM state is after the end of the virtual disk. This resulted in wrong values for the number of sectors to be copied (n). The code that checks for the end of the image isn't required any more because the code hasn't been calling the block layer's bdrv_read() for a long time; instead, it directly calls qcow2_readv(), which doesn't error out on VM state sector numbers. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 6b7d4c55586a849aa8313282d79432917eade3bf) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03qcow2: Fix NULL dereference in qcow2_open() error path (CVE-2014-0146)Kevin Wolf3-3/+15
The qcow2 code assumes that s->snapshots is non-NULL if s->nb_snapshots != 0. By having the initialisation of both fields separated in qcow2_open(), any error occuring in between would cause the error path to dereference NULL in qcow2_free_snapshots() if the image had any snapshots. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 11b128f4062dd7f89b14abc8877ff20d41b28be9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03block: Limit request size (CVE-2014-0143)Kevin Wolf1-0/+4
Limiting the size of a single request to INT_MAX not only fixes a direct integer overflow in bdrv_check_request() (which would only trigger bad behaviour with ridiculously huge images, as in close to 2^64 bytes), but can also prevent overflows in all block drivers. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 8f4754ede56e3f9ea3fd7207f4a7c4453e59285b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: prevent chunk buffer overflow (CVE-2014-0145)Stefan Hajnoczi1-6/+33
Both compressed and uncompressed I/O is buffered. dmg_open() calculates the maximum buffer size needed from the metadata in the image file. There is currently a buffer overflow since ->lengths[] is accounted against the maximum compressed buffer size but actually uses the uncompressed buffer: switch (s->types[chunk]) { case 1: /* copy */ ret = bdrv_pread(bs->file, s->offsets[chunk], s->uncompressed_chunk, s->lengths[chunk]); We must account against the maximum uncompressed buffer size for type=1 chunks. This patch fixes the maximum buffer size calculation to take into account the chunk type. It is critical that we update the correct maximum since there are two buffers ->compressed_chunk and ->uncompressed_chunk. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit f0dce23475b5af5da6b17b97c1765271307734b6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-07-03dmg: use uint64_t consistently for sectors and lengthsStefan Hajnoczi1-3/+3
The DMG metadata is stored as uint64_t, so use the same type for sector_num. int was a particularly poor choice since it is only 32-bit and would truncate large values. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 686d7148ec23402a172628c800022b3a95a022c9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-15 00:49:22 +0000