qemu is a generic and open source machine emulator and virtualizer.
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Issue/PR: add templete for issue and PR It is convenient for communication by using this templete. Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 6 年前 | |
update code | 6 年前 | |
Package init | 6 年前 | |
9pfs: Fully restart unreclaim loop (CVE-2021-20181) Fix CVE-2021-20181 Depending on the client activity, the server can be asked to open a huge number of file descriptors and eventually hit RLIMIT_NOFILE. This is currently mitigated using a reclaim logic : the server closes the file descriptors of idle fids, based on the assumption that it will be able to re-open them later. This assumption doesn't hold of course if the client requests the file to be unlinked. In this case, we loop on the entire fid list and mark all related fids as unreclaimable (the reclaim logic will just ignore them) and, of course, we open or re-open their file descriptors if needed since we're about to unlink the file. This is the purpose of v9fs_mark_fids_unreclaim(). Since the actual opening of a file can cause the coroutine to yield, another client request could possibly add a new fid that we may want to mark as non-reclaimable as well. The loop is thus restarted if the re-open request was actually transmitted to the backend. This is achieved by keeping a reference on the first fid (head) before traversing the list. This is wrong in several ways: - a potential clunk request from the client could tear the first fid down and cause the reference to be stale. This leads to a use-after-free error that can be detected with ASAN, using a custom 9p client - fids are added at the head of the list : restarting from the previous head will always miss fids added by a some other potential request All these problems could be avoided if fids were being added at the end of the list. This can be achieved with a QSIMPLEQ, but this is probably too much change for a bug fix. For now let's keep it simple and just restart the loop from the current head. Fixes: CVE-2021-20181 Buglink: https://bugs.launchpad.net/qemu/+bug/1911666 Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-Id: <161064025265.1838153.15185571283519390907.stgit@bahia.lan> Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
9pfs: Update 9pfs-local-Fix-possible patch format Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
vtimer: introduce the vtimer first used in v4.0.1 To support cross version migration, we had to add the vtimer back which was introduced in openEuler qemu-4.0.1. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Revert: "vtimer: compat cross version migration from v4.0.1" This reverts commit patch: vtimer-compat-cross-version-migration-from-v4.0.1.patch Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
Fix some memory leak in qemu Signed-off-by: Ying Fang <fangying1@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Support CPU cold plug This adds CPU cold plug support to arm virt machine board. CPU cold plug means adding CPU by using "-device xx-arm-cpu" when we bring up Qemu. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
async: Fix qemu main thread hang on weak ordered platfrom aio-wait: delegate polling of main AioContext if BQL not held upstream_url: https://patchwork.kernel.org/patch/11482099/ async: use explicit memory barriers upstream_url: https://patchwork.kernel.org/patch/11482103/ Signed-off-by: Ying Fang <fanging1@huawei.com> | 6 年前 | |
ati: check x y display parameter values fix CVE-2020-24352 The source and destination x,y display parameters in ati_2d_blt() may run off the vga limits if either of s->regs.[src|dst]_[xy] is zero. Check the parameter values to avoid potential crash. Reported-by: Gaoning Pan <pgn@zju.edu.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20201021103818.1704030-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
ati: use vga_read_byte in ati_cursor_define fix CVE-2019-20808 This makes sure reads are confined to vga video memory. v3: use uint32_t, fix cut+paste bug. v2: fix ati_cursor_draw_line too. Reported-by: xu hang <flier_m@outlook.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190917111441.27405-3-kraxel@redhat.com cherry-pick from aab0e2a661b2b6bf7915c0aefe807fb60d6d9d13 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
CVE: fix CVE-2020-11869 backport from qemu upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=ac2071c3791b67fc7af78b8ceb320c01ca1b5df7 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
update block-fix-memleaks-in-bdrv_refresh_filename.patch. | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix some issue for monitor and iscsi block/iscsi: use MIN() between mx_sb_len and sb_len_wr monitor: fix memory leak in monitor_fdset_dup_fd_find_remove Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
Package init | 6 年前 | |
CVE: Fix CVE-2018-19665 upstream url: https://patchwork.kernel.org/patch/10688527/ Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
bugfix: fix Uninitialized Free Vulnerability Signed-off-by: nocjj <1250062498@qq.com> Signed-off-by: imxcc <xingchaochao@huawei.com> | 5 年前 | |
cadence_gem: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Package init | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20196/CVE-2021-4207/CVE-2021-4206 (openeuler !289) hw/block/fdc: Extract blk_create_empty_drive() hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 tests/fdc-test: Add a regression test for CVE-2021-20196 display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) Signed-off-by: yezengruan <yezengruan@huawei.com> Signed-off-by: bobychen <boby.chen@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
dp8393x: switch to use qemu_receive_packet() for loopback packet Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
e1000: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Package init | 6 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix cve-2020-35504 esp: always check current_req is not NULL before use in DMA callbacks Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
fix cve-2020-35505 esp: ensure cmdfifo is not empty and current_dev is non-NULL Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
hostmem: Fix up free host_nodes list right after visited In host_memory_backend_get_host_nodes, we build host_nodes list and output it to v (a StringOutputVisitor) but forget to free the list. This fixes the memory leak. The memory leak stack: Direct leak of 32 byte(s) in 2 object(s) allocated from: #0 0xfffda30b3393 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xd3393) #1 0xfffda1d28b9b in g_malloc0 (/usr/lib64/libglib-2.0.so.0+0x58b9b) #2 0xaaab05ca6e43 in host_memory_backend_get_host_nodes backends/hostmem.c:94 #3 0xaaab061ddf83 in object_property_get_uint16List qom/object.c:1478 #4 0xaaab05866513 in query_memdev hw/core/machine-qmp-cmds.c:312 #5 0xaaab061d980b in do_object_child_foreach qom/object.c:1001 #6 0xaaab0586779b in qmp_query_memdev hw/core/machine-qmp-cmds.c:328 #7 0xaaab0615ed3f in qmp_marshal_query_memdev qapi/qapi-commands-machine.c:327 #8 0xaaab0632d647 in do_qmp_dispatch qapi/qmp-dispatch.c:147 #9 0xaaab0632d647 in qmp_dispatch qapi/qmp-dispatch.c:190 #10 0xaaab0610f74b in monitor_qmp_dispatch monitor/qmp.c:120 #11 0xaaab0611074b in monitor_qmp_bh_dispatcher monitor/qmp.c:209 #12 0xaaab063caefb in aio_bh_poll util/async.c:117 #13 0xaaab063d30fb in aio_dispatch util/aio-posix.c:459 #14 0xaaab063cac8f in aio_ctx_dispatch util/async.c:268 #15 0xfffda1d22a6b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a6b) #16 0xaaab063d0e97 in glib_pollfds_poll util/main-loop.c:218 #17 0xaaab063d0e97 in os_host_main_loop_wait util/main-loop.c:241 #18 0xaaab063d0e97 in main_loop_wait util/main-loop.c:517 #19 0xaaab05c8bfa7 in main_loop /root/rpmbuild/BUILD/qemu-4.1.0/vl.c:1791 #20 0xaaab05713bc3 in main /root/rpmbuild/BUILD/qemu-4.1.0/vl.c:4473 #21 0xfffda0a83ebf in __libc_start_main (/usr/lib64/libc.so.6+0x23ebf) #22 0xaaab0571ed5f (aarch64-softmmu/qemu-system-aarch64+0x88ed5f) SUMMARY: AddressSanitizer: 32 byte(s) leaked in 2 allocation(s). Fixes: 4cf1b76bf1e2 (hostmem: add properties for NUMA memory policy) Reported-by: Euler Robot <euler.robot@huawei.com> Tested-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 5 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
hw/arm/acpi: enable SHPC native hot plug backport from upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=e04c13cdcf5befd9d08df38d4d34494a802cdf63 Signed-off-by: Zeyu Jin <jinzeyu@huawei.com> | 5 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
patch: fix patch format problem which can lead git am failed Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
hw/arm/virt: Init PMU for hotplugged vCPU Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
hw/arm/virt: add missing compat for kvm-no-adjvtime Machine compatibility for kvm-no-adjvtime is missed, let's add it for virt machine 4.0, thus kvm-no-adjvtime is supported in v4.1.0. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2021-20196/CVE-2021-4207/CVE-2021-4206 (openeuler !289) hw/block/fdc: Extract blk_create_empty_drive() hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 tests/fdc-test: Add a regression test for CVE-2021-20196 display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) Signed-off-by: yezengruan <yezengruan@huawei.com> Signed-off-by: bobychen <boby.chen@huawei.com> | 4 年前 | |
fix CVE-2021-20196/CVE-2021-4207/CVE-2021-4206 (openeuler !289) hw/block/fdc: Extract blk_create_empty_drive() hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 tests/fdc-test: Add a regression test for CVE-2021-20196 display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) Signed-off-by: yezengruan <yezengruan@huawei.com> Signed-off-by: bobychen <boby.chen@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
hw: ehci: check return value of 'usb_packet_map' If 'usb_packet_map' fails, we should stop to process the usb request. Signed-off-by: Li Qiang <liq3ea@163.com> Message-Id: <20200812161727.29412-1-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry-picked from 2fdb42d8) Fix CVE-2020-25723 Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
hw/ide: check null block before _cancel_dma_sync fix CVE-2020-25743 patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05967.html When canceling an i/o operation via ide_cancel_dam_sync(), a block pointer may be null. Add check to avoid null pointer dereference. -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1 ==1803100==Hint: address points to the zero page. #0 blk_bs ../block/block-backend.c:714 #1 blk_drain ../block/block-backend.c:1715 #2 ide_cancel_dma_sync ../hw/ide/core.c:723 #3 bmdma_cmd_writeb ../hw/ide/core.c:723 #4 bmdma_write ../hw/ide/pci.c:298 #5 memory_region_write_accessor ../softmmu/memory.c:483 #6 access_with_adjusted_size ../softmmu/memory.c:544 #7 memory_region_dispatch_write ../softmmu/memory.c:1465 #8 flatview_write_continue ../exe.c:3176 ... Reported-by: Ruhr-University <bugs-syssec@rub.de> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | 5 年前 | |
hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register Fix CVE-2021-20221 Per the ARM Generic Interrupt Controller Architecture specification (document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit, not 10: - 4.3 Distributor register descriptions - 4.3.15 Software Generated Interrupt Register, GICD_SG - Table 4-21 GICD_SGIR bit assignments The Interrupt ID of the SGI to forward to the specified CPU interfaces. The value of this field is the Interrupt ID, in the range 0-15, for example a value of 0b0011 specifies Interrupt ID 3. Correct the irq mask to fix an undefined behavior (which eventually lead to a heap-buffer-overflow, see [Buglink]): $ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio [I 1612088147.116987] OPENED [R +0.278293] writel 0x8000f00 0xff4affb0 ../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13 This fixes a security issue when running with KVM on Arm with kernel-irqchip=off. (The default is kernel-irqchip=on, which is unaffected, and which is also the correct choice for performance.) Cc: qemu-stable@nongnu.org Fixes: CVE-2021-20221 Fixes: 9ee6e8bb ("ARMv7 support.") Buglink: https://bugs.launchpad.net/qemu/+bug/1913916 Buglink: https://bugs.launchpad.net/qemu/+bug/1913917 Reported-by: Alexander Bulekov's avatarAlexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé's avatarPhilippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210131103401.217160-1-f4bug@amsat.org Reviewed-by: Peter Maydell's avatarPeter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell's avatarPeter Maydell <peter.maydell@linaro.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
fix CVE-2021-3750 and Check that colo-compare is active (openeuler !291!298) hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750) net/colo-compare.c: Check that colo-compare is active | 4 年前 | |
fix CVE-2021-3750 and Check that colo-compare is active (openeuler !291!298) hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750) net/colo-compare.c: Check that colo-compare is active | 4 年前 | |
fix CVE-2021-3750 and Check that colo-compare is active (openeuler !291!298) hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750) net/colo-compare.c: Check that colo-compare is active | 4 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
hw/net/e1000e: advance desc_offset in case of null descriptor While receiving packets via e1000e_write_packet_to_guest() routine, 'desc_offset' is advanced only when RX descriptor is processed. And RX descriptor is not processed if it has NULL buffer address. This may lead to an infinite loop condition. Increament 'desc_offset' to process next descriptor in the ring to avoid infinite loop. Reported-by: Cheol-woo Myung <330cjfdn@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry-picked from c2cb5116) Fix CVE-2020-28916 Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() An assertion failure issue was found in the code that processes network packets while adding data fragments into the packet context. It could be abused by a malicious guest to abort the QEMU process on the host. This patch replaces the affected assert() with a conditional statement, returning false if the current data fragment exceeds max_raw_frags. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Ziming Zhang <ezrakiez@gmail.com> Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> | 5 年前 | |
hw/net/rocker_of_dpa: fix double free bug of rocker device The of_dpa_cmd_add_l2_flood function of the rocker device releases the memory of group->l2_flood.group_ids before applying for new memory. If the l2_group configured by the guest does not match the input group->l2_flood.group_ids, the err_out branch is redirected to release the memory of the group->l2_flood.group_ids branch. The pointer is not set to NULL after the memory is freed. When the guest accesses the of_dpa_cmd_add_l2_flood function again, the memory of group->l2_flood.group_ids is released again. As a result, the memory is double free. Fix that by setting group->l2_flood.group_ids to NULL after free. Signed-off-by: Jiajie Li <lijiajie11@huawei.com> Signed-off-by: Qiang Ning <ningqiang1@huawei.com> | 5 年前 | |
hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() A buffer overflow issue was reported by Mr. Ziming Zhang, CC'd here. It occurs while sending an Ethernet frame due to missing break statements and improper checking of the buffer size. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com> | 5 年前 | |
hw/pci-host: add pci-intack write method fix CVE-2020-15469 Add pci-intack mmio write method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
fix CVE-2021-3582/CVE-2021-3607/CVE-2021-3608 hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) pvrdma: Ensure correct input on ring init (CVE-2021-3607) pvrdma: Fix the ring init error flow (CVE-2021-3608) Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands This avoids an off-by-one read of 'mode_sense_valid' buffer in hw/scsi/scsi-disk.c:mode_sense_page(). Fixes: CVE-2021-3930 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") Fixes: #546 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: AlexChen <alex.chen@huawei.com> Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
hw/sd: sdhci: Correctly set the controller status for ADMA Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 When an ADMA transfer is started, the codes forget to set the controller status to indicate a transfer is in progress. With this fix, the following 2 reproducers: https://paste.debian.net/plain/1185136 https://paste.debian.net/plain/1185141 cannot be reproduced with the following QEMU command line: $ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \ -nodefaults -device sdhci-pci,sd-spec-version=3 \ -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \ -device sd-card,drive=mydrive -qtest stdio Cc: qemu-stable@nongnu.org Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cornelius Aschermann (Ruhr-University Bochum) Reported-by: Muhammad Ramdhan Reported-by: Sergej Schumilo (Ruhr-University Bochum) Reported-by: Simon Wrner (Ruhr-University Bochum) Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Buglink: https://bugs.launchpad.net/qemu/+bug/1909418 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146 Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
hw/sd: sdhci: Don't transfer any data when command time out Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 At the end of sdhci_send_command(), it starts a data transfer if the command register indicates data is associated. But the data transfer should only be initiated when the command execution has succeeded. With this fix, the following reproducer: outl 0xcf8 0x80001810 outl 0xcfc 0xe1068000 outl 0xcf8 0x80001804 outw 0xcfc 0x7 write 0xe106802c 0x1 0x0f write 0xe1068004 0xc 0x2801d10101fffffbff28a384 write 0xe106800c 0x1f 0x9dacbbcad9e8f7061524334251606f7e8d9cabbac9d8e7f60514233241505f write 0xe1068003 0x28 0x80d000251480d000252280d000253080d000253e80d000254c80d000255a80d000256880d0002576 write 0xe1068003 0x1 0xfe cannot be reproduced with the following QEMU command line: $ qemu-system-x86_64 -nographic -M pc-q35-5.0 \ -device sdhci-pci,sd-spec-version=3 \ -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \ -device sd-card,drive=mydrive \ -monitor none -serial none -qtest stdio Cc: qemu-stable@nongnu.org Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cornelius Aschermann (Ruhr-University Bochum) Reported-by: Muhammad Ramdhan Reported-by: Sergej Schumilo (Ruhr-University Bochum) Reported-by: Simon Wrner (Ruhr-University Bochum) Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Buglink: https://bugs.launchpad.net/qemu/+bug/1909418 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146 Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 Per "SD Host Controller Standard Specification Version 7.00" chapter 2.2.1 SDMA System Address Register: This register can be accessed only if no transaction is executing (i.e., after a transaction has stopped). With this fix, the following reproducer: outl 0xcf8 0x80001010 outl 0xcfc 0xfbefff00 outl 0xcf8 0x80001001 outl 0xcfc 0x06000000 write 0xfbefff2c 0x1 0x05 write 0xfbefff0f 0x1 0x37 write 0xfbefff0a 0x1 0x01 write 0xfbefff0f 0x1 0x29 write 0xfbefff0f 0x1 0x02 write 0xfbefff0f 0x1 0x03 write 0xfbefff04 0x1 0x01 write 0xfbefff05 0x1 0x01 write 0xfbefff07 0x1 0x02 write 0xfbefff0c 0x1 0x33 write 0xfbefff0e 0x1 0x20 write 0xfbefff0f 0x1 0x00 write 0xfbefff2a 0x1 0x01 write 0xfbefff0c 0x1 0x00 write 0xfbefff03 0x1 0x00 write 0xfbefff05 0x1 0x00 write 0xfbefff2a 0x1 0x02 write 0xfbefff0c 0x1 0x32 write 0xfbefff01 0x1 0x01 write 0xfbefff02 0x1 0x01 write 0xfbefff03 0x1 0x01 cannot be reproduced with the following QEMU command line: $ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \ -nodefaults -device sdhci-pci,sd-spec-version=3 \ -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \ -device sd-card,drive=mydrive -qtest stdio Cc: qemu-stable@nongnu.org Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cornelius Aschermann (Ruhr-University Bochum) Reported-by: Muhammad Ramdhan Reported-by: Sergej Schumilo (Ruhr-University Bochum) Reported-by: Simon Wrner (Ruhr-University Bochum) Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Buglink: https://bugs.launchpad.net/qemu/+bug/1909418 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146 Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
qemu: enrich commit info for some patchs Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 The codes to limit the maximum block size is only necessary when SDHC_BLKSIZE register is writable. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 If the block size is programmed to a different value from the previous one, reset the data pointer of s->fifo_buffer[] so that s->fifo_buffer[] can be filled in using the new block size in the next transfer. With this fix, the following reproducer: outl 0xcf8 0x80001010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80001001 outl 0xcfc 0x06000000 write 0xe000002c 0x1 0x05 write 0xe0000005 0x1 0x02 write 0xe0000007 0x1 0x01 write 0xe0000028 0x1 0x10 write 0x0 0x1 0x23 write 0x2 0x1 0x08 write 0xe000000c 0x1 0x01 write 0xe000000e 0x1 0x20 write 0xe000000f 0x1 0x00 write 0xe000000c 0x1 0x32 write 0xe0000004 0x2 0x0200 write 0xe0000028 0x1 0x00 write 0xe0000003 0x1 0x40 cannot be reproduced with the following QEMU command line: $ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \ -nodefaults -device sdhci-pci,sd-spec-version=3 \ -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \ -device sd-card,drive=mydrive -qtest stdio Cc: qemu-stable@nongnu.org Fixes: CVE-2020-17380 Fixes: CVE-2020-25085 Fixes: CVE-2021-3409 Fixes: d7dfca0807a0 ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cornelius Aschermann (Ruhr-University Bochum) Reported-by: Muhammad Ramdhan Reported-by: Sergej Schumilo (Ruhr-University Bochum) Reported-by: Simon Wrner (Ruhr-University Bochum) Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Buglink: https://bugs.launchpad.net/qemu/+bug/1909418 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146 Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
hw/usb/core.c fix buffer overflow in do_token_setup() function Store calculated setup_len in a local variable, verify it, and only write it to the struct(USBDevice->setup_len)in case it passed the sanity checks. This prevent other code (do_token_{in,out}function specifically) from working with invalid USBDevice->setup_len values and overruning the USBDevice->setup_buf[] buffer. Fixes: CVE-2020-14364 | 5 年前 | |
hw: usb: hcd-ohci: check for processed TD before retire While servicing OHCI transfer descriptors(TD), ohci_service_iso_td retires a TD if it has passed its time frame. It does not check if the TD was already processed once and holds an error code in TD_CC. It may happen if the TD list has a loop. Add check to avoid an infinite loop condition. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-id: 20200915182259.68522-3-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry-picked from 1be90ebe) Fix CVE-2020-25625 Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
hw: usb: hcd-ohci: check len and frame_number variables While servicing the OHCI transfer descriptors(TD), OHCI host controller derives variables 'start_addr', 'end_addr', 'len' etc. from values supplied by the host controller driver. Host controller driver may supply values such that using above variables leads to out-of-bounds access issues. Add checks to avoid them. AddressSanitizer: stack-buffer-overflow on address 0x7ffd53af76a0 READ of size 2 at 0x7ffd53af76a0 thread T0 #0 ohci_service_iso_td ../hw/usb/hcd-ohci.c:734 #1 ohci_service_ed_list ../hw/usb/hcd-ohci.c:1180 #2 ohci_process_lists ../hw/usb/hcd-ohci.c:1214 #3 ohci_frame_boundary ../hw/usb/hcd-ohci.c:1257 #4 timerlist_run_timers ../util/qemu-timer.c:572 #5 qemu_clock_run_timers ../util/qemu-timer.c:586 #6 qemu_clock_run_all_timers ../util/qemu-timer.c:672 #7 main_loop_wait ../util/main-loop.c:527 #8 qemu_main_loop ../softmmu/vl.c:1676 #9 main ../softmmu/main.c:50 Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Yongkang Jia <j_kangel@163.com> Reported-by: Yi Ren <yunye.ry@alibaba-inc.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20200915182259.68522-2-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry-picked from 1328fe0c) Fix CVE-2020-25624 Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
qemu: enrich commit info for some patchs Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
CVE: fix CVE-2019-20175 backport patch from upstream: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ed78352a59ea7acf7520d4d47a96b9911bae7fc3 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
ide: ahci: add check to avoid null dereference (CVE-2019-12067) Fix CVE-2019-12067 AHCI emulator while committing DMA buffer in ahci_commit_buf() may do a NULL dereference if the command header 'ad->cur_cmd' is null. Add check to avoid it. Reported-by: Bugs SysSec <address@hidden> Signed-off-by: Prasad J Pandit <address@hidden> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
ide:atapi: check io_buffer_index in ide_atapi_cmd_reply_end Fix CVE-2020-29443 During data transfer via packet command in 'ide_atapi_cmd_reply_end' 's->io_buffer_index' could exceed the 's->io_buffer' length, leading to OOB access issue. Add check to avoid it. ... #9 ahci_pio_transfer ../hw/ide/ahci.c:1383 #10 ide_transfer_start_norecurse ../hw/ide/core.c:553 #11 ide_atapi_cmd_reply_end ../hw/ide/atapi.c:284 #12 ide_atapi_cmd_read_pio ../hw/ide/atapi.c:329 #13 ide_atapi_cmd_read ../hw/ide/atapi.c:442 #14 cmd_read ../hw/ide/atapi.c:988 #15 ide_atapi_cmd ../hw/ide/atapi.c:1352 #16 ide_transfer_start ../hw/ide/core.c:561 #17 cmd_packet ../hw/ide/core.c:1729 #18 ide_exec_cmd ../hw/ide/core.c:2107 #19 handle_reg_h2d_fis ../hw/ide/ahci.c:1267 #20 handle_cmd ../hw/ide/ahci.c:1318 #21 check_cmd ../hw/ide/ahci.c:592 #22 ahci_port_write ../hw/ide/ahci.c:373 #23 ahci_mem_write ../hw/ide/ahci.c:513 Reported-by: Wenxiang Qian <leonwxqian@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
imx7-ccm: add digprog mmio write method fix CVE-2020-15469 Add digprog mmio write method to avoid assert failure during initialisation. Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Arm: Backport patches from upstream to support more than 256 vcpus Without this serial, we can't start VM with more than 256 vcpus, this is limited by kvm API, backport this serial to fix the bug. With this patches, it can supports up to 512 vcpus. Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) Pick patch from upstream to fix CVE-2020-1711 upstream url: https://git.qemu.org/?p=qemu.git;a=commit;h=693fd2acdf14dd86c0bf852610f1c2cca80a74dc Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
json: Fix a memleak in parse_pair() In qobject_type(), NULL is returned when the 'QObject' returned from parse_value() is not of QString type, and this 'QObject' memory will leaked. So we need to first cache the 'QObject' returned from parse_value(), and finally free 'QObject' memory at the end of the function. Also, we add a testcast about invalid dict key. The memleak stack is as follows: Direct leak of 32 byte(s) in 1 object(s) allocated from: #0 0xfffe4b3c34fb in __interceptor_malloc (/lib64/libasan.so.4+0xd34fb) #1 0xfffe4ae48aa3 in g_malloc (/lib64/libglib-2.0.so.0+0x58aa3) #2 0xaaab3557d9f7 in qnum_from_int qemu/qobject/qnum.c:25 #3 0xaaab35584d23 in parse_literal qemu/qobject/json-parser.c:511 #4 0xaaab35584d23 in parse_value qemu/qobject/json-parser.c:554 #5 0xaaab35583d77 in parse_pair qemu/qobject/json-parser.c:270 #6 0xaaab355845db in parse_object qemu/qobject/json-parser.c:327 #7 0xaaab355845db in parse_value qemu/qobject/json-parser.c:546 #8 0xaaab35585b1b in json_parser_parse qemu/qobject/json-parser.c:580 #9 0xaaab35583703 in json_message_process_token qemu/qobject/json-streamer.c:92 #10 0xaaab355ddccf in json_lexer_feed_char qemu/qobject/json-lexer.c:313 #11 0xaaab355de0eb in json_lexer_feed qemu/qobject/json-lexer.c:350 #12 0xaaab354aff67 in tcp_chr_read qemu/chardev/char-socket.c:525 #13 0xfffe4ae429db in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x529db) #14 0xfffe4ae42d8f (/lib64/libglib-2.0.so.0+0x52d8f) #15 0xfffe4ae430df in g_main_loop_run (/lib64/libglib-2.0.so.0+0x530df) #16 0xaaab34d70bff in iothread_run qemu/iothread.c:82 #17 0xaaab3559d71b in qemu_thread_start qemu/util/qemu-thread-posix.c:519 Fixes: 532fb5328473 ("qapi: Make more of qobject_to()") Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20201113145525.85151-1-alex.chen@huawei.com> [Commit message tweaked] (cherry-picked form commit 922d42bb) | 5 年前 | |
lan9118: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
log: Add some logs on VM runtime path Add logs on VM runtime path, to make it easier to do trouble shooting. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
qemu: pick serveral patches from upstream that fix CVE Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362 Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 5 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
memory: clamp cached translation in case it points to an MMIO region In using the address_space_translate_internal API, address_space_cache_init forgot one piece of advice that can be found in the code for address_space_translate_internal: /* MMIO registers can be expected to perform full-width accesses based only * on their address, without considering adjacent registers that could * decode to completely different MemoryRegions. When such registers * exist (e.g. I/O ports 0xcf8 and 0xcf9 on most PC chipsets), MMIO * regions overlap wildly. For this reason we cannot clamp the accesses * here. * * If the length is small (as is the case for address_space_ldl/stl), * everything works fine. If the incoming length is large, however, * the caller really has to do the clamping through memory_access_size. */ address_space_cache_init is exactly one such case where "the incoming length is large", therefore we need to clamp the resulting length---not to memory_access_size though, since we are not doing an access yet, but to the size of the resulting section. This ensures that subsequent accesses to the cached MemoryRegionSection will be in range. With this patch, the enclosed testcase notices that the used ring does not fit into the MSI-X table and prints a "qemu-system-x86_64: Cannot map used" error. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry-picked from 4bfb024b) Fix CVE-2020-27821 Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
migration: Compat virtual timer adjust for v4.0.1 and v4.1.0 Vtimer adjust is used in openEuler qemu-4.0.1, however kvm_adjvtime is introduced in openEuler qemu-4.1.0. To maintain the compatibility and enable cross version migration, let's enable vtimer adjust only if kvm_adjvtime is not enabled, otherwise there may be conflicts between vtimer adjust and kvm_adjvtime. After this modification: 1: openEuler qemu-4.0.1 use vtimer as the default virtual timer 2: openEuler qemu-4.1.0 use kvm_adjvtime as the defaut virtual timer Migration from openEuler qemu-4.0.1 to openEuler qemu-4.1.0 will be ok, but migration path from upstream qemu-4.0.1 to openEuler qemu-4..0.1 will be broken. Since openEuler qemu-4.1.0, kvm_adjvtime is used as the default virtual timer. So please upgrade to openEuler qemu-4.1.0 and use the virt-4.1 machine. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
migration: add missing ram.h for migration/socket.c ram.h is missing for migration/socket.c, let's add it. Later we will enable werror for qemu.spec Signed-off-by: Ying Fang <fangying1@huawei.com> | 5 年前 | |
migration: fix some memleaks Fix some memleaks for migration. Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
migration: fix some memleaks Fix some memleaks for migration. Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
migration: fix some memleaks Fix some memleaks for migration. Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
migration: backport migration patches from upstream This series patches backport migration patches from upstream. | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
msix: add valid.accepts methods to check address Fix CVE-2020-13754 While doing msi-x mmio operations, a guest may send an address that leads to an OOB access issue. Add valid.accepts methods to ensure that ensuing mmio r/w operation don't go beyond regions. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> patch link: https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Fix some memory leak in qemu Signed-off-by: Ying Fang <fangying1@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
fix CVE-2021-3750 and Check that colo-compare is active (openeuler !291!298) hw/intc/arm_gicv3_dist: Rename 64-bit accessors with 'q' suffix hw/intc/arm_gicv3: Replace mis-used MEMTX_* constants by booleans hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR (CVE-2021-3750) net/colo-compare.c: Check that colo-compare is active | 4 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
net: introduce qemu_receive_packet() Fix CVE-2021-3416 Some NIC supports loopback mode and this is done by calling nc->info->receive() directly which in fact suppresses the effort of reentrancy check that is done in qemu_net_queue_send(). Unfortunately we can use qemu_net_queue_send() here since for loop back there's no sender as peer, so this patch introduce a qemu_receive_packet() which is used for implementing loopback mode for a NIC with this check. NIC that supports loopback mode will be converted to this helper. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
net: remove an assert call in eth_get_gso_type fix CVE-2020-27617 eth_get_gso_type() routine returns segmentation offload type based on L3 protocol type. It calls g_assert_not_reached if L3 protocol is unknown, making the following return statement unreachable. Remove the g_assert call, it maybe triggered by a guest user. Reported-by: Gaoning Pan <pgn@zju.edu.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com> cherry-pick from commit 7564bf7701f00214cdc8a678a9f7df765244def1 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
net: vmxnet3: validate configuration values during activate (CVE-2021-20203) fix CVE-2021-20203 #I3A34O While activating device in vmxnet3_acticate_device(), it does not validate guest supplied configuration values against predefined minimum - maximum limits. This may lead to integer overflow or OOB access issues. Add checks to avoid it. Fixes: CVE-2021-20203 Buglink: https://bugs.launchpad.net/qemu/+bug/1913873 Reported-by: Gaoning Pan <pgn@zju.edu.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
nvram: add nrf51_soc flash read method fix CVE-2020-15469 Add nrf51_soc mmio read method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
pci: check bus pointer before dereference fix CVE-2020-25742 patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html While mapping IRQ level in pci_change_irq_level() routine, it does not check if pci_get_bus() returned a valid pointer. It may lead to a NULL pointer dereference issue. Add check to avoid it. -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1 ==1183858==Hint: address points to the zero page. #0 pci_change_irq_level hw/pci/pci.c:259 #1 pci_irq_handler hw/pci/pci.c:1445 #2 pci_set_irq hw/pci/pci.c:1463 #3 lsi_set_irq hw/scsi/lsi53c895a.c:488 #4 lsi_update_irq hw/scsi/lsi53c895a.c:523 #5 lsi_script_scsi_interrupt hw/scsi/lsi53c895a.c:554 #6 lsi_execute_script hw/scsi/lsi53c895a.c:1149 #7 lsi_reg_writeb hw/scsi/lsi53c895a.c:1984 #8 lsi_io_write hw/scsi/lsi53c895a.c:2146 ... Reported-by: Ruhr-University <bugs-syssec@rub.de> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | 5 年前 | |
pci-host: add pcie-msi read method fix CVE-2020-15469 Add pcie-msi mmio read method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
pcie: Add pcie-root-port deivce fast plug/unplug feature If a device is plugged in the pcie-root-port when VM kernel is booting, the kernel may wrongly disable the device. This bug was brought in by two patches of the linux kernel: https://patchwork.kernel.org/patch/10575355/ https://patchwork.kernel.org/patch/10766219/ VM runtime like kata uses this feature to boot microVM, so we must fix it up. We hack into the pcie native hotplug patch so that hotplug/unplug will work under this circumstance. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
pcie: Add pcie-root-port deivce fast plug/unplug feature If a device is plugged in the pcie-root-port when VM kernel is booting, the kernel may wrongly disable the device. This bug was brought in by two patches of the linux kernel: https://patchwork.kernel.org/patch/10575355/ https://patchwork.kernel.org/patch/10766219/ VM runtime like kata uses this feature to boot microVM, so we must fix it up. We hack into the pcie native hotplug patch so that hotplug/unplug will work under this circumstance. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
update code | 6 年前 | |
pcnet: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1917085 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Package init | 6 年前 | |
Package init | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
prep: add ppc-parity write method fix CVE-2020-15469 Add ppc-parity mmio write method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
fix CVE-2021-3582/CVE-2021-3607/CVE-2021-3608 hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) pvrdma: Ensure correct input on ring init (CVE-2021-3607) pvrdma: Fix the ring init error flow (CVE-2021-3608) Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
fix CVE-2021-3582/CVE-2021-3607/CVE-2021-3608 hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) pvrdma: Ensure correct input on ring init (CVE-2021-3607) pvrdma: Fix the ring init error flow (CVE-2021-3608) Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Package init | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
rtl8139: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1910826 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Fix some memory leak in qemu Signed-off-by: Ying Fang <fangying1@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
scsi: mptsas: dequeue request object in case of an error Fix CVE-2021-3392 While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Unconditionally dequeue 'req' object from 's->pending' to avoid it. Fixes: CVE-2021-3392 Buglink: https://bugs.launchpad.net/qemu/+bug/1914236 Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
sd: sdhci: assert data_count is within fifo_buffer Fix CVE-2020-17380 While doing multi block SDMA, transfer block size may exceed the 's->fifo_buffer[s->buf_maxsz]' size. It may leave the current element pointer 's->data_count' pointing out of bounds. Leading the subsequent DMA r/w operation to OOB access issue. Assert that 's->data_count' is within fifo_buffer. -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fsdhci_oob_write1 ==1459837==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 54722048 at 0x61500001e280 thread T3 #0 __interceptor_memcpy (/lib64/libasan.so.6+0x3a71d) #1 flatview_read_continue ../exec.c:3245 #2 flatview_read ../exec.c:3278 #3 address_space_read_full ../exec.c:3291 #4 address_space_rw ../exec.c:3319 #5 dma_memory_rw_relaxed ../include/sysemu/dma.h:87 #6 dma_memory_rw ../include/sysemu/dma.h:110 #7 dma_memory_read ../include/sysemu/dma.h:116 #8 sdhci_sdma_transfer_multi_blocks ../hw/sd/sdhci.c:629 #9 sdhci_write ../hw/sd/sdhci.c:1097 #10 memory_region_write_accessor ../softmmu/memory.c:483 ... Reported-by: Ruhr-University <bugs-syssec@rub.de> Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01175.html Signed-off-by: Jiajie Li <lijiajie11@hw.com> | 5 年前 | |
slirp: check pkt_len before reading protocol header While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input' routines, ensure that pkt_len is large enough to accommodate the respective protocol headers, lest it should do an OOB access. Add check to avoid it. CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets -> https://www.openwall.com/lists/oss-security/2020/11/27/1 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20201126135706.273950-1-ppandit@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> (cherry-picked from 2e1dcbc0) Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
qemu: rename some patches for slirp Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
qemu: rename some patches for slirp Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
qemu: rename some patches for slirp Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
qemu: rename some patches for slirp Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
CVE: Fix CVE-2020-7211 backport from upstream: https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
qemu: rename some patches for slirp Signed-off-by: AlexChen <alex.chen@huawei.com> | 5 年前 | |
sm501: Clean up local variables in sm501_2d_operation Make variables local to the block they are used in to make it clearer which operation they are needed for. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: ae59f8138afe7f6a5a4a82539d0f61496a906b06.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | 5 年前 | |
sm501: Convert printf + abort to qemu_log_mask Some places already use qemu_log_mask() to log unimplemented features or errors but some others have printf() then abort(). Convert these to qemu_log_mask() and avoid aborting to prevent guests to easily cause denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 305af87f59d81e92f2aaff09eb8a3603b8baa322.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | 5 年前 | |
sm501: Replace hand written implementation with pixman where possible Besides being faster this should also prevent malicious guests to abuse 2D engine to overwrite data or cause a crash. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 58666389b6cae256e4e972a32c05cf8aa51bffc0.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | 5 年前 | |
sm501: Shorten long variable names in sm501_2d_operation This increases readability and cleans up some confusing naming. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b9b67b94c46e945252a73c77dfd117132c63c4fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | 5 年前 | |
sm501: Use BIT(x) macro to shorten constant Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 124bf5de8d7cf503b32b377d0445029a76bfbd49.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | 5 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
spapr_pci: add spapr msi read method fix CVE-2020-15469 Add spapr msi mmio read method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
sungem: switch to use qemu_receive_packet() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
target/arm: Add the kvm_adjvtime vcpu property for Cortex-A72 Add the kvm_adjvtime vcpu property for ARM Cortex-A72 cpu model, so that virtual time adjust will be enabled for it. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
target/arm: Fix PAuth sbox functions Fix CVE-2020-10702 bug Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
target/arm/kvm: Adjust virtual time v3: - Added a target/arm/kvm_arm.h comment cleanup patch (1/6) - Minor refactoring of assert_has_feature_enabled/disabled in 4/6, kept Richard's r-b. - Rewrote kvm-no-adjvtime documentation in 6/6. - Reworked approach in 5/6 to properly deal with migration and to track running vs. !running, rather than running vs. paused states. v2: - Reworked it enough that I brought back the RFC tag and retitled the series. Also had to drop r-b's from a couple of patches, and even drop patches. - Changed approach from writing the QEMU virtual time to the guest vtime counter to saving and restoring the guest vtime counter. - Changed the kvm-adjvtime property, which was off by default, to a kvm-no-adjvtime property, which is also off by default, meaning the effective "adjust vtime" property is now on by default (but only for 5.0 virt machine types and later) v1: - move from RFC status to v1 - put kvm_arm_vm_state_change() in kvm.c to share among kvm32.c and kvm64.c - add r-b's from Richard This series is inspired by a series[1] posted by Bijan Mottahedeh over a year ago and by the patch[2] posted by Heyi Guo almost a year ago. The problem described in the cover letter of [1] is easily reproducible and some users would like to have the option to avoid it. However the solution, which is to adjust the virtual counter each time the VM transitions to the running state, introduces a different problem, which is that the virtual and physical counters diverge. As described in the cover letter of [1] this divergence is easily observed when comparing the output of date and hwclock after suspending the guest, waiting a while, and then resuming it. Because this different problem may actually be worse for some users, unlike [1], the series posted here makes the virtual counter adjustment optional. Besides the adjustment being optional, this series approaches the needed changes differently to apply them in more appropriate locations. Additional notes ---------------- Note 1 ------ As described above, when running a guest with kvm-no-adjtime disabled it will be less likely the guest OS and guest applications get surprise time jumps when they use the virtual counter. However the counter will no longer reflect real time. It will lag behind. If this is a problem then the guest can resynchronize its time from an external source or even from its physical counter. If the suspend/resume is done with libvirt's virsh, and the guest is running the guest agent, then it's also possible to use a sequence like this $ virsh suspend $GUEST $ virsh resume $GUEST $ virsh domtime --sync $GUEST in order to resynchronize a guest right after the resume. Of course there will still be time when the clock is not right, possibly creating confusing timestamps in logs, for example, and the guest must still be tolerant to the time synchronizations. Note 2 ------ Userspace that wants to set KVM_REG_ARM_TIMER_CNT should beware that the KVM register ID is not correct. This cannot be fixed because it's UAPI and if the UAPI headers are used then it can't be a problem. However, if a userspace attempts to create the ID themselves from the register's specification, then they will get KVM_REG_ARM_TIMER_CVAL instead, as the _CNT and _CVAL definitions have their register parameters swapped. Note 3 ------ I didn't test this with a 32-bit KVM host, but the changes to kvm32.c are the same as kvm64.c. So what could go wrong? Test results would be appreciated. [1] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg05713.html [2] https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg03695.html upstream url: https://patchwork.kernel.org/cover/11341629/ | 6 年前 | |
target/arm/kvm: Adjust virtual time v3: - Added a target/arm/kvm_arm.h comment cleanup patch (1/6) - Minor refactoring of assert_has_feature_enabled/disabled in 4/6, kept Richard's r-b. - Rewrote kvm-no-adjvtime documentation in 6/6. - Reworked approach in 5/6 to properly deal with migration and to track running vs. !running, rather than running vs. paused states. v2: - Reworked it enough that I brought back the RFC tag and retitled the series. Also had to drop r-b's from a couple of patches, and even drop patches. - Changed approach from writing the QEMU virtual time to the guest vtime counter to saving and restoring the guest vtime counter. - Changed the kvm-adjvtime property, which was off by default, to a kvm-no-adjvtime property, which is also off by default, meaning the effective "adjust vtime" property is now on by default (but only for 5.0 virt machine types and later) v1: - move from RFC status to v1 - put kvm_arm_vm_state_change() in kvm.c to share among kvm32.c and kvm64.c - add r-b's from Richard This series is inspired by a series[1] posted by Bijan Mottahedeh over a year ago and by the patch[2] posted by Heyi Guo almost a year ago. The problem described in the cover letter of [1] is easily reproducible and some users would like to have the option to avoid it. However the solution, which is to adjust the virtual counter each time the VM transitions to the running state, introduces a different problem, which is that the virtual and physical counters diverge. As described in the cover letter of [1] this divergence is easily observed when comparing the output of date and hwclock after suspending the guest, waiting a while, and then resuming it. Because this different problem may actually be worse for some users, unlike [1], the series posted here makes the virtual counter adjustment optional. Besides the adjustment being optional, this series approaches the needed changes differently to apply them in more appropriate locations. Additional notes ---------------- Note 1 ------ As described above, when running a guest with kvm-no-adjtime disabled it will be less likely the guest OS and guest applications get surprise time jumps when they use the virtual counter. However the counter will no longer reflect real time. It will lag behind. If this is a problem then the guest can resynchronize its time from an external source or even from its physical counter. If the suspend/resume is done with libvirt's virsh, and the guest is running the guest agent, then it's also possible to use a sequence like this $ virsh suspend $GUEST $ virsh resume $GUEST $ virsh domtime --sync $GUEST in order to resynchronize a guest right after the resume. Of course there will still be time when the clock is not right, possibly creating confusing timestamps in logs, for example, and the guest must still be tolerant to the time synchronizations. Note 2 ------ Userspace that wants to set KVM_REG_ARM_TIMER_CNT should beware that the KVM register ID is not correct. This cannot be fixed because it's UAPI and if the UAPI headers are used then it can't be a problem. However, if a userspace attempts to create the ID themselves from the register's specification, then they will get KVM_REG_ARM_TIMER_CVAL instead, as the _CNT and _CVAL definitions have their register parameters swapped. Note 3 ------ I didn't test this with a 32-bit KVM host, but the changes to kvm32.c are the same as kvm64.c. So what could go wrong? Test results would be appreciated. [1] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg05713.html [2] https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg03695.html upstream url: https://patchwork.kernel.org/cover/11341629/ | 6 年前 | |
target/arm/kvm: Adjust virtual time v3: - Added a target/arm/kvm_arm.h comment cleanup patch (1/6) - Minor refactoring of assert_has_feature_enabled/disabled in 4/6, kept Richard's r-b. - Rewrote kvm-no-adjvtime documentation in 6/6. - Reworked approach in 5/6 to properly deal with migration and to track running vs. !running, rather than running vs. paused states. v2: - Reworked it enough that I brought back the RFC tag and retitled the series. Also had to drop r-b's from a couple of patches, and even drop patches. - Changed approach from writing the QEMU virtual time to the guest vtime counter to saving and restoring the guest vtime counter. - Changed the kvm-adjvtime property, which was off by default, to a kvm-no-adjvtime property, which is also off by default, meaning the effective "adjust vtime" property is now on by default (but only for 5.0 virt machine types and later) v1: - move from RFC status to v1 - put kvm_arm_vm_state_change() in kvm.c to share among kvm32.c and kvm64.c - add r-b's from Richard This series is inspired by a series[1] posted by Bijan Mottahedeh over a year ago and by the patch[2] posted by Heyi Guo almost a year ago. The problem described in the cover letter of [1] is easily reproducible and some users would like to have the option to avoid it. However the solution, which is to adjust the virtual counter each time the VM transitions to the running state, introduces a different problem, which is that the virtual and physical counters diverge. As described in the cover letter of [1] this divergence is easily observed when comparing the output of date and hwclock after suspending the guest, waiting a while, and then resuming it. Because this different problem may actually be worse for some users, unlike [1], the series posted here makes the virtual counter adjustment optional. Besides the adjustment being optional, this series approaches the needed changes differently to apply them in more appropriate locations. Additional notes ---------------- Note 1 ------ As described above, when running a guest with kvm-no-adjtime disabled it will be less likely the guest OS and guest applications get surprise time jumps when they use the virtual counter. However the counter will no longer reflect real time. It will lag behind. If this is a problem then the guest can resynchronize its time from an external source or even from its physical counter. If the suspend/resume is done with libvirt's virsh, and the guest is running the guest agent, then it's also possible to use a sequence like this $ virsh suspend $GUEST $ virsh resume $GUEST $ virsh domtime --sync $GUEST in order to resynchronize a guest right after the resume. Of course there will still be time when the clock is not right, possibly creating confusing timestamps in logs, for example, and the guest must still be tolerant to the time synchronizations. Note 2 ------ Userspace that wants to set KVM_REG_ARM_TIMER_CNT should beware that the KVM register ID is not correct. This cannot be fixed because it's UAPI and if the UAPI headers are used then it can't be a problem. However, if a userspace attempts to create the ID themselves from the register's specification, then they will get KVM_REG_ARM_TIMER_CVAL instead, as the _CNT and _CVAL definitions have their register parameters swapped. Note 3 ------ I didn't test this with a 32-bit KVM host, but the changes to kvm32.c are the same as kvm64.c. So what could go wrong? Test results would be appreciated. [1] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg05713.html [2] https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg03695.html upstream url: https://patchwork.kernel.org/cover/11341629/ | 6 年前 | |
target/arm/kvm: Adjust virtual time v3: - Added a target/arm/kvm_arm.h comment cleanup patch (1/6) - Minor refactoring of assert_has_feature_enabled/disabled in 4/6, kept Richard's r-b. - Rewrote kvm-no-adjvtime documentation in 6/6. - Reworked approach in 5/6 to properly deal with migration and to track running vs. !running, rather than running vs. paused states. v2: - Reworked it enough that I brought back the RFC tag and retitled the series. Also had to drop r-b's from a couple of patches, and even drop patches. - Changed approach from writing the QEMU virtual time to the guest vtime counter to saving and restoring the guest vtime counter. - Changed the kvm-adjvtime property, which was off by default, to a kvm-no-adjvtime property, which is also off by default, meaning the effective "adjust vtime" property is now on by default (but only for 5.0 virt machine types and later) v1: - move from RFC status to v1 - put kvm_arm_vm_state_change() in kvm.c to share among kvm32.c and kvm64.c - add r-b's from Richard This series is inspired by a series[1] posted by Bijan Mottahedeh over a year ago and by the patch[2] posted by Heyi Guo almost a year ago. The problem described in the cover letter of [1] is easily reproducible and some users would like to have the option to avoid it. However the solution, which is to adjust the virtual counter each time the VM transitions to the running state, introduces a different problem, which is that the virtual and physical counters diverge. As described in the cover letter of [1] this divergence is easily observed when comparing the output of date and hwclock after suspending the guest, waiting a while, and then resuming it. Because this different problem may actually be worse for some users, unlike [1], the series posted here makes the virtual counter adjustment optional. Besides the adjustment being optional, this series approaches the needed changes differently to apply them in more appropriate locations. Additional notes ---------------- Note 1 ------ As described above, when running a guest with kvm-no-adjtime disabled it will be less likely the guest OS and guest applications get surprise time jumps when they use the virtual counter. However the counter will no longer reflect real time. It will lag behind. If this is a problem then the guest can resynchronize its time from an external source or even from its physical counter. If the suspend/resume is done with libvirt's virsh, and the guest is running the guest agent, then it's also possible to use a sequence like this $ virsh suspend $GUEST $ virsh resume $GUEST $ virsh domtime --sync $GUEST in order to resynchronize a guest right after the resume. Of course there will still be time when the clock is not right, possibly creating confusing timestamps in logs, for example, and the guest must still be tolerant to the time synchronizations. Note 2 ------ Userspace that wants to set KVM_REG_ARM_TIMER_CNT should beware that the KVM register ID is not correct. This cannot be fixed because it's UAPI and if the UAPI headers are used then it can't be a problem. However, if a userspace attempts to create the ID themselves from the register's specification, then they will get KVM_REG_ARM_TIMER_CVAL instead, as the _CNT and _CVAL definitions have their register parameters swapped. Note 3 ------ I didn't test this with a 32-bit KVM host, but the changes to kvm32.c are the same as kvm64.c. So what could go wrong? Test results would be appreciated. [1] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg05713.html [2] https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg03695.html upstream url: https://patchwork.kernel.org/cover/11341629/ | 6 年前 | |
arm/virt: Add ACPI CPU hotplug support This series is an attempt to provide CPU hotplug support on ARM virt platform. This is based on ACPI GED device. We should enable ACPI support, and use vGICv3 and 64bit CPU to support CPU hotplug. Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs is pre-created too. However, QEMU vCPU objects are defer-created. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
tests: Disable filemonitor testcase Since filemonitor testcase requires that host kernel being a LTS version, we cannot guarantee that on OBS system. Let's disable it by default. Signed-off-by: Ying Fang <fangying1@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> | 5 年前 | |
fix CVE-2021-20257/CVE-2020-13253 and fix gcc 10.3.1 compile error openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch | 4 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
patch: fix patch format problem which can lead git am failed Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> | 6 年前 | |
ARM virt: ACPI memory hotplug support This series is an attempt to provide device memory hotplug support on ARM virt platform. This is based on Eric's recent works here[1] and carries some of the pc-dimm related patches dropped from his series. The kernel support for arm64 memory hot add was added recently by Robin and hence the guest kernel should be => 5.0-rc1. NVDIM support is not included currently as we still have an unresolved issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches can be included, but not done for now, for keeping it simple. This makes use of GED device to sent hotplug ACPI events to the Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and Sebastien to add the hardware-reduced support to Nemu using GED device[3]. (Please shout if I got the author/signed-off wrong for those patches or missed any names). This is sanity tested on a HiSilicon ARM64 platform and appreciate any further testing. Note: Attempted adding dimm_pxm test case to bios-tables-test for arm/virt. But noticed the issue decribed here[5]. This is under investigation now. upstream url: https://patchwork.kernel.org/cover/11150345/ Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> | 6 年前 | |
fix CVE-2021-20196/CVE-2021-4207/CVE-2021-4206 (openeuler !289) hw/block/fdc: Extract blk_create_empty_drive() hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 tests/fdc-test: Add a regression test for CVE-2021-20196 display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) Signed-off-by: yezengruan <yezengruan@huawei.com> Signed-off-by: bobychen <boby.chen@huawei.com> | 4 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
tx_pkt: switch to use qemu_receive_packet_iov() for loopback Fix CVE-2021-3416 This patch switches to use qemu_receive_receive_iov() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
tz-ppc: add dummy read/write methods fix CVE-2020-15469 Add tz-ppc-dummy mmio read/write methods to avoid assert failure during initialisation. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
uas: add stream number sanity checks. The device uses the guest-supplied stream number unchecked, which can lead to guest-triggered out-of-band access to the UASDevice->data3 and UASDevice->status3 fields. Add the missing checks. Fixes: CVE-2021-3713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reported-by: Chen Zhe <chenzhe@huawei.com> Reported-by: Tan Jingguo <tanjingguo@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210818120505.1258262-2-kraxel@redhat.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2021-20196/CVE-2021-4207/CVE-2021-4206 (openeuler !289) hw/block/fdc: Extract blk_create_empty_drive() hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 tests/fdc-test: Add a regression test for CVE-2021-20196 display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) Signed-off-by: yezengruan <yezengruan@huawei.com> Signed-off-by: bobychen <boby.chen@huawei.com> | 4 年前 | |
fix cve-2021-3592 cve-2021-3593 cve-2021-3595 fix submodule slirp cve-2021-3592 cve-2021-3593 and cve-2021-3595 Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
usb: limit combined packets to 1 MiB (CVE-2021-3527) Fix CVE-2021-3527 usb-host and usb-redirect try to batch bulk transfers by combining many small usb packets into a single, large transfer request, to reduce the overhead and improve performance. This patch adds a size limit of 1 MiB for those combined packets to restrict the host resources the guest can bind that way. Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Message-Id: <20210503132915.2335822-6-kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
usbredir: fix free call data might point into the middle of a larger buffer, there is a separate free_on_destroy pointer passed into bufp_alloc() to handle that. It is only used in the normal workflow though, not when dropping packets due to the queue being full. Fix that. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/491 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210722072756.647673-1-kraxel@redhat.com> Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
Package init | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
vfio: add quirk device write method | 5 年前 | |
qemu: backport some bug fixing patches from upstream We backport some bug fixing patches form qemu-stable-4.1.1 branch of upstream. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Package init | 6 年前 | |
vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) Fix CVE-2021-3544 If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org> Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) Fix CVE-2021-3544 Otherwise some of the 'resp' will be leaked to guest. Fixes: CVE-2021-3545 Reported-by: default avatarLi Qiang <liq3ea@163.com> virtio-gpu fix: 42a8dadc ("virtio-gpu: fix information leak in getting capset info dispatch") Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-2-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) Fix CVE-2021-3544 Check whether the 'res' has already been attach_backing to avoid memory leak. Fixes: CVE-2021-3544 Reported-by: default avatarLi Qiang <liq3ea@163.com> virtio-gpu fix: 204f01b3 ("virtio-gpu: fix memory leak in resource attach backing") Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-4-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) Fix CVE-2021-3544 The 'res->iov' will be leaked if the guest trigger following sequences: virgl_cmd_create_resource_2d virgl_resource_attach_backing virgl_cmd_resource_unref This patch fixes this. Fixes: CVE-2021-3544 Reported-by: default avatarLi Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref" Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-6-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) Fix CVE-2021-3544 If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will be leaked. Fixes: CVE-2021-3544 Reported-by: default avatarLi Qiang <liq3ea@163.com> virtio-gpu fix: 33243031 ("virtio-gpu-3d: fix memory leak in resource attach backing") Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-7-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) Fix CVE-2021-3544 If the guest trigger following sequences, the attach_backing will be leaked: vg_resource_create_2d vg_resource_attach_backing vg_resource_unref This patch fix this by freeing 'res->iov' in vg_resource_destroy. Fixes: CVE-2021-3544 Reported-by: default avatarLi Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref") Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org> Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-5-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) Fix CVE-2021-3544 Call 'vugbm_buffer_destroy' in error path to avoid resource leak. Fixes: CVE-2021-3544 Reported-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org> Signed-off-by: default avatarLi Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau's avatarMarc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-3-liq3ea@163.com> Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Rebase qemu to 4.1.0 version Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2022-26354 and CVE-2022-26353 vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354) virtio-net: fix map leaking on error during receive (CVE-2022-26353) Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
virtio-balloon: apply upstream patch. Signed-off-by: Ming Yang <yangming73@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
fix CVE-2022-26354 and CVE-2022-26353 vhost-vsock: detach the virqueue element in case of error (CVE-2022-26354) virtio-net: fix map leaking on error during receive (CVE-2022-26353) Signed-off-by: yezengruan <yezengruan@huawei.com> | 4 年前 | |
virtio-net: fix use after unmap/free for sg When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues, E.g a use after free when the descriptor has an address which belongs to the non direct access region. In this case we use bounce buffer that is allocated during address_space_map() and freed during address_space_unmap(). Fixing this by storing the elems temporarily in an array and delay the unmap after we set the the num_buffers. This addresses CVE-2021-3748. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: fbe78f4f55c6 ("virtio-net support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: imxcc <xingchaochao@huawei.com> | 4 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
update code | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
vtimer: Drop vtimer virtual timer adjust This patch drops the vtimer virtual timer adjust, cross version migration from openEuler qemu-4.0.1 to qemu-4.1.0 is not supported as a consequence. By default openEuler qemu-4.1.0 use kvm_adjvtime as the virtual timer. Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
vtimer: compat cross version migration from v4.0.1 vtimer feature was added to qemu v4.0.1 to record timer tick when vcpu is stopped. However this feature is discared and the new virtual time adjustment is introduced. This patch add the missing vtimer parameter to ARMCPUState in order to compat cross version migration fromm v4.0.1 openEuler 2003 lts release. Singed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Backport: backport form upstream stable v4.1.1 This patch backports bugfix patch series from qemu upstream v4.1.1 Signed-off-by: Ying Fang <fangying1@huawei.com> | 6 年前 | |
Package init | 6 年前 | |
fix some issue for monitor and iscsi block/iscsi: use MIN() between mx_sb_len and sb_len_wr monitor: fix memory leak in monitor_fdset_dup_fd_find_remove Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> | 6 年前 | |
Package init | 6 年前 |