qemu/qemu.git, branch v2.2.0

Update version for v2.2.0 release

2014-12-09T12:13:37+00:00

Signed-off-by: Peter Maydell

Update version for v2.2.0-rc5 release

2014-12-04T15:51:22+00:00

Signed-off-by: Peter Maydell

Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging

2014-12-04T12:22:46+00:00

cirrus: fix blit region check # gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) " # gpg: aka "Gerd Hoffmann " # gpg: aka "Gerd Hoffmann (private) " * remotes/kraxel/tags/pull-cve-2014-8106-20141204-1: cirrus: don't overflow CirrusVGAState->cirrus_bltbuf cirrus: fix blit region check Signed-off-by: Peter Maydell

Update version for v2.2.0-rc4 release

2014-12-01T13:35:26+00:00

Signed-off-by: Peter Maydell

vhost: Fix vhostfd leak in error branch

2014-12-01T12:29:35+00:00

Signed-off-by: Gonglei Reviewed-by: Jason Wang Reviewed-by: Michael S. Tsirkin Message-id: 1417166789-1960-1-git-send-email-arei.gonglei@huawei.com Signed-off-by: Peter Maydell

cirrus: don't overflow CirrusVGAState->cirrus_bltbuf

2014-12-01T09:25:46+00:00

This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann

cirrus: fix blit region check

2014-12-01T09:25:12+00:00

Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini Signed-off-by: Gerd Hoffmann Reviewed-by: Paolo Bonzini

Fix for crash after migration in virtio-rng on bi-endian targets

2014-11-28T13:06:00+00:00

VirtIO devices now remember which endianness they're operating in in order to support targets which may have guests of either endianness, such as powerpc. This endianness state is transferred in a subsection of the virtio device's information. With virtio-rng this can lead to an abort after a loadvm hitting the assert() in virtio_is_big_endian(). This can be reproduced by doing a migrate and load from file on a bi-endian target with a virtio-rng device. The actual guest state isn't particularly important to triggering this. The cause is that virtio_rng_load_device() calls virtio_rng_process() which accesses the ring and thus needs the endianness. However, virtio_rng_process() is called via virtio_load() before it loads the subsections. Essentially the ->load callback in VirtioDeviceClass should only be used for actually reading the device state from the stream, not for post-load re-initialization. This patch fixes the bug by moving the virtio_rng_process() after the call to virtio_load(). Better yet would be to convert virtio to use vmsd and have the virtio_rng_process() as a post_load callback, but that's a bigger project for another day. This is bugfix, and should be considered for the 2.2 branch. Signed-off-by: David Gibson Reviewed-by: Greg Kurz Message-id: 1417067290-20715-1-git-send-email-david@gibson.dropbear.id.au Signed-off-by: Peter Maydell

virtio-net: fix unmap leak

2014-11-28T10:29:20+00:00

virtio_net_handle_ctrl() and other functions that process control vq request call iov_discard_front() which will shorten the iov. This will lead unmapping in virtqueue_push() leaks mapping. Fixes this by keeping the original iov untouched and using a temp variable in those functions. Cc: Wen Congyang Cc: Stefano Stabellini Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang Reviewed-by: Stefano Stabellini Reviewed-by: Fam Zheng Reviewed-by: Michael S. Tsirkin Message-id: 1417082643-23907-1-git-send-email-jasowang@redhat.com Signed-off-by: Peter Maydell

hmp: fix regression of HMP device_del auto-completion

2014-11-27T14:36:20+00:00

The commits: - 6a1fa9f5 (monitor: add del completion for peripheral device) - 66e56b13 (qdev: add qdev_build_hotpluggable_device_list helper) cause a QEMU crash when trying to use HMP device_del auto-completion. It can be easily reproduced by: -enable-kvm ~/images/fedora.qcow2 -monitor stdio -device virtio-net-pci,id=vnet (qemu) device_del /home/mapfelba/git/upstream/qemu/hw/core/qdev.c:941:qdev_build_hotpluggable_device_list: Object 0x7f6ce04e4fe0 is not an instance of type device Aborted (core dumped) The root cause is qdev_build_hotpluggable_device_list going recursively over all peripherals and their children assuming all are devices. It doesn't work since PCI devices have at least on child which is a memory region (bus master). Solved by observing that all devices appear as direct children of /machine/peripheral container. No need of going recursively over all the children. Signed-off-by: Marcel Apfelbaum Reported-by: Gal Hammer Reviewed-by: Igor Mammedov Message-id: 1417002601-20799-1-git-send-email-marcel.a@redhat.com Signed-off-by: Peter Maydell