qemu/qemu.git, branch v2.4.0.1

Update version for 2.4.0.1 release

2015-09-22T21:53:29+00:00

Signed-off-by: Michael Roth

net: avoid infinite loop when receiving packets(CVE-2015-5278)

2015-09-21T22:04:22+00:00

Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, leading to an infinite loop situation. Reported-by: Qinghao Tang Signed-off-by: P J P Signed-off-by: Stefan Hajnoczi (cherry picked from commit 737d2b3c41d59eb8f94ab7eb419b957938f24943) Signed-off-by: Michael Roth

net: add checks to validate ring buffer pointers(CVE-2015-5279)

2015-09-21T22:04:14+00:00

Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, which could lead to a memory buffer overflow. Added other checks at initialisation. Reported-by: Qinghao Tang Signed-off-by: P J P Signed-off-by: Stefan Hajnoczi (cherry picked from commit 9bbdbc66e5765068dce76e9269dce4547afd8ad4) Signed-off-by: Michael Roth

e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)

2015-09-21T22:04:05+00:00

While processing transmit descriptors, it could lead to an infinite loop if 'bytes' was to become zero; Add a check to avoid it. [The guest can force 'bytes' to 0 by setting the hdr_len and mss descriptor fields to 0. --Stefan] Signed-off-by: P J P Signed-off-by: Stefan Hajnoczi Reviewed-by: Thomas Huth Message-id: 1441383666-6590-1-git-send-email-stefanha@redhat.com (cherry picked from commit b947ac2bf26479e710489739c465c8af336599e7) Signed-off-by: Michael Roth

vnc: fix memory corruption (CVE-2015-5225)

2015-09-21T22:03:16+00:00

The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential memory corruption issues" can become negative. Result is (possibly exploitable) memory corruption. Reason for that is it uses the stride instead of bytes per scanline to apply limits. For the server surface is is actually fine. vnc creates that itself, there is never any padding and thus scanline length always equals stride. For the guest surface scanline length and stride are typically identical too, but it doesn't has to be that way. So add and use a new variable (guest_ll) for the guest scanline length. Also rename min_stride to line_bytes to make more clear what it actually is. Finally sprinkle in an assert() to make sure we never use a negative _cmp_bytes again. Reported-by: 范祚至(库特) Reviewed-by: P J P Signed-off-by: Gerd Hoffmann (cherry picked from commit eb8934b0418b3b1d125edddc4fc334a54334a49b) Signed-off-by: Michael Roth

Update version for v2.4.0 release

2015-08-11T14:30:34+00:00

Signed-off-by: Peter Maydell

Update version for v2.4.0-rc4 release

2015-08-05T16:02:58+00:00

Signed-off-by: Peter Maydell

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

2015-08-05T15:02:00+00:00

virtio fix for 2.4 Fixes migration in virtio 1 mode. We still have a known bug with memory hotplug, it doesn't look like we can fix that in time for 2.4. Signed-off-by: Michael S. Tsirkin # gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin " # gpg: aka "Michael S. Tsirkin " * remotes/mst/tags/for_upstream: virtio: fix 1.0 virtqueue migration Signed-off-by: Peter Maydell

block: don't register quorum driver if SHA256 support is unavailable

2015-08-05T14:19:32+00:00

Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs] broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a compile-time check to a run-time check at device open time. The result is that we now advertise a feature (the quorum block driver) that will never work (on those hosts). There's no way (short of parsing human-readable error messages) for qemu-iotests or any other API consumer to recognise that the quorum block driver isn't _actually_ available and shouldn't be used or tested. Move the run-time check to bdrv_quorum_init() to avoid registering the quorum block driver if we know it cannot work. This way API consumers can recognise it's unavailable. Fixes: 488981a4af396551a3178d032cc2b41d9553ada2 Signed-off-by: Sascha Silbe Reviewed-by: Eric Blake Reviewed-by: Daniel P. Berrange Reviewed-by: Alberto Garcia Message-id: 1438699705-21761-1-git-send-email-silbe@linux.vnet.ibm.com Signed-off-by: Peter Maydell

virtio: fix 1.0 virtqueue migration

2015-08-05T13:56:34+00:00

1.0 does not requires physically-contiguous pages layout for a virtqueue. So we could not infer avail and used from desc. This means we need to migrate vring.avail and vring.used when host support virtio 1.0. This fixes malfunction of virtio 1.0 device after migration. Cc: Michael S. Tsirkin Cc: Cornelia Huck Cc: Dr. David Alan Gilbert Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin