qemu/qemu.git, branch v7.0.0

Update version for v7.0.0 release

2022-04-19T17:44:36+00:00

Signed-off-by: Peter Maydell

Update version for v7.0.0-rc4 release

2022-04-12T16:01:34+00:00

Signed-off-by: Peter Maydell

virtio-iommu: use-after-free fix

2022-04-08T14:02:09+00:00

A potential Use-after-free was reported in virtio_iommu_handle_command when using virtio-iommu: > I find a potential Use-after-free in QEMU 6.2.0, which is in > virtio_iommu_handle_command() (./hw/virtio/virtio-iommu.c). > > > Specifically, in the loop body, the variable 'buf' allocated at line 639 can be > freed by g_free() at line 659. However, if the execution path enters the loop > body again and the if branch takes true at line 616, the control will directly > jump to 'out' at line 651. At this time, 'buf' is a freed pointer, which is not > assigned with an allocated memory but used at line 653. As a result, a UAF bug > is triggered. > > > > 599 for (;;) { > ... > 615 sz = iov_to_buf(iov, iov_cnt, 0, &head, sizeof(head)); > 616 if (unlikely(sz != sizeof(head))) { > 617 tail.status = VIRTIO_IOMMU_S_DEVERR; > 618 goto out; > 619 } > ... > 639 buf = g_malloc0(output_size); > ... > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > > We can fix it by set ‘buf‘ to NULL after freeing it: > > > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > +++ buf = NULL; > 660 } Fix as suggested by the reporter. Signed-off-by: Wentao Liang Signed-off-by: Michael S. Tsirkin Message-id: 20220407095047.50371-1-mst@redhat.com Message-ID: <20220406040445-mutt-send-email-mst@kernel.org> Signed-off-by: Peter Maydell

Merge tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu into staging

2022-04-08T09:43:30+00:00

two cursor/qxl related security fixes. # gpg: Signature made Fri 08 Apr 2022 05:37:16 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) " [full] # gpg: aka "Gerd Hoffmann " [full] # gpg: aka "Gerd Hoffmann (private) " [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu: ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) Signed-off-by: Peter Maydell

ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)

2022-04-07T10:30:54+00:00

Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella Reviewed-by: Marc-André Lureau Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann

display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)

2022-04-07T10:30:54+00:00

Avoid fetching 'width' and 'height' a second time to prevent possible race condition. Refer to security advisory https://starlabs.sg/advisories/22-4207/ for more information. Fixes: CVE-2021-4207 Signed-off-by: Mauro Matteo Cascella Reviewed-by: Marc-André Lureau Message-Id: <20220407081106.343235-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann

Update version for v7.0.0-rc3 release

2022-04-06T20:26:13+00:00

Signed-off-by: Peter Maydell

acpi: fix acpi_index migration

2022-04-06T19:03:26+00:00

vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState as state but it actually received PIIX4PMState, because VMSTATE_PCI_HOTPLUG is a macro and not another struct. So it ended up accessing random pointer, which resulted in 'false' return value and acpi_index field wasn't ever sent. However in 7.0 that pointer de-references to value > 0, and destination QEMU starts to expect the field which isn't sent in migratioon stream from older QEMU (6.2 and older). As result migration fails with: qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm qemu-system-x86_64: load of migration failed: Invalid argument In addition with QEMU-6.2, destination due to not expected state, also never expects the acpi_index field in migration stream. Q35 is not affected as it always sends/expects the field as long as acpi based PCI hotplug is enabled. Fix issue by introducing compat knob to never send/expect acpi_index in migration stream for 6.2 and older PC machine types and always send it for 7.0 and newer PC machine types. Diagnosed-by: Dr. David Alan Gilbert Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932 Signed-off-by: Igor Mammedov Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Peter Maydell

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

2022-04-05T15:14:28+00:00

* fix vss-win32 compilation with clang++ * update Coverity model * add measurement calculation to amd-memory-encryption docs # gpg: Signature made Tue 05 Apr 2022 09:42:59 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini " [full] # gpg: aka "Paolo Bonzini " [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: docs/system/i386: Add measurement calculation details to amd-memory-encryption qga/vss-win32: fix compilation with clang++ coverity: update model for latest tools Signed-off-by: Peter Maydell

Merge tag 'pull-qapi-2022-04-05' of git://repo.or.cz/qemu/armbru into staging

2022-04-05T13:02:01+00:00

QAPI patches patches for 2022-04-05 # gpg: Signature made Tue 05 Apr 2022 11:32:05 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster " [full] # gpg: aka "Markus Armbruster " [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-qapi-2022-04-05' of git://repo.or.cz/qemu/armbru: qapi: Fix calc-dirty-rate example qapi: fix example of query-memdev command qapi: fix example of query-cpus-fast command qapi: fix example of trace-event-get-state command qapi: fix example of query-colo-status command qapi: fix example of query-vnc command qapi: fix example of query-spice command qapi: fix example of query-named-block-nodes command qapi: fix examples: replay-break and replay-seek qapi: fix example of netdev_add command Signed-off-by: Peter Maydell