* [PULL 1/3] checkpatch: typo fix
2022-11-10 21:06 [PULL 0/3] pc,virtio: regression fixes Michael S. Tsirkin
@ 2022-11-10 21:06 ` Michael S. Tsirkin
2022-11-10 21:06 ` [PULL 2/3] display: include dependencies explicitly Michael S. Tsirkin
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2022-11-10 21:06 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Philippe Mathieu-Daudé,
Marc-André Lureau, Richard Henderson, Paolo Bonzini,
Laurent Vivier
remove inline #inline - it's an obvious typo. Should just be remove
inline.
Fixes: 1ef47f40dc ("checkpatch: better pattern for inline comments")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221108135155.1121566-1-mst@redhat.com>
---
scripts/checkpatch.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index bc7d4780ec..6ecabfb2b5 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1682,7 +1682,7 @@ sub process {
# Block comments use /* on a line of its own
my $commentline = $rawline;
- while ($commentline =~ s@^(\+.*)/\*.*\*/@$1@o) { # remove inline #inline /*...*/
+ while ($commentline =~ s@^(\+.*)/\*.*\*/@$1@o) { # remove inline /*...*/
}
if ($commentline =~ m@^\+.*/\*\*?+[ \t]*[^ \t]@) { # /* or /** non-blank
WARN("Block comments use a leading /* on a separate line\n" . $herecurr);
--
MST
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PULL 2/3] display: include dependencies explicitly
2022-11-10 21:06 [PULL 0/3] pc,virtio: regression fixes Michael S. Tsirkin
2022-11-10 21:06 ` [PULL 1/3] checkpatch: typo fix Michael S. Tsirkin
@ 2022-11-10 21:06 ` Michael S. Tsirkin
2022-11-10 21:06 ` [PULL 3/3] virtio-net: fix for heap-buffer-overflow Michael S. Tsirkin
2022-11-12 2:32 ` [PULL 0/3] pc,virtio: regression fixes Stefan Hajnoczi
3 siblings, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2022-11-10 21:06 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Laurent Vivier, Miroslav Rezanina, Frederic Bezies,
Philippe Mathieu-Daudé, Gerd Hoffmann
acpi-vga-stub.c pulls in vga_int.h
However that currently pulls in ui/console.h which
breaks e.g. on systems without pixman.
It's better to remove ui/console.h from vga_int.h
and directly include it where it's used.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221109222112.74519-1-mst@redhat.com>
Tested-by: Laurent Vivier <lvivier@redhat.com>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reported-by: Frederic Bezies <fredbezies@gmail.com>
Reported-by: Laurent Vivier <lvivier@redhat.com>
Fixes: cfead31326 ("AcpiDevAmlIf interface to build VGA device descs")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/display/vga_int.h | 1 -
include/qemu/typedefs.h | 2 ++
hw/display/ati_2d.c | 1 +
hw/display/cirrus_vga.c | 1 +
hw/display/cirrus_vga_isa.c | 1 +
hw/display/vga-isa.c | 1 +
hw/display/vga-mmio.c | 1 +
hw/display/vga-pci.c | 1 +
hw/display/vga.c | 1 +
hw/display/vmware_vga.c | 1 +
10 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index 330406ad9c..7cf0d11201 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -27,7 +27,6 @@
#include "exec/ioport.h"
#include "exec/memory.h"
-#include "ui/console.h"
#include "hw/display/bochs-vbe.h"
#include "hw/acpi/acpi_aml_interface.h"
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index 6d4e6d9708..688408e048 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -132,6 +132,8 @@ typedef struct Visitor Visitor;
typedef struct VMChangeStateEntry VMChangeStateEntry;
typedef struct VMStateDescription VMStateDescription;
typedef struct DumpState DumpState;
+typedef struct GraphicHwOps GraphicHwOps;
+typedef struct QEMUCursor QEMUCursor;
/*
* Pointer types
diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index 692bec91de..7d786653e8 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -12,6 +12,7 @@
#include "ati_regs.h"
#include "qemu/log.h"
#include "ui/pixel_ops.h"
+#include "ui/console.h"
/*
* NOTE:
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index c1e719a405..6e8c747c46 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -45,6 +45,7 @@
#include "ui/pixel_ops.h"
#include "cirrus_vga_internal.h"
#include "qom/object.h"
+#include "ui/console.h"
/*
* TODO:
diff --git a/hw/display/cirrus_vga_isa.c b/hw/display/cirrus_vga_isa.c
index 96144bd690..84be51670e 100644
--- a/hw/display/cirrus_vga_isa.c
+++ b/hw/display/cirrus_vga_isa.c
@@ -31,6 +31,7 @@
#include "hw/isa/isa.h"
#include "cirrus_vga_internal.h"
#include "qom/object.h"
+#include "ui/console.h"
#define TYPE_ISA_CIRRUS_VGA "isa-cirrus-vga"
OBJECT_DECLARE_SIMPLE_TYPE(ISACirrusVGAState, ISA_CIRRUS_VGA)
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 46abbc5653..2a5437d803 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -32,6 +32,7 @@
#include "qemu/timer.h"
#include "hw/loader.h"
#include "hw/qdev-properties.h"
+#include "ui/console.h"
#include "qom/object.h"
#define TYPE_ISA_VGA "isa-vga"
diff --git a/hw/display/vga-mmio.c b/hw/display/vga-mmio.c
index 75dfcedea5..cd2c46776d 100644
--- a/hw/display/vga-mmio.c
+++ b/hw/display/vga-mmio.c
@@ -27,6 +27,7 @@
#include "hw/sysbus.h"
#include "hw/display/vga.h"
#include "hw/qdev-properties.h"
+#include "ui/console.h"
#include "vga_int.h"
/*
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 9a91de7ed1..df23dbf3a0 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -30,6 +30,7 @@
#include "migration/vmstate.h"
#include "vga_int.h"
#include "ui/pixel_ops.h"
+#include "ui/console.h"
#include "qemu/module.h"
#include "qemu/timer.h"
#include "hw/loader.h"
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 50ecb1ad02..0cb26a791b 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -31,6 +31,7 @@
#include "vga_int.h"
#include "vga_regs.h"
#include "ui/pixel_ops.h"
+#include "ui/console.h"
#include "qemu/timer.h"
#include "hw/xen/xen.h"
#include "migration/vmstate.h"
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index cedbbde522..53949d2539 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -33,6 +33,7 @@
#include "hw/qdev-properties.h"
#include "migration/vmstate.h"
#include "qom/object.h"
+#include "ui/console.h"
#undef VERBOSE
#define HW_RECT_ACCEL
--
MST
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PULL 3/3] virtio-net: fix for heap-buffer-overflow
2022-11-10 21:06 [PULL 0/3] pc,virtio: regression fixes Michael S. Tsirkin
2022-11-10 21:06 ` [PULL 1/3] checkpatch: typo fix Michael S. Tsirkin
2022-11-10 21:06 ` [PULL 2/3] display: include dependencies explicitly Michael S. Tsirkin
@ 2022-11-10 21:06 ` Michael S. Tsirkin
2022-11-12 2:32 ` [PULL 0/3] pc,virtio: regression fixes Stefan Hajnoczi
3 siblings, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2022-11-10 21:06 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Xuan Zhuo, Alexander Bulekov, Jason Wang
From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Run shell script:
cat << EOF | valgrind qemu-system-i386 -display none -machine accel=qtest, -m \
512M -M q35 -nodefaults -device virtio-net,netdev=net0 -netdev \
user,id=net0 -qtest stdio
outl 0xcf8 0x80000810
outl 0xcfc 0xc000
outl 0xcf8 0x80000804
outl 0xcfc 0x01
outl 0xc00d 0x0200
outl 0xcf8 0x80000890
outb 0xcfc 0x4
outl 0xcf8 0x80000889
outl 0xcfc 0x1c000000
outl 0xcf8 0x80000893
outw 0xcfc 0x100
EOF
Got:
==68666== Invalid read of size 8
==68666== at 0x688536: virtio_net_queue_enable (virtio-net.c:575)
==68666== by 0x6E31AE: memory_region_write_accessor (memory.c:492)
==68666== by 0x6E098D: access_with_adjusted_size (memory.c:554)
==68666== by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
==68666== by 0x6E31AE: memory_region_write_accessor (memory.c:492)
==68666== by 0x6E098D: access_with_adjusted_size (memory.c:554)
==68666== by 0x6E4DB3: memory_region_dispatch_write (memory.c:1521)
==68666== by 0x6EBCD3: flatview_write_continue (physmem.c:2820)
==68666== by 0x6EBFBF: flatview_write (physmem.c:2862)
==68666== by 0x6EF5E7: address_space_write (physmem.c:2958)
==68666== by 0x6DFDEC: cpu_outw (ioport.c:70)
==68666== by 0x6F6DF0: qtest_process_command (qtest.c:480)
==68666== Address 0x29087fe8 is 24 bytes after a block of size 416 in arena "client"
That is reported by Alexander Bulekov. https://gitlab.com/qemu-project/qemu/-/issues/1309
Here, the queue_index is the index of the cvq, but in some cases cvq
does not have the corresponding NetClientState, so overflow appears.
I add a check here, ignore illegal queue_index and cvq queue_index.
Note the queue_index is below the VIRTIO_QUEUE_MAX but greater or equal
than cvq index could hit this. Other devices are similar.
Fixes: 7f863302 ("virtio-net: support queue_enable")
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1309
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Message-Id: <20221110095739.130393-1-xuanzhuo@linux.alibaba.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
include/hw/virtio/virtio.h | 2 ++
hw/net/virtio-net.c | 18 ++++++++++++++++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 141a253a2c..a973811cbf 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -148,7 +148,9 @@ struct VirtioDeviceClass {
void (*set_config)(VirtIODevice *vdev, const uint8_t *config);
void (*reset)(VirtIODevice *vdev);
void (*set_status)(VirtIODevice *vdev, uint8_t val);
+ /* Device must validate queue_index. */
void (*queue_reset)(VirtIODevice *vdev, uint32_t queue_index);
+ /* Device must validate queue_index. */
void (*queue_enable)(VirtIODevice *vdev, uint32_t queue_index);
/* For transitional devices, this is a bitmap of features
* that are only exposed on the legacy interface but not
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 8b32339b76..aba12759d5 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -549,7 +549,14 @@ static RxFilterInfo *virtio_net_query_rxfilter(NetClientState *nc)
static void virtio_net_queue_reset(VirtIODevice *vdev, uint32_t queue_index)
{
VirtIONet *n = VIRTIO_NET(vdev);
- NetClientState *nc = qemu_get_subqueue(n->nic, vq2q(queue_index));
+ NetClientState *nc;
+
+ /* validate queue_index and skip for cvq */
+ if (queue_index >= n->max_queue_pairs * 2) {
+ return;
+ }
+
+ nc = qemu_get_subqueue(n->nic, vq2q(queue_index));
if (!nc->peer) {
return;
@@ -566,9 +573,16 @@ static void virtio_net_queue_reset(VirtIODevice *vdev, uint32_t queue_index)
static void virtio_net_queue_enable(VirtIODevice *vdev, uint32_t queue_index)
{
VirtIONet *n = VIRTIO_NET(vdev);
- NetClientState *nc = qemu_get_subqueue(n->nic, vq2q(queue_index));
+ NetClientState *nc;
int r;
+ /* validate queue_index and skip for cvq */
+ if (queue_index >= n->max_queue_pairs * 2) {
+ return;
+ }
+
+ nc = qemu_get_subqueue(n->nic, vq2q(queue_index));
+
if (!nc->peer || !vdev->vhost_started) {
return;
}
--
MST
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PULL 0/3] pc,virtio: regression fixes
2022-11-10 21:06 [PULL 0/3] pc,virtio: regression fixes Michael S. Tsirkin
` (2 preceding siblings ...)
2022-11-10 21:06 ` [PULL 3/3] virtio-net: fix for heap-buffer-overflow Michael S. Tsirkin
@ 2022-11-12 2:32 ` Stefan Hajnoczi
3 siblings, 0 replies; 5+ messages in thread
From: Stefan Hajnoczi @ 2022-11-12 2:32 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: qemu-devel, Peter Maydell
[-- Attachment #1: Type: text/plain, Size: 115 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/7.2 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread