[Qemu-devel] [PULL 0/3] Ui 20180518 patches

[Qemu-devel] [PULL 0/3] Ui 20180518 patches

[Gerd Hoffmann]

The following changes since commit a4207e3b00e89f934adb231057dcf9a75ac2ae45:

  Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-05-17 11:59:50 +0100)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/ui-20180518-pull-request

for you to fetch changes up to e8dcb8ae5121965ac8c89e6b277ac127e9d08452:

  sdl: Move use of surface pointer below check for whether it is NULL (2018-05-18 09:14:24 +0200)

----------------------------------------------------------------
ui: bugfixes, move x11 dependency to modules.

----------------------------------------------------------------

Michal Privoznik (1):
  console: Avoid segfault in screendump

Paolo Bonzini (1):
  ui: add x_keymap.o to modules

Peter Maydell (1):
  sdl: Move use of surface pointer below check for whether it is NULL

 ui/console.c             |  5 +++++
 ui/sdl2-2d.c             |  6 +++---
 hw/display/Makefile.objs |  2 ++
 ui/Makefile.objs         | 11 +++++++----
 4 files changed, 17 insertions(+), 7 deletions(-)

-- 
2.9.3

[Qemu-devel] [PULL 1/3] console: Avoid segfault in screendump

[Gerd Hoffmann]

From: Michal Privoznik <mprivozn@redhat.com>

After f771c5440e04626f1 it is possible to select device and
head which to take screendump from. And even though we check if
provided head number falls within range, it may still happen that
the console has no surface yet leading to SIGSEGV:

  qemu.git $ ./x86_64-softmmu/qemu-system-x86_64 \
    -qmp stdio \
    -device virtio-vga,id=video0,max_outputs=4

  {"execute":"qmp_capabilities"}
  {"execute":"screendump", "arguments":{"filename":"/tmp/screen.ppm", "device":"video0", "head":1}}
  Segmentation fault

 #0  0x00005628249dda88 in ppm_save (filename=0x56282826cbc0 "/tmp/screen.ppm", ds=0x0, errp=0x7fff52a6fae0) at ui/console.c:304
 #1  0x00005628249ddd9b in qmp_screendump (filename=0x56282826cbc0 "/tmp/screen.ppm", has_device=true, device=0x5628276902d0 "video0", has_head=true, head=1, errp=0x7fff52a6fae0) at ui/console.c:375
 #2  0x00005628247740df in qmp_marshal_screendump (args=0x562828265e00, ret=0x7fff52a6fb68, errp=0x7fff52a6fb60) at qapi/qapi-commands-ui.c:110

Here, @ds from frame #0 (or @surface from frame #1) is
dereferenced at the very beginning of ppm_save(). And because
it's NULL crash happens.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: cb05bb1909daa6ba62145c0194aafa05a14ed3d1.1526569138.git.mprivozn@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/console.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ui/console.c b/ui/console.c
index 945f05d728..ef1247f872 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -372,6 +372,11 @@ void qmp_screendump(const char *filename, bool has_device, const char *device,
 
     graphic_hw_update(con);
     surface = qemu_console_surface(con);
+    if (!surface) {
+        error_setg(errp, "no surface");
+        return;
+    }
+
     ppm_save(filename, surface, errp);
 }
 
-- 
2.9.3

[Qemu-devel] [PULL 2/3] ui: add x_keymap.o to modules

[Gerd Hoffmann]

From: Paolo Bonzini <pbonzini@redhat.com>

x_keymap.o is common to the SDL and GTK+ modules, and it causes the
QEMU binary to link to the X11 libraries.  Add it separately to the
modules to keep the main QEMU binary smaller.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1526560782-18732-1-git-send-email-pbonzini@redhat.com

[ kraxel: fix lm32 target build (milkymist-tmu2) ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/Makefile.objs |  2 ++
 ui/Makefile.objs         | 11 +++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index 3c7c75b94d..11321e466b 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -20,6 +20,8 @@ common-obj-$(CONFIG_MILKYMIST) += milkymist-vgafb.o
 common-obj-$(CONFIG_ZAURUS) += tc6393xb.o
 
 common-obj-$(CONFIG_MILKYMIST_TMU2) += milkymist-tmu2.o
+milkymist-tmu2.o-cflags := $(X11_CFLAGS)
+milkymist-tmu2.o-libs := $(X11_LIBS)
 
 obj-$(CONFIG_OMAP) += omap_dss.o
 obj-$(CONFIG_OMAP) += omap_lcdc.o
diff --git a/ui/Makefile.objs b/ui/Makefile.objs
index cc784346cb..00f6976c30 100644
--- a/ui/Makefile.objs
+++ b/ui/Makefile.objs
@@ -15,10 +15,6 @@ common-obj-$(CONFIG_COCOA) += cocoa.o
 common-obj-$(CONFIG_VNC) += $(vnc-obj-y)
 common-obj-$(call lnot,$(CONFIG_VNC)) += vnc-stubs.o
 
-common-obj-$(CONFIG_X11) += x_keymap.o
-x_keymap.o-cflags := $(X11_CFLAGS)
-x_keymap.o-libs := $(X11_LIBS)
-
 # ui-sdl module
 common-obj-$(CONFIG_SDL) += sdl.mo
 ifeq ($(CONFIG_SDLABI),1.2)
@@ -46,6 +42,13 @@ gtk.mo-objs += gtk-gl-area.o
 endif
 endif
 
+ifeq ($(CONFIG_X11),y)
+sdl.mo-objs += x_keymap.o
+gtk.mo-objs += x_keymap.o
+x_keymap.o-cflags := $(X11_CFLAGS)
+x_keymap.o-libs := $(X11_LIBS)
+endif
+
 common-obj-$(CONFIG_CURSES) += curses.mo
 curses.mo-objs := curses.o
 curses.mo-cflags := $(CURSES_CFLAGS)
-- 
2.9.3

[Qemu-devel] [PULL 3/3] sdl: Move use of surface pointer below check for whether it is NULL

[Gerd Hoffmann]

From: Peter Maydell <peter.maydell@linaro.org>

In commit 2ab858c6c38ee1 we added a use of the 'surf' variable
in sdl2_2d_update() that was unfortunately placed above the
early-exit-if-NULL check. Move it to where it ought to be.

Fixes: Coverity CID 1390598
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180515185814.1374-1-peter.maydell@linaro.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/sdl2-2d.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ui/sdl2-2d.c b/ui/sdl2-2d.c
index 1f34817bae..85484407be 100644
--- a/ui/sdl2-2d.c
+++ b/ui/sdl2-2d.c
@@ -36,9 +36,7 @@ void sdl2_2d_update(DisplayChangeListener *dcl,
     struct sdl2_console *scon = container_of(dcl, struct sdl2_console, dcl);
     DisplaySurface *surf = qemu_console_surface(dcl->con);
     SDL_Rect rect;
-    size_t surface_data_offset = surface_bytes_per_pixel(surf) * x +
-                                 surface_stride(surf) * y;
-
+    size_t surface_data_offset;
     assert(!scon->opengl);
 
     if (!surf) {
@@ -48,6 +46,8 @@ void sdl2_2d_update(DisplayChangeListener *dcl,
         return;
     }
 
+    surface_data_offset = surface_bytes_per_pixel(surf) * x +
+                          surface_stride(surf) * y;
     rect.x = x;
     rect.y = y;
     rect.w = w;
-- 
2.9.3

Re: [Qemu-devel] [PULL 0/3] Ui 20180518 patches

[Peter Maydell]

On 18 May 2018 at 08:40, Gerd Hoffmann <kraxel@redhat.com> wrote:
> The following changes since commit a4207e3b00e89f934adb231057dcf9a75ac2ae45:
>
>   Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-05-17 11:59:50 +0100)
>
> are available in the git repository at:
>
>   git://git.kraxel.org/qemu tags/ui-20180518-pull-request
>
> for you to fetch changes up to e8dcb8ae5121965ac8c89e6b277ac127e9d08452:
>
>   sdl: Move use of surface pointer below check for whether it is NULL (2018-05-18 09:14:24 +0200)
>
> ----------------------------------------------------------------
> ui: bugfixes, move x11 dependency to modules.
>
> ----------------------------------------------------------------
>

Applied, thanks.

-- PMM