Skip to content
Snippets Groups Projects
  1. May 03, 2022
  2. Apr 06, 2022
  3. Feb 14, 2022
    • Peter Foley's avatar
      net: Fix uninitialized data usage · e29919c9
      Peter Foley authored
      
      e.g.
      1109 15:16:20.151506 Uninitialized bytes in ioctl_common_pre at offset 0 inside [0x7ffc516af9b8, 4)
       1109 15:16:20.151659 ==588974==WARNING: MemorySanitizer: use-of-uninitialized-value
       1109 15:16:20.312923     #0 0x5639b88acb21 in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c:183:9
       1109 15:16:20.312952     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
       1109 15:16:20.312954     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
       1109 15:16:20.312956     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
       1109 15:16:20.312957     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
       1109 15:16:20.312958     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
       1109 15:16:20.312960     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
       1109 15:16:20.312961     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
       1109 15:16:20.312962     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
       1109 15:16:20.312964     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
       1109 15:16:20.312965     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
       1109 15:16:20.312967     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
       1109 15:16:20.312968     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
       1109 15:16:20.312969     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
       1109 15:16:20.312970
       1109 15:16:20.312975   Uninitialized value was stored to memory at
       1109 15:16:20.313393     #0 0x5639b88acbee in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c
       1109 15:16:20.313396     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
       1109 15:16:20.313398     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
       1109 15:16:20.313399     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
       1109 15:16:20.313400     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
       1109 15:16:20.313401     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
       1109 15:16:20.313403     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
       1109 15:16:20.313404     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
       1109 15:16:20.313405     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
       1109 15:16:20.313407     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
       1109 15:16:20.313408     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
       1109 15:16:20.313409     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
       1109 15:16:20.313410     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
       1109 15:16:20.313412     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
       1109 15:16:20.313413
       1109 15:16:20.313417   Uninitialized value was stored to memory at
       1109 15:16:20.313791     #0 0x5639b88affbd in net_tap_fd_init third_party/qemu/net/tap.c:400:26
       1109 15:16:20.313826     #1 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
       1109 15:16:20.313829     #2 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
       1109 15:16:20.313831     #3 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
       1109 15:16:20.313836     #4 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
       1109 15:16:20.313838     #5 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
       1109 15:16:20.313839     #6 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
       1109 15:16:20.313841     #7 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
       1109 15:16:20.313843     #8 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
       1109 15:16:20.313844     #9 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
       1109 15:16:20.313845     #10 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
       1109 15:16:20.313846     #11 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
       1109 15:16:20.313847     #12 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
       1109 15:16:20.313849
       1109 15:16:20.313851   Uninitialized value was created by an allocation of 'ifr' in the stack frame of function 'tap_probe_vnet_hdr'
       1109 15:16:20.313855     #0 0x5639b88ac680 in tap_probe_vnet_hdr third_party/qemu/net/tap-linux.c:151
       1109 15:16:20.313856
       1109 15:16:20.313878 SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/qemu/net/tap-linux.c:183:9 in tap_probe_vnet_hdr_len
      
      Fixes: dc69004c ("net: move tap_probe_vnet_hdr() to tap-linux.c")
      Reviewed-by: default avatarHao Wu <wuhaotsh@google.com>
      Reviewed-by: default avatarPatrick Venture <venture@google.com>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Signed-off-by: default avatarPeter Foley <pefoley@google.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      e29919c9
  4. Jun 04, 2021
  5. Jul 15, 2020
    • Daniel P. Berrangé's avatar
      net: detect errors from probing vnet hdr flag for TAP devices · e7b347d0
      Daniel P. Berrangé authored
      
      When QEMU sets up a tap based network device backend, it mostly ignores errors
      reported from various ioctl() calls it makes, assuming the TAP file descriptor
      is valid. This assumption can easily be violated when the user is passing in a
      pre-opened file descriptor. At best, the ioctls may fail with a -EBADF, but if
      the user passes in a bogus FD number that happens to clash with a FD number that
      QEMU has opened internally for another reason, a wide variety of errnos may
      result, as the TUNGETIFF ioctl number may map to a completely different command
      on a different type of file.
      
      By ignoring all these errors, QEMU sets up a zombie network backend that will
      never pass any data. Even worse, when QEMU shuts down, or that network backend
      is hot-removed, it will close this bogus file descriptor, which could belong to
      another QEMU device backend.
      
      There's no obvious guaranteed reliable way to detect that a FD genuinely is a
      TAP device, as opposed to a UNIX socket, or pipe, or something else. Checking
      the errno from probing vnet hdr flag though, does catch the big common cases.
      ie calling TUNGETIFF will return EBADF for an invalid FD, and ENOTTY when FD is
      a UNIX socket, or pipe which catches accidental collisions with FDs used for
      stdio, or monitor socket.
      
      Previously the example below where bogus fd 9 collides with the FD used for the
      chardev saw:
      
      $ ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,fd=9 \
        -chardev socket,id=charchannel0,path=/tmp/qga,server,nowait \
        -monitor stdio -vnc :0
      qemu-system-x86_64: -netdev tap,id=hostnet0,fd=9: TUNGETIFF ioctl() failed: Inappropriate ioctl for device
      TUNSETOFFLOAD ioctl() failed: Bad address
      QEMU 2.9.1 monitor - type 'help' for more information
      (qemu) Warning: netdev hostnet0 has no peer
      
      which gives a running QEMU with a zombie network backend.
      
      With this change applied we get an error message and QEMU immediately exits
      before carrying on and making a bigger disaster:
      
      $ ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,fd=9 \
        -chardev socket,id=charchannel0,path=/tmp/qga,server,nowait \
        -monitor stdio -vnc :0
      qemu-system-x86_64: -netdev tap,id=hostnet0,vhost=on,fd=9: Unable to query TUNGETIFF on FD 9: Inappropriate ioctl for device
      
      Reported-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: default avatarDaniel P. Berrange <berrange@redhat.com>
      Tested-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
      Message-id: 20171027085548.3472-1-berrange@redhat.com
      [lv: to simplify, don't check on EINVAL with TUNGETIFF as it exists since v2.6.27]
      Signed-off-by: default avatarLaurent Vivier <lvivier@redhat.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      e7b347d0
  6. Aug 16, 2019
    • Markus Armbruster's avatar
      Clean up inclusion of sysemu/sysemu.h · d5938f29
      Markus Armbruster authored
      
      In my "build everything" tree, changing sysemu/sysemu.h triggers a
      recompile of some 5400 out of 6600 objects (not counting tests and
      objects that don't depend on qemu/osdep.h).
      
      Almost a third of its inclusions are actually superfluous.  Delete
      them.  Downgrade two more to qapi/qapi-types-run-state.h, and move one
      from char/serial.h to char/serial.c.
      
      hw/semihosting/config.c, monitor/monitor.c, qdev-monitor.c, and
      stubs/semihost.c define variables declared in sysemu/sysemu.h without
      including it.  The compiler is cool with that, but include it anyway.
      
      This doesn't reduce actual use much, as it's still included into
      widely included headers.  The next commit will tackle that.
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Reviewed-by: default avatarAlistair Francis <alistair.francis@wdc.com>
      Message-Id: <20190812052359.30071-27-armbru@redhat.com>
      Reviewed-by: default avatarAlex Bennée <alex.bennee@linaro.org>
      d5938f29
  7. Jun 12, 2019
    • Markus Armbruster's avatar
      Include qemu-common.h exactly where needed · a8d25326
      Markus Armbruster authored
      
      No header includes qemu-common.h after this commit, as prescribed by
      qemu-common.h's file comment.
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Message-Id: <20190523143508.25387-5-armbru@redhat.com>
      [Rebased with conflicts resolved automatically, except for
      include/hw/arm/xlnx-zynqmp.h hw/arm/nrf51_soc.c hw/arm/msf2-soc.c
      block/qcow2-refcount.c block/qcow2-cluster.c block/qcow2-cache.c
      target/arm/cpu.h target/lm32/cpu.h target/m68k/cpu.h target/mips/cpu.h
      target/moxie/cpu.h target/nios2/cpu.h target/openrisc/cpu.h
      target/riscv/cpu.h target/tilegx/cpu.h target/tricore/cpu.h
      target/unicore32/cpu.h target/xtensa/cpu.h; bsd-user/main.c and
      net/tap-bsd.c fixed up]
      a8d25326
  8. Jul 13, 2017
    • Alistair Francis's avatar
      Convert error_report() to warn_report() · 3dc6f869
      Alistair Francis authored
      
      Convert all uses of error_report("warning:"... to use warn_report()
      instead. This helps standardise on a single method of printing warnings
      to the user.
      
      All of the warnings were changed using these two commands:
          find ./* -type f -exec sed -i \
            's|error_report(".*warning[,:] |warn_report("|Ig' {} +
      
      Indentation fixed up manually afterwards.
      
      The test-qdev-global-props test case was manually updated to ensure that
      this patch passes make check (as the test cases are case sensitive).
      
      Signed-off-by: default avatarAlistair Francis <alistair.francis@xilinx.com>
      Suggested-by: default avatarThomas Huth <thuth@redhat.com>
      Cc: Jeff Cody <jcody@redhat.com>
      Cc: Kevin Wolf <kwolf@redhat.com>
      Cc: Max Reitz <mreitz@redhat.com>
      Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Peter Lieven <pl@kamp.de>
      Cc: Josh Durgin <jdurgin@redhat.com>
      Cc: "Richard W.M. Jones" <rjones@redhat.com>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Peter Crosthwaite <crosthwaite.peter@gmail.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
      Cc: Greg Kurz <groug@kaod.org>
      Cc: Rob Herring <robh@kernel.org>
      Cc: Peter Maydell <peter.maydell@linaro.org>
      Cc: Peter Chubb <peter.chubb@nicta.com.au>
      Cc: Eduardo Habkost <ehabkost@redhat.com>
      Cc: Marcel Apfelbaum <marcel@redhat.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Igor Mammedov <imammedo@redhat.com>
      Cc: David Gibson <david@gibson.dropbear.id.au>
      Cc: Alexander Graf <agraf@suse.de>
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Jason Wang <jasowang@redhat.com>
      Cc: Marcelo Tosatti <mtosatti@redhat.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Cornelia Huck <cohuck@redhat.com>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Acked-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
      Acked-by: default avatarGreg Kurz <groug@kaod.org>
      Acked-by: default avatarCornelia Huck <cohuck@redhat.com>
      Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Reviewed by: Peter Chubb <peter.chubb@data61.csiro.au>
      Acked-by: default avatarMax Reitz <mreitz@redhat.com>
      Acked-by: default avatarMarcel Apfelbaum <marcel@redhat.com>
      Message-Id: <e1cfa2cd47087c248dd24caca9c33d9af0c499b0.1499866456.git.alistair.francis@xilinx.com>
      Reviewed-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      3dc6f869
  9. Mar 22, 2016
    • Veronia Bahaa's avatar
      util: move declarations out of qemu-common.h · f348b6d1
      Veronia Bahaa authored
      
      Move declarations out of qemu-common.h for functions declared in
      utils/ files: e.g. include/qemu/path.h for utils/path.c.
      Move inline functions out of qemu-common.h and into new files (e.g.
      include/qemu/bcd.h)
      
      Signed-off-by: default avatarVeronia Bahaa <veroniabahaa@gmail.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      f348b6d1
    • Markus Armbruster's avatar
      include/qemu/osdep.h: Don't include qapi/error.h · da34e65c
      Markus Armbruster authored
      
      Commit 57cb38b3 included qapi/error.h into qemu/osdep.h to get the
      Error typedef.  Since then, we've moved to include qemu/osdep.h
      everywhere.  Its file comment explains: "To avoid getting into
      possible circular include dependencies, this file should not include
      any other QEMU headers, with the exceptions of config-host.h,
      compiler.h, os-posix.h and os-win32.h, all of which are doing a
      similar job to this file and are under similar constraints."
      qapi/error.h doesn't do a similar job, and it doesn't adhere to
      similar constraints: it includes qapi-types.h.  That's in excess of
      100KiB of crap most .c files don't actually need.
      
      Add the typedef to qemu/typedefs.h, and include that instead of
      qapi/error.h.  Include qapi/error.h in .c files that need it and don't
      get it now.  Include qapi-types.h in qom/object.h for uint16List.
      
      Update scripts/clean-includes accordingly.  Update it further to match
      reality: replace config.h by config-target.h, add sysemu/os-posix.h,
      sysemu/os-win32.h.  Update the list of includes in the qemu/osdep.h
      comment quoted above similarly.
      
      This reduces the number of objects depending on qapi/error.h from "all
      of them" to less than a third.  Unfortunately, the number depending on
      qapi-types.h shrinks only a little.  More work is needed for that one.
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      [Fix compilation without the spice devel packages. - Paolo]
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      da34e65c
  10. Feb 04, 2016
    • Peter Maydell's avatar
      net: Clean up includes · 2744d920
      Peter Maydell authored
      
      Clean up includes so that osdep.h is included first and headers
      which it implies are not included manually.
      
      This commit was created with scripts/clean-includes.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Message-id: 1454089805-5470-11-git-send-email-peter.maydell@linaro.org
      2744d920
  11. Sep 11, 2015
  12. Jun 17, 2015
  13. May 27, 2015
  14. Jan 27, 2014
  15. Feb 27, 2013
  16. Feb 01, 2013
    • Jason Wang's avatar
      tap: multiqueue support · 264986e2
      Jason Wang authored
      
      Recently, linux support multiqueue tap which could let userspace call TUNSETIFF
      for a signle device many times to create multiple file descriptors as
      independent queues. User could also enable/disabe a specific queue through
      TUNSETQUEUE.
      
      The patch adds the generic infrastructure to create multiqueue taps. To achieve
      this a new parameter "queues" were introduced to specify how many queues were
      expected to be created for tap by qemu itself. Alternatively, management could
      also pass multiple pre-created tap file descriptors separated with ':' through a
      new parameter fds like -netdev tap,id=hn0,fds="X:Y:..:Z". Multiple vhost file
      descriptors could also be passed in this way.
      
      Each TAPState were still associated to a tap fd, which mean multiple TAPStates
      were created when user needs multiqueue taps. Since each TAPState contains one
      NetClientState, with the multiqueue nic support, an N peers of NetClientState
      were built up.
      
      A new parameter, mq_required were introduce in tap_open() to create multiqueue
      tap fds.
      
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
      264986e2
    • Jason Wang's avatar
      tap: introduce a helper to get the name of an interface · e5dc0b40
      Jason Wang authored
      
      This patch introduces a helper tap_get_ifname() to get the device name of tap
      device. This is needed when ifname is unspecified in the command line and qemu
      were asked to create tap device by itself. In this situation, the name were
      allocated by kernel, so if multiqueue is asked, we need to fetch its name after
      creating the first queue.
      
      Only linux has this support since it's the only platform that supports
      multiqueue tap.
      
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
      e5dc0b40
    • Jason Wang's avatar
      tap: add Linux multiqueue support · 94fdc6d0
      Jason Wang authored
      
      This patch add basic multiqueue support for Linux. When multiqueue is needed, we
      will first check whether kernel support multiqueue tap before creating more
      queues. Two new functions tap_fd_enable() and tap_fd_disable() were introduced
      to enable and disable a specific queue. Since the multiqueue is only supported
      in Linux, return error on other platforms.
      
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
      94fdc6d0
    • Jason Wang's avatar
      28a65891
  17. Dec 19, 2012
  18. Dec 12, 2012
  19. Jul 23, 2012
  20. Nov 01, 2011
  21. Feb 01, 2011
  22. Sep 07, 2010
  23. Jun 22, 2010
  24. Mar 16, 2010
  25. Dec 03, 2009
  26. Oct 30, 2009
Loading