Skip to content
Snippets Groups Projects
  1. Sep 03, 2019
  2. Aug 27, 2019
  3. Aug 22, 2019
    • Stefan Hajnoczi's avatar
      util/async: hold AioContext ref to prevent use-after-free · f0f81002
      Stefan Hajnoczi authored
      
      The tests/test-bdrv-drain /bdrv-drain/iothread/drain test case does the
      following:
      
      1. The preadv coroutine calls aio_bh_schedule_oneshot() and then yields.
      2. The one-shot BH executes in another AioContext.  All it does is call
         aio_co_wakeup(preadv_co).
      3. The preadv coroutine is re-entered and returns.
      
      There is a race condition in aio_co_wake() where the preadv coroutine
      returns and the test case destroys the preadv IOThread.  aio_co_wake()
      can still be running in the other AioContext and it performs an access
      to the freed IOThread AioContext.
      
      Here is the race in aio_co_schedule():
      
        QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
                                  co, co_scheduled_next);
        <-- race: co may execute before we invoke qemu_bh_schedule()!
        qemu_bh_schedule(ctx->co_schedule_bh);
      
      So if co causes ctx to be freed then we're in trouble.  Fix this problem
      by holding a reference to ctx.
      
      Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Message-id: 20190723190623.21537-1-stefanha@redhat.com
      Message-Id: <20190723190623.21537-1-stefanha@redhat.com>
      Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      f0f81002
  4. Aug 21, 2019
  5. Aug 20, 2019
  6. Aug 16, 2019
  7. Aug 15, 2019
  8. Aug 06, 2019
  9. Jul 15, 2019
  10. Jun 24, 2019
  11. Jun 21, 2019
  12. Jun 12, 2019
    • Markus Armbruster's avatar
      Include qemu-common.h exactly where needed · a8d25326
      Markus Armbruster authored
      
      No header includes qemu-common.h after this commit, as prescribed by
      qemu-common.h's file comment.
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Message-Id: <20190523143508.25387-5-armbru@redhat.com>
      [Rebased with conflicts resolved automatically, except for
      include/hw/arm/xlnx-zynqmp.h hw/arm/nrf51_soc.c hw/arm/msf2-soc.c
      block/qcow2-refcount.c block/qcow2-cluster.c block/qcow2-cache.c
      target/arm/cpu.h target/lm32/cpu.h target/m68k/cpu.h target/mips/cpu.h
      target/moxie/cpu.h target/nios2/cpu.h target/openrisc/cpu.h
      target/riscv/cpu.h target/tilegx/cpu.h target/tricore/cpu.h
      target/unicore32/cpu.h target/xtensa/cpu.h; bsd-user/main.c and
      net/tap-bsd.c fixed up]
      a8d25326
  13. Jun 11, 2019
  14. Jun 06, 2019
  15. May 29, 2019
  16. May 22, 2019
  17. May 10, 2019
  18. May 07, 2019
  19. May 03, 2019
    • Daniel P. Berrangé's avatar
      sockets: avoid string truncation warnings when copying UNIX path · 2d2023c3
      Daniel P. Berrangé authored
      
      In file included from /usr/include/string.h:494,
                       from include/qemu/osdep.h:101,
                       from util/qemu-sockets.c:18:
      In function ‘strncpy’,
          inlined from ‘unix_connect_saddr.isra.0’ at util/qemu-sockets.c:925:5:
      /usr/include/bits/string_fortified.h:106:10: warning: ‘__builtin_strncpy’ specified bound 108 equals destination size [-Wstringop-truncation]
        106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
            |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      In function ‘strncpy’,
          inlined from ‘unix_listen_saddr.isra.0’ at util/qemu-sockets.c:880:5:
      /usr/include/bits/string_fortified.h:106:10: warning: ‘__builtin_strncpy’ specified bound 108 equals destination size [-Wstringop-truncation]
        106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
            |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      We are already validating the UNIX socket path length earlier in
      the functions. If we save this string length when we first check
      it, then we can simply use memcpy instead of strcpy later, avoiding
      the gcc truncation warnings.
      
      Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      Reviewed-by: default avatarEric Blake <eblake@redhat.com>
      Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      Message-Id: <20190501145052.12579-1-berrange@redhat.com>
      Signed-off-by: default avatarLaurent Vivier <laurent@vivier.eu>
      2d2023c3
  20. Apr 30, 2019
  21. Apr 25, 2019
Loading