Compare commits

...
13 Commits
Author SHA1 Message Date
Peter Maydell 553032db17 Update version for v5.2.0 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-12-08 15:55:19 +00:00
Peter Maydell d73c46e4a8 Update version for v5.2.0-rc4 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-12-01 16:21:01 +00:00
Paolo Bonzini 8132122889 ide: atapi: assert that the buffer pointer is in range
A case was reported where s->io_buffer_index can be out of range.
The report skimped on the details but it seems to be triggered
by s->lba == -1 on the READ/READ CD paths (e.g. by sending an
ATAPI command with LBA = 0xFFFFFFFF).  For now paper over it
with assertions.  The first one ensures that there is no overflow
when incrementing s->io_buffer_index, the second checks for the
buffer overrun.

Note that the buffer overrun is only a read, so I am not sure
if the assertion failure is actually less harmful than the overrun.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201201120926.56559-1-pbonzini@redhat.com
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-12-01 15:23:05 +00:00
Mauro Matteo Cascella 915976bd98 hw/net/dp8393x: fix integer underflow in dp8393x_do_transmit_packets()
An integer underflow could occur during packet transmission due to 'tx_len' not
being updated if SONIC_TFC register is set to zero. Check for negative 'tx_len'
when removing existing FCS.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1899722
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-id: 20201124092445.658647-1-mcascell@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-12-01 10:34:08 +00:00
Peter Maydell 944fdc5e27 Merge remote-tracking branch 'remotes/elmarco/tags/libslirp-pull-request' into staging
# gpg: Signature made Fri 27 Nov 2020 17:06:28 GMT
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* remotes/elmarco/tags/libslirp-pull-request:
  slirp: update to fix CVE-2020-29129 CVE-2020-29130

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-27 17:09:55 +00:00
Marc-André Lureau 37c0c885d1 slirp: update to fix CVE-2020-29129 CVE-2020-29130
An out-of-bounds access issue was found in the SLIRP user networking
implementation of QEMU. It could occur while processing ARP/NCSI
packets, if the packet length was shorter than required to accommodate
respective protocol headers and payload. A privileged guest user may use
this flaw to potentially leak host information bytes.

Marc-André Lureau (1):
      Merge branch 'stable-4.2' into 'stable-4.2'

Prasad J Pandit (1):
      slirp: check pkt_len before reading protocol header

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-11-27 20:57:11 +04:00
Peter Maydell ea8208249d Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20201127-pull-request' into staging
qxl: fix segfault

# gpg: Signature made Fri 27 Nov 2020 07:06:51 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-20201127-pull-request:
  qxl: fix segfault

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-27 11:11:43 +00:00
Peter Maydell 6cfdaa88cf Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging
Remove obsolete setuptools dependency and fix Stefan's
Win32 builds.

# gpg: Signature made Thu 26 Nov 2020 14:21:28 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini-gitlab/tags/for-upstream:
  nsis: Fix build for 64 bit installer
  tests/docker, tests/vm: remove setuptools from images
  configure: remove python pkg_resources check
  meson: use dependency() to find libjpeg

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-26 14:25:47 +00:00
Stefan Weil 24bdcc9608 nsis: Fix build for 64 bit installer
Pass cpu instead of cpu_family to the NSIS installer script.

That script checks for "x86_64" which is the cpu value,
while cpu_family is "x86".

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20201125191833.964753-1-sw@weilnetz.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-26 09:20:48 -05:00
Paolo Bonzini 92ea027017 tests/docker, tests/vm: remove setuptools from images
Setuptools is not needed anymore by the bundled copy of meson,
remove it.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-25 12:50:48 -05:00
Olaf Hering 8e84bf984a configure: remove python pkg_resources check
Since meson.git#0240d760c7699a059cc89e584363c6431cdd2b61 setuptools is not required anymore.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20201124211925.4194-1-olaf@aepfle.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-25 12:49:40 -05:00
Gerd Hoffmann 6fc5183a65 qxl: fix segfault
Add missing sanity check.
Reproducer: run qemu with "-device qxl" but without "-spice ..."

Fixes: 0d9b90ce5c ("console: make QMP/HMP screendump run in coroutine")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20201124122936.30588-1-kraxel@redhat.com
2020-11-25 12:33:21 +01:00
Paolo Bonzini 8e242b3cb4 meson: use dependency() to find libjpeg
Prefer pkg-config to find_library because some installations of libjpeg
may place it outside the default search path.

Reported-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-23 13:34:02 -05:00
15 changed files with 14 additions and 18 deletions

No files matched your search

-1
View File
@@ -87,7 +87,6 @@ windows_msys2_task:
C:\tools\msys64\usr\bin\bash.exe -lc "pacman --noconfirm -S --needed \
diffutils git grep make pkg-config sed \
mingw-w64-x86_64-python \
mingw-w64-x86_64-python-setuptools \
mingw-w64-x86_64-toolchain \
mingw-w64-x86_64-SDL2 \
mingw-w64-x86_64-SDL2_image \
+1 -1
View File
@@ -1 +1 @@
5.1.93
5.2.0
Vendored
-3
View File
@@ -1912,9 +1912,6 @@ fi
case "$meson" in
git | internal)
if ! $python -c 'import pkg_resources' > /dev/null 2>&1; then
error_exit "Python setuptools not found"
fi
meson="$python ${source_path}/meson/meson.py"
;;
*) meson=$(command -v "$meson") ;;
+2
View File
@@ -276,6 +276,8 @@ void ide_atapi_cmd_reply_end(IDEState *s)
s->packet_transfer_size -= size;
s->elementary_transfer_size -= size;
s->io_buffer_index += size;
assert(size <= s->io_buffer_total_len);
assert(s->io_buffer_index <= s->io_buffer_total_len);
/* Some adapters process PIO data right away. In that case, we need
* to avoid mutual recursion between ide_transfer_start
+4
View File
@@ -495,6 +495,10 @@ static void dp8393x_do_transmit_packets(dp8393xState *s)
} else {
/* Remove existing FCS */
tx_len -= 4;
if (tx_len < 0) {
SONIC_ERROR("tx_len is %d\n", tx_len);
break;
}
}
if (s->regs[SONIC_RCR] & (SONIC_RCR_LB1 | SONIC_RCR_LB0)) {
+3 -4
View File
@@ -654,9 +654,8 @@ if get_option('vnc').enabled()
vnc = declare_dependency() # dummy dependency
png = dependency('libpng', required: get_option('vnc_png'),
method: 'pkg-config', static: enable_static)
jpeg = cc.find_library('jpeg', has_headers: ['jpeglib.h'],
required: get_option('vnc_jpeg'),
static: enable_static)
jpeg = dependency('libjpeg', required: get_option('vnc_jpeg'),
method: 'pkg-config', static: enable_static)
sasl = cc.find_library('sasl2', has_headers: ['sasl/sasl.h'],
required: get_option('vnc_sasl'),
static: enable_static)
@@ -1956,7 +1955,7 @@ if host_machine.system() == 'windows'
'@OUTPUT@',
get_option('prefix'),
meson.current_source_dir(),
host_machine.cpu_family(),
host_machine.cpu(),
'--',
'-DDISPLAYVERSION=' + meson.project_version(),
]
+1 -1
Submodule slirp updated: ce94eba204...8f43a99191.
-1
View File
@@ -30,7 +30,6 @@ RUN apt update && \
pkg-config \
psmisc \
python3 \
python3-setuptools \
python3-sphinx \
$(apt-get -s build-dep qemu | egrep ^Inst | fgrep '[all]' | cut -d\ -f2)
@@ -30,7 +30,6 @@ ENV PACKAGES \
perl-Test-Harness \
python3 \
python3-PyYAML \
python3-setuptools \
tar \
which
@@ -26,7 +26,6 @@ ENV PACKAGES \
perl-Test-Harness \
python3 \
python3-PyYAML \
python3-setuptools \
tar \
which
-1
View File
@@ -33,7 +33,6 @@ class FreeBSDVM(basevm.BaseVM):
"pkgconf",
"bzip2",
"python37",
"py37-setuptools",
"ninja",
# gnu tools
-1
View File
@@ -77,7 +77,6 @@ class HaikuVM(basevm.BaseVM):
"devel:libusb_1.0",
"devel:libz",
"ninja",
"setuptools_python3"
]
# https://dev.haiku-os.org/ticket/16512 virtio disk1 shows up as 0 (reversed order)
-1
View File
@@ -31,7 +31,6 @@ class NetBSDVM(basevm.BaseVM):
"pkgconf",
"xz",
"python37",
"py37-setuptools",
"ninja-build",
# gnu tools
-1
View File
@@ -30,7 +30,6 @@ class OpenBSDVM(basevm.BaseVM):
"git",
"pkgconf",
"bzip2", "xz",
"py3-setuptools",
"ninja",
# gnu tools
+3 -1
View File
@@ -264,7 +264,9 @@ static void gui_setup_refresh(DisplayState *ds)
void graphic_hw_update_done(QemuConsole *con)
{
qemu_co_queue_restart_all(&con->dump_queue);
if (con) {
qemu_co_queue_restart_all(&con->dump_queue);
}
}
void graphic_hw_update(QemuConsole *con)