summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* iotests: 30: drop from auto group (and effectively from make check)Vladimir Sementsov-Ogievskiy2021-02-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I reproduced the following crash fast enough: 0 raise () at /lib64/libc.so.6 1 abort () at /lib64/libc.so.6 2 _nl_load_domain.cold () at /lib64/libc.so.6 3 annobin_assert.c_end () at /lib64/libc.so.6 4 bdrv_reopen_multiple (bs_queue=0x55de75fa9b70, errp=0x0) at ../block.c:3820 5 bdrv_reopen_set_read_only (bs=0x55de760fc020, read_only=true, errp=0x0) at ../block.c:3870 6 stream_clean (job=0x55de75fa9410) at ../block/stream.c:99 7 job_clean (job=0x55de75fa9410) at ../job.c:680 8 job_finalize_single (job=0x55de75fa9410) at ../job.c:696 9 job_txn_apply (job=0x55de75fa9410, fn=0x55de741eee27 <job_finalize_single>) at ../job.c:158 10 job_do_finalize (job=0x55de75fa9410) at ../job.c:805 11 job_completed_txn_success (job=0x55de75fa9410) at ../job.c:855 12 job_completed (job=0x55de75fa9410) at ../job.c:868 13 job_exit (opaque=0x55de75fa9410) at ../job.c:888 14 aio_bh_call (bh=0x55de76b9b4e0) at ../util/async.c:136 15 aio_bh_poll (ctx=0x55de75bc5300) at ../util/async.c:164 16 aio_dispatch (ctx=0x55de75bc5300) at ../util/aio-posix.c:381 17 aio_ctx_dispatch (source=0x55de75bc5300, callback=0x0, user_data=0x0) at ../util/async.c:306 18 g_main_context_dispatch () at /lib64/libglib-2.0.so.0 19 glib_pollfds_poll () at ../util/main-loop.c:232 20 os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:255 21 main_loop_wait (nonblocking=0) at ../util/main-loop.c:531 22 qemu_main_loop () at ../softmmu/runstate.c:722 23 main (argc=20, argv=0x7ffe218f0268, envp=0x7ffe218f0310) at ../softmmu/main.c:50 (gdb) fr 4 4 bdrv_reopen_multiple (bs_queue=0x55de75fa9b70, errp=0x0) at ../block.c:3820 3820 assert(perm == state->perm); (gdb) list 3815 3816 if (ret == 0) { 3817 uint64_t perm, shared; 3818 3819 bdrv_get_cumulative_perm(state->bs, &perm, &shared); 3820 assert(perm == state->perm); 3821 assert(shared == state->shared_perm); 3822 3823 bdrv_set_perm(state->bs); 3824 } else { (gdb) p perm $1 = 1 (gdb) p state->perm $2 = 0 Then I had 38 successful iterations and another crash: 0 bdrv_check_update_perm (bs=0x5631ac97bc50, q=0x0, new_used_perm=1, new_shared_perm=31, ignore_children=0x0, errp=0x7ffd9d477cf8) at ../block.c:2197 1 bdrv_root_attach_child (child_bs=0x5631ac97bc50, child_name=0x5631aaf6b1f9 "backing", child_class=0x5631ab280ca0 <child_of_bds>, child_role=8, ctx=0x5631ab757300, perm=1, shared_perm=31, opaque=0x5631abb8c020, errp=0x7ffd9d477cf8) at ../block.c:2642 2 bdrv_attach_child (parent_bs=0x5631abb8c020, child_bs=0x5631ac97bc50, child_name=0x5631aaf6b1f9 "backing", child_class=0x5631ab280ca0 <child_of_bds>, child_role=8, errp=0x7ffd9d477cf8) at ../block.c:2719 3 bdrv_set_backing_hd (bs=0x5631abb8c020, backing_hd=0x5631ac97bc50, errp=0x7ffd9d477cf8) at ../block.c:2854 4 stream_prepare (job=0x5631ac751eb0) at ../block/stream.c:74 5 job_prepare (job=0x5631ac751eb0) at ../job.c:784 6 job_txn_apply (job=0x5631ac751eb0, fn=0x5631aacb1156 <job_prepare>) at ../job.c:158 7 job_do_finalize (job=0x5631ac751eb0) at ../job.c:801 8 job_completed_txn_success (job=0x5631ac751eb0) at ../job.c:855 9 job_completed (job=0x5631ac751eb0) at ../job.c:868 10 job_exit (opaque=0x5631ac751eb0) at ../job.c:888 11 aio_bh_call (bh=0x7f3d9c007680) at ../util/async.c:136 12 aio_bh_poll (ctx=0x5631ab757300) at ../util/async.c:164 13 aio_dispatch (ctx=0x5631ab757300) at ../util/aio-posix.c:381 14 aio_ctx_dispatch (source=0x5631ab757300, callback=0x0, user_data=0x0) at ../util/async.c:306 15 g_main_context_dispatch () at /lib64/libglib-2.0.so.0 16 glib_pollfds_poll () at ../util/main-loop.c:232 17 os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:255 18 main_loop_wait (nonblocking=0) at ../util/main-loop.c:531 19 qemu_main_loop () at ../softmmu/runstate.c:722 20 main (argc=20, argv=0x7ffd9d478198, envp=0x7ffd9d478240) at ../softmmu/main.c:50 (gdb) list 2192 QLIST_FOREACH(c, &bs->parents, next_parent) { 2193 if (g_slist_find(ignore_children, c)) { 2194 continue; 2195 } 2196 2197 if ((new_used_perm & c->shared_perm) != new_used_perm) { 2198 char *user = bdrv_child_user_desc(c); 2199 char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm); 2200 2201 error_setg(errp, "Conflicts with use by %s as '%s', which does not " (gdb) p c $1 = (BdrvChild *) 0x8585858585858585 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20210205111021.715240-1-vsementsov@virtuozzo.com Reviewed-by: Eric Blake <eblake@redhat.com> [PMM: trimmed the part of the commit message referring to as-yet-unapplied patchseries] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch ↵Peter Maydell2021-02-0531-105/+517
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/vga-ui-20210205-pull-request' into staging ui+virtio-gpu: opengl cleanups and fixes. qxl+spice: bugfixes # gpg: Signature made Fri 05 Feb 2021 06:56:04 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-ui-20210205-pull-request: (24 commits) tests: add some virtio-gpu & vhost-user-gpu acceptance test chardev: check if the chardev is registered for yanking display/ui: add a callback to indicate GL state is flushed virtio-gpu: avoid re-entering cmdq processing ui: add egl dmabuf import to gtkglarea ui: check gtk-egl dmabuf support ui: add qemu_egl_has_dmabuf helper ui: check hw requirements during DCL registration ui: add a DCLOps callback to check dmabuf support ui: add an optional get_flags callback to GraphicHwOps vhost-user-gpu: add a configuration flag for dmabuf usage ui: remove console_has_gl_dmabuf() ui: annotate DCLOps callback requirements ui: add gd_gl_area_scanout_disable ui: remove gl_ctx_get_current ui: remove extra #ifdef CONFIG_OPENGL vhost-user-gpu: handle display-info in a callback vhost-user-gpu: use an extandable state enum for commands vhost-user-gpu: handle vhost-user-gpu features in a callback vhost-user-gpu: check backend for EDID support ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tests: add some virtio-gpu & vhost-user-gpu acceptance testMarc-André Lureau2021-02-041-0/+161
| | | | | | | | | | | | | | | | | | This will check virtio/vhost-user-vga & virgl are correctly initialized by the Linux kernel on an egl-headless display. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-21-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * chardev: check if the chardev is registered for yankingMarc-André Lureau2021-02-041-20/+33
| | | | | | | | | | | | | | | | | | | | Not all chardevs are created via qmp_chardev_open_socket(), and those should not call the yank function registration, as this will eventually assert() not being registered. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-20-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * display/ui: add a callback to indicate GL state is flushedMarc-André Lureau2021-02-0411-10/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Displaying rendered resources requires blocking qemu GPU to avoid extra framebuffer copies. For an external display, via Spice currently, there is a callback to block/unblock the rendering in the same thread. But with the vhost-user-gpu backend, the qemu process doesn't handle the rendering itself, and the blocking callback isn't effective. Instead, the backend must be notified when the display code is done. Fix this by adding a new GraphicHwOps callback to indicate the GL state is flushed, and we are done manipulating the shared GL resources. Call it from gtk and spice display. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-19-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * virtio-gpu: avoid re-entering cmdq processingMarc-André Lureau2021-02-042-0/+6
| | | | | | | | | | | | | | | | | | | | The next patch will notify the GL context got flush, which will resume the queue processing. However, if this happens within the caller context, it will end up with a stack overflow flush/update loop. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-18-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: add egl dmabuf import to gtkglareaMarc-André Lureau2021-02-043-0/+42
| | | | | | | | | | | | | | | | GtkGLArea is used on wayland, where EGL is usually available. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-17-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: check gtk-egl dmabuf supportMarc-André Lureau2021-02-042-0/+10
| | | | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-16-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: add qemu_egl_has_dmabuf helperMarc-André Lureau2021-02-042-0/+11
| | | | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-15-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: check hw requirements during DCL registrationMarc-André Lureau2021-02-041-0/+30
| | | | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-14-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: add a DCLOps callback to check dmabuf supportMarc-André Lureau2021-02-042-0/+15
| | | | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-13-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: add an optional get_flags callback to GraphicHwOpsMarc-André Lureau2021-02-044-0/+42
| | | | | | | | | | | | | | | | | | Those flags can be used to express different requirements for the display or other needs. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-12-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vhost-user-gpu: add a configuration flag for dmabuf usageMarc-André Lureau2021-02-042-0/+5
| | | | | | | | | | | | | | | | Let's inform VirtioGPUBase that vhost-user-gpu require DMABUF messages. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-11-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: remove console_has_gl_dmabuf()Marc-André Lureau2021-02-043-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | This check is currently limited. It only is used by vhost-user-gpu (not by vfio-display), and will print an error repeatedly during run-time. We are going to dissociate the GL context from the DisplayChangeListener, and listeners may come and go. The following patches will address this differently. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-10-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: annotate DCLOps callback requirementsMarc-André Lureau2021-02-041-0/+19
| | | | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-9-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: add gd_gl_area_scanout_disableMarc-André Lureau2021-02-044-6/+10
| | | | | | | | | | | | | | | | Require the callback, drop the fallback path. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-8-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: remove gl_ctx_get_currentMarc-André Lureau2021-02-0410-28/+0
| | | | | | | | | | | | | | | | There are no users left. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-7-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: remove extra #ifdef CONFIG_OPENGLMarc-André Lureau2021-02-041-8/+1
| | | | | | | | | | | | | | | | | | Since commit 5cb69566daa8081abb82a13403dcc0fffed02007 ("gtk: remove CONFIG_GTK_GL"), some #ifdef are redundants. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-6-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vhost-user-gpu: handle display-info in a callbackMarc-André Lureau2021-02-041-6/+27
| | | | | | | | | | | | | | | | | | Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-5-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vhost-user-gpu: use an extandable state enum for commandsMarc-André Lureau2021-02-043-6/+12
| | | | | | | | | | | | | | | | | | | | Introduce a pending state for commands which aren't finished yet, but are being handled. See following patch. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210204105232.834642-4-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vhost-user-gpu: handle vhost-user-gpu features in a callbackMarc-André Lureau2021-02-042-11/+28
| | | | | | | | | | | | | | | | | | Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vhost-user-gpu: check backend for EDID supportMarc-André Lureau2021-02-041-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EDID has been enabled by default, but the backend may not implement it (such as the contrib backend). This results in extra warnings and potentially other issues in the guest. The option shouldn't probably have been added to VIRTIO_GPU_BASE, but it's a bit too late now, report an error and disable EDID when it's not available. Fixes: 0a7196625 ("edid: flip the default to enabled") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-2-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * spice: delay starting until display are initializedMarc-André Lureau2021-02-043-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU used to run qemu_spice.display_init() before vm_start(), and QXL/display interfaces where started then. Now, vm_start() happens before QXL/display interfaces are added and Spice server doesn't automatically start them in this case (fixed in spice git) Fixes Spice regression introduced after 5.2, with refactoring commits b4e1a34211 ("vl: remove separate preconfig main_loop") and facf7c60ee ("vl: initialize displays _after_ exiting preconfiguration"), probably others. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210129152351.161971-1-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * qxl: also notify the rendering is done when skipping itMarc-André Lureau2021-02-041-0/+1
| | | | | | | | | | | | | | | | | | | | Asynchronous handlers may be waiting for the graphic_hw_update_done() to be called in this case too. Fixes: 4d6316218 ("console: add graphic_hw_update_done()") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210201201422.446552-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * qxl: set qxl.ssd.dcl.con on secondary devicesMarc-André Lureau2021-02-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | On secondary QXL devices, the console is only set on qxl.vga.con. But graphic_hw_update_done() is called with qxl.ssd.dcl.con. Like for primary QXL devices, set qxl.sdd.dcl.con = qxl.vga.con. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210201201422.446552-2-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * hw/display/qxl: Fix bad printf format specifiersAlex Chen2021-02-042-3/+3
| | | | | | | | | | | | | | | | | | | | We should use printf format specifier "%u" instead of "%d" for argument of type "unsigned int". Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> Message-id: 20201119025851.56487-1-alex.chen@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-02-042-76/+150
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204' into staging virtiofs: Security pull 2021-02-04 This contains an important CVE fix for virtiofsd, together with two fixes for over-eager seccomp rules. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Thu 04 Feb 2021 18:30:37 GMT # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204: virtiofsd: Add restart_syscall to the seccomp whitelist virtiofsd: Add _llseek to the seccomp whitelist virtiofsd: prevent opening of special files (CVE-2020-35517) virtiofsd: optionally return inode pointer from lo_do_lookup() virtiofsd: extract lo_do_open() from lo_open() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtiofsd: Add restart_syscall to the seccomp whitelistGreg Kurz2021-02-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is how linux restarts some system calls after SIGSTOP/SIGCONT. This is needed to avoid virtiofsd termination when resuming execution under GDB for example. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210201193305.136390-1-groug@kaod.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | virtiofsd: Add _llseek to the seccomp whitelistGreg Kurz2021-02-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is how glibc implements lseek(2) on POWER. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1917692 Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210121171540.1449777-1-groug@kaod.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | virtiofsd: prevent opening of special files (CVE-2020-35517)Stefan Hajnoczi2021-02-041-52/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A well-behaved FUSE client does not attempt to open special files with FUSE_OPEN because they are handled on the client side (e.g. device nodes are handled by client-side device drivers). The check to prevent virtiofsd from opening special files is missing in a few cases, most notably FUSE_OPEN. A malicious client can cause virtiofsd to open a device node, potentially allowing the guest to escape. This can be exploited by a modified guest device driver. It is not exploitable from guest userspace since the guest kernel will handle special files inside the guest instead of sending FUSE requests. This patch fixes this issue by introducing the lo_inode_open() function to check the file type before opening it. This is a short-term solution because it does not prevent a compromised virtiofsd process from opening device nodes on the host. Restructure lo_create() to try O_CREAT | O_EXCL first. Note that O_CREAT | O_EXCL does not follow symlinks, so O_NOFOLLOW masking is not necessary here. If the file exists and the user did not specify O_EXCL, open it via lo_do_open(). Reported-by: Alex Xu <alex@alxu.ca> Fixes: CVE-2020-35517 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210204150208.367837-4-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | virtiofsd: optionally return inode pointer from lo_do_lookup()Stefan Hajnoczi2021-02-041-8/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lo_do_lookup() finds an existing inode or allocates a new one. It increments nlookup so that the inode stays alive until the client releases it. Existing callers don't need the struct lo_inode so the function doesn't return it. Extend the function to optionally return the inode. The next commit will need it. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20210204150208.367837-3-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | virtiofsd: extract lo_do_open() from lo_open()Stefan Hajnoczi2021-02-041-27/+46
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | Both lo_open() and lo_create() have similar code to open a file. Extract a common lo_do_open() function from lo_open() that will be used by lo_create() in a later commit. Since lo_do_open() does not otherwise need fuse_req_t req, convert lo_add_fd_mapping() to use struct lo_data *lo instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210204150208.367837-2-stefanha@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-qmp-2021-02-04' into ↵Peter Maydell2021-02-047-21/+55
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging QMP patches patches for 2021-02-04 # gpg: Signature made Thu 04 Feb 2021 12:21:47 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qmp-2021-02-04: qmp: Resume OOB-enabled monitor before processing the request qmp: Add more tracepoints qmp: Fix up comments after commit 9ce44e2ce2 docs/interop/qmp-spec: Document the request queue limit qobject: braces {} are necessary for all arms of this statement qobject: spaces required around that operators qobject: code indent should never use tabs qobject: open brace '{' following struct go on the same line monitor/qmp-cmds.c: Don't include ui/vnc.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qmp: Resume OOB-enabled monitor before processing the requestMarkus Armbruster2021-02-041-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | monitor_qmp_dispatcher_co() needs to resume the monitor if handle_qmp_command() suspended it. Two cases: 1. OOB enabled: suspended if mon->qmp_requests has no more space 2. OOB disabled: suspended always We resume only after we processed the request. Which can take a long time. Resume the monitor right when the queue has space to keep the monitor available for out-of-band commands even in this corner case. Leave the "OOB disabled" case alone. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-4-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> [Trailing whitespace tidied up]
| * qmp: Add more tracepointsMarkus Armbruster2021-02-042-0/+11
| | | | | | | | | | | | | | | | | | Add tracepoints for in-band request enqueue and dequeue, processing of queued in-band errors, and responses. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-3-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com>
| * qmp: Fix up comments after commit 9ce44e2ce2Markus Armbruster2021-02-041-2/+2
| | | | | | | | | | | | | | | | | | | | Commit 9ce44e2ce2 "qmp: Move dispatcher to a coroutine" replaced monitor_qmp_bh_dispatcher() by monitor_qmp_dispatcher_co(), but neglected to update comments. Do that now. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-2-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com>
| * docs/interop/qmp-spec: Document the request queue limitMarkus Armbruster2021-02-041-3/+5
| | | | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210127144734.2367693-1-armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
| * qobject: braces {} are necessary for all arms of this statementZhang Han2021-02-041-2/+4
| | | | | | | | | | | | | | | | | | | | Add braces {} for arms of if/for statement Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-5-zhanghan64@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * qobject: spaces required around that operatorsZhang Han2021-02-041-2/+2
| | | | | | | | | | | | | | | | | | Add spaces around operators. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-4-zhanghan64@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * qobject: code indent should never use tabsZhang Han2021-02-041-2/+2
| | | | | | | | | | | | | | | | | | Transfer tabs to spaces. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-3-zhanghan64@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * qobject: open brace '{' following struct go on the same lineZhang Han2021-02-042-4/+2
| | | | | | | | | | | | | | | | | | | | Put open brace '{' on the same line of struct. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-2-zhanghan64@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * monitor/qmp-cmds.c: Don't include ui/vnc.hPeter Maydell2021-02-041-1/+1
|/ | | | | | | | | | | | | | | | The qmp-cmds.c file currently includes ui/vnc.h, which (being located in the ui/ directory rather than include) is really supposed to be for use only by the ui subsystem. In fact the function prototypes we need (vnc_display_password(), etc) are all declared in include/ui/console.h, so we can switch to including that instead. (ui/vnc.h includes include/ui/console.h, so this change strictly reduces the quantity of headers qmp-cmds.c pulls in.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210104161200.15068-1-peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210202' ↵Peter Maydell2021-02-0329-1266/+1250
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging TCG backend constraints cleanup # gpg: Signature made Tue 02 Feb 2021 22:59:19 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth-gitlab/tags/pull-tcg-20210202: (24 commits) tcg: Remove TCG_TARGET_CON_SET_H tcg/tci: Split out constraint sets to tcg-target-con-set.h tcg/sparc: Split out constraint sets to tcg-target-con-set.h tcg/s390: Split out constraint sets to tcg-target-con-set.h tcg/riscv: Split out constraint sets to tcg-target-con-set.h tcg/ppc: Split out constraint sets to tcg-target-con-set.h tcg/mips: Split out constraint sets to tcg-target-con-set.h tcg/arm: Split out constraint sets to tcg-target-con-set.h tcg/aarch64: Split out constraint sets to tcg-target-con-set.h tcg/i386: Split out constraint sets to tcg-target-con-set.h tcg: Remove TCG_TARGET_CON_STR_H tcg/sparc: Split out target constraints to tcg-target-con-str.h tcg/s390: Split out target constraints to tcg-target-con-str.h tcg/riscv: Split out target constraints to tcg-target-con-str.h tcg/mips: Split out target constraints to tcg-target-con-str.h tcg/tci: Split out target constraints to tcg-target-con-str.h tcg/ppc: Split out target constraints to tcg-target-con-str.h tcg/aarch64: Split out target constraints to tcg-target-con-str.h tcg/arm: Split out target constraints to tcg-target-con-str.h tcg/i386: Split out target constraints to tcg-target-con-str.h ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tcg: Remove TCG_TARGET_CON_SET_HRichard Henderson2021-02-0210-22/+0
| | | | | | | | | | | | | | | | | | All backends have now been converted to tcg-target-con-set.h, so we can remove the fallback code. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/tci: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-142/+158
| | | | | | | | | | | | | | This requires finishing the conversion to tcg_target_op_def. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/sparc: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-52/+56
| | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/s390: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-70/+81
| | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/riscv: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-60/+54
| | | | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/ppc: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-81/+100
| | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/mips: Split out constraint sets to tcg-target-con-set.hRichard Henderson2021-02-023-68/+67
| | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>