Public bug reported:
The vulnerable version is qemu-2.8.0, and the vulnerable function is in
"target-s390x/translate.c".
The code snippet is as following.
static ExitStatus translate_one(CPUS390XState *env, DisasContext *s)
{
const DisasInsn *insn;
ExitStatus ret = NO_EXIT;
DisasFiel
On Mon, Jan 30, 2017 at 10:08 PM, Juan Quintela wrote:
> Peter Maydell wrote:
>> On 30 January 2017 at 14:41, Ashijeet Acharya
>> wrote:
>>> Commit a3a3d8c7 introduced a segfault bug while checking for
>>> 'dc->vmsd->unmigratable' which caused QEMU to crash when trying to add
>>> devices which
Commit a3a3d8c7 introduced a segfault bug while checking for
'dc->vmsd->unmigratable' which caused QEMU to crash when trying to add
devices which do no set their 'dc->vmsd' yet while initialization.
Place a 'dc->vmsd' check prior to it so that we do not segfault for
such devices.
NOTE: This doesn'
On 04/02/2017 00:59, Ashijeet Acharya wrote:
> Commit a3a3d8c7 introduced a segfault bug while checking for
> 'dc->vmsd->unmigratable' which caused QEMU to crash when trying to add
> devices which do no set their 'dc->vmsd' yet while initialization.
> Place a 'dc->vmsd' check prior to it so that
"Dr. David Alan Gilbert" writes:
> * Markus Armbruster (arm...@redhat.com) wrote:
>> "Dr. David Alan Gilbert" writes:
>>
>> > * Markus Armbruster (arm...@redhat.com) wrote:
[...]
>> >> === Structured values ===
>> >>
>> >> The dotted key convention messes with KEY syntax to permit structured
>
Max Reitz writes:
> On 03.02.2017 08:50, Markus Armbruster wrote:
>> "Dr. David Alan Gilbert" writes:
>>
>>> * Markus Armbruster (arm...@redhat.com) wrote:
= Introduction =
>>>
>>>
>>>
= Structured option argument syntax =
== JSON ==
The obvious way to provid
"Richard W.M. Jones" writes:
> On Thu, Feb 02, 2017 at 08:42:33PM +0100, Markus Armbruster wrote:
>> There's also the -drive file=json:... syntax. It's a bad fit for
>> QemuOpts, because QemuOpts and JSON fight for the comma. I'd show you
>> if I could get it to work.
>
> I think this refers to
Max Reitz writes:
> I like both JSON and dot syntax. But I like them differently in
> different places.
>
> I love JSON when it's in some file where I can turn out syntax
> highlighting and let my $EDITOR match brackets and braces.
>
> I hate JSON when it's on the command line. You have to escape
"Richard W.M. Jones" writes:
> On Fri, Feb 03, 2017 at 03:16:43PM +, Stefan Hajnoczi wrote:
>> On Thu, Feb 02, 2017 at 05:16:25PM +, Richard W.M. Jones wrote:
>> > +if (*port == NULL) {
>> > +*port = g_strdup_printf("%d", NBD_DEFAULT_PORT);;
>>
>> Please stringify NBD_DEFAULT
Peter Maydell writes:
> Our defacto coding style strongly prefers /* */ style comments
> over the single-line // style, and checkpatch enforces this,
> but we don't actually document this. Mention it in CODING_STYLE.
>
> Suggested-by: Thomas Huth
> Signed-off-by: Peter Maydell
> ---
> CODING_S
Socket activation (sometimes known as systemd socket activation)
allows an Internet superserver to pass a pre-opened listening socket
to the process, instead of having qemu-nbd open a socket itself. This
is done via the LISTEN_FDS and LISTEN_PID environment variables, and a
standard file descripto
Socket activation (sometimes known as systemd socket activation)
allows an Internet superserver to pass a pre-opened listening socket
to the process, instead of having qemu-nbd open a socket itself. This
is done via the LISTEN_FDS and LISTEN_PID environment variables, and a
standard file descripto
v3 -> v5:
- Use stringify() macro (thanks Markus).
- Remove --fork restriction again.
- Retest with virt-p2v.
Rich.
v3 -> v4:
- Remove restriction on --fork again.
- Retest the patch using virt-p2v.
Rich.
On 04/02/2017 01:45, Markus Armbruster wrote:
>>> -drive driver=qcow2,
>>> file.driver=gluster,
>>> .volume=testvol,
>>> .path=/path/a.qcow2,
>>> .debug=9,
>>> file.server.0.type=tcp,
>>> .host=1
On Fri, Feb 03, 2017 at 06:06:33PM +0100, fred.kon...@greensocs.com wrote:
> From: KONRAD Frederic
>
> This replaces env1 and page_index variables by env and index
> so we can use VICTIM_TLB_HIT macro later.
>
Hi Fred,
A question, wouldn't it be more readable to add env and index arguments to
Paolo Bonzini writes:
> On 04/02/2017 01:45, Markus Armbruster wrote:
-drive driver=qcow2,
file.driver=gluster,
.volume=testvol,
.path=/path/a.qcow2,
.debug=9,
file.server.0.type=tcp,
On Fri, Feb 03, 2017 at 09:26:19AM -0800, Paolo Bonzini wrote:
>
>
> On 03/02/2017 09:06, fred.kon...@greensocs.com wrote:
> > +host = mr->ops->request_ptr(mr->opaque, addr - mr->addr, &size,
> > &offset);
> > +
> > +if (!host || !size) {
> > +memory_region_transaction_commit();
On 02/04/2017 12:30 PM, Edgar E. Iglesias wrote:
> On Fri, Feb 03, 2017 at 06:06:33PM +0100, fred.kon...@greensocs.com wrote:
>> From: KONRAD Frederic
>>
>> This replaces env1 and page_index variables by env and index
>> so we can use VICTIM_TLB_HIT macro later.
>>
>
> Hi Fred,
>
> A question, w
Commit a3a3d8c7 introduced a segfault bug while checking for
'dc->vmsd->unmigratable' which caused QEMU to crash when trying to add
devices which do no set their 'dc->vmsd' yet while initialization.
Place a 'dc->vmsd' check prior to it so that we do not segfault for
such devices.
NOTE: This doesn'
On Thu, 02/02 20:42, Markus Armbruster wrote:
> === Comparison ===
>
> In my opinion, dotted keys are weird and ugly, but at least they don't
> add to the quoting mess. Structured values look better, except when
> they do add to the quoting mess.
>
> I'm having a hard time deciding which one I l
On 3 February 2017 at 17:06, wrote:
> From: KONRAD Frederic
>
> This patch-set allows to execute code from mmio areas.
> The main goal of this is to be able to run code for example from an SPI
> device.
>
> The three first patch fixes the way get_page_addr_code fills the TLB.
>
> The fourth pat
On 03/02/2017 13:09, Frederic Konrad wrote:
> On 02/03/2017 06:26 PM, Paolo Bonzini wrote:
>>
>>
>> On 03/02/2017 09:06, fred.kon...@greensocs.com wrote:
>>> +host = mr->ops->request_ptr(mr->opaque, addr - mr->addr, &size,
>>> &offset);
>>> +
>>> +if (!host || !size) {
>>> +memor
On 04/02/2017 03:52, Markus Armbruster wrote:
> Paolo Bonzini writes:
>
>> On 04/02/2017 01:45, Markus Armbruster wrote:
> -drive driver=qcow2,
> file.driver=gluster,
> .volume=testvol,
> .path=/path/a.qcow2,
>
On 04/02/2017 04:21, Fam Zheng wrote:
> -json "id=children0,text=[
> { 'driver': 'null-co://' },
> { 'driver': 'null-co://' },
You meant ,, at the end of this lines. Which throws a wrench in your
proposal somewhat. :(
Paolo
> { 'driver': 'nu
On 02/04/2017 01:33 PM, Peter Maydell wrote:
> On 3 February 2017 at 17:06, wrote:
>> From: KONRAD Frederic
>>
>> This patch-set allows to execute code from mmio areas.
>> The main goal of this is to be able to run code for example from an SPI
>> device.
>>
>> The three first patch fixes the wa
On Sat, 02/04 04:44, Paolo Bonzini wrote:
>
>
> On 04/02/2017 04:21, Fam Zheng wrote:
> > -json "id=children0,text=[
> > { 'driver': 'null-co://' },
> > { 'driver': 'null-co://' },
>
> You meant ,, at the end of this lines. Which throws a wrench in your
> pro
On 4 February 2017 at 12:52, Frederic Konrad wrote:
> Is that the case that we might get a Bad RAM address error or some such
> if we are not on a page boundary (or too small as you say)?
> I guess this is a limitation. Mapping on a page boundary shouldn't be
> too much restrictive.
Yeah. I reall
Fam Zheng writes:
> On Thu, 02/02 20:42, Markus Armbruster wrote:
>> === Comparison ===
>>
>> In my opinion, dotted keys are weird and ugly, but at least they don't
>> add to the quoting mess. Structured values look better, except when
>> they do add to the quoting mess.
>>
>> I'm having a har
On 02/04/2017 01:41 PM, Paolo Bonzini wrote:
>
...
>>
>> Doesn't hotplug use dynamic MemoryRegion? In which case we better
>> make that work with MTTCG. I wonder if we can't simply handle that
>> with a safe_work for this case?
>
> Hot-unplug works because the backing memory is only freed when th
On 02/04/2017 02:17 PM, Peter Maydell wrote:
> On 4 February 2017 at 12:52, Frederic Konrad
> wrote:
>> Is that the case that we might get a Bad RAM address error or some such
>> if we are not on a page boundary (or too small as you say)?
>> I guess this is a limitation. Mapping on a page boundar
On Sat, 02/04 14:35, Markus Armbruster wrote:
> Fam Zheng writes:
>
> > On Thu, 02/02 20:42, Markus Armbruster wrote:
> >> === Comparison ===
> >>
> >> In my opinion, dotted keys are weird and ugly, but at least they don't
> >> add to the quoting mess. Structured values look better, except when
On Fri, Feb 03, 2017 at 05:48:54PM +, Peter Maydell wrote:
> In the ARM ldr/str decode path, rather than directly testing
> "insn & (1 << 21)" and "insn & (1 << 24)", abstract these
> bits out into wbit and pbit local flags. (We will want to
> do more tests against them to determine whether we
On Fri, Feb 03, 2017 at 05:48:55PM +, Peter Maydell wrote:
> Add support for generating the ISS (Instruction Specific Syndrome)
> for Data Abort exceptions taken from AArch32. These syndromes are
> used by hypervisors for example to trap and emulate memory accesses.
>
> This is the equivalent
We install this file to data dir but since 0ab8ed18 it's no longer
required by any objects during "make". List it explicitly as a depended
target of install and fix the broken "make install" command.
Signed-off-by: Fam Zheng
---
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
dif
On Fri, 02/03 17:58, Peter Maydell wrote:
> Our defacto coding style strongly prefers /* */ style comments
> over the single-line // style, and checkpatch enforces this,
> but we don't actually document this. Mention it in CODING_STYLE.
>
> Suggested-by: Thomas Huth
> Signed-off-by: Peter Maydell
Commit 8b0caab0 ("ps2: add support for mice with extra/side buttons")
accidentally swapped right and middle mouse buttons. This commit corrects
the mapping as expected by the ps2 controller.
Signed-off-by: Fabian Lesniak
---
include/hw/input/ps2.h | 4 ++--
1 file changed, 2 insertions(+), 2 del
These patches solve my problems. All three devices I tested using xhci
work correctly now.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1653384
Title:
Assertion failed with USB pass through with X
** Changed in: qemu
Status: New => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1653384
Title:
Assertion failed with USB pass through with XHCI controller
Status in QEMU:
F
On 04/02/2017 04:21, Ashijeet Acharya wrote:
> Commit a3a3d8c7 introduced a segfault bug while checking for
> 'dc->vmsd->unmigratable' which caused QEMU to crash when trying to add
> devices which do no set their 'dc->vmsd' yet while initialization.
> Place a 'dc->vmsd' check prior to it so that
On Wed, Jan 25, 2017 at 04:14:10PM +, Daniel P. Berrange wrote:
> One final complication is that the absolute '-I$(BUILD_DIR)/$(@D)'
> will sometimes end up pointing to a non-existant directory if
> that sub-dir does not have any target-independant files to be
> built. Rather than try to dynam
Fam Zheng writes:
> We install this file to data dir but since 0ab8ed18 it's no longer
> required by any objects during "make". List it explicitly as a depended
> target of install and fix the broken "make install" command.
I'm probably wrong, but I remember someone worked on making traces
self-d
Coverity doesn't like the code in load_symbols() which assumes
it can use 'int' for a variable that might hold an offset into
the guest ELF file, because in a 64-bit guest that could
overflow. Guest binaries with 2GB sections aren't very likely
and this isn't a security issue because we fully trust
Check the return value from qemu_socket() rather than trying to
pass it to bind() as an fd argument even if it's negative.
This wouldn't have caused any negative consequences, because
it won't be a valid fd number and the bind call will fail;
but Coverity complains (CID 1005723).
Signed-off-by: Pe
This patchset fixes three easy-to-fix coverity warnings in the slirp
code (there are another 5 or so which are not quite so simple).
As usual, the preexisting tab-indent style for a lot of the slirp
code is well out of line with the QEMU/checkpatch preferences.
I opted to generally use QEMU style
Coverity points out (CID 1005725) that an error-exit path in tcp_listen()
will try to close(s) even if the reason it got there was that the
qemu_socket() failed and s was never opened. Not only that, this isn't even
the right function to use, because we need closesocket() to do the right
thing on
The mbuf code currently doesn't check the result of doing a malloc()
or realloc() of its data (spotted by Coverity, CID 1238946).
Since the m_inc() API assumes that extending an mbuf must succeed,
just convert to g_malloc() and g_free().
Signed-off-by: Peter Maydell
---
slirp/mbuf.c | 30 +++
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1646610
Title:
"Assertion
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1248469
Title:
qemu 1.6.1
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1221966
Title:
SIGSEGV in
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1243639
Title:
qemu-1.5.3
51 matches
Mail list logo