Quoting Dr. David Alan Gilbert (2014-07-09 12:43:49) > * Michael Roth (mdr...@linux.vnet.ibm.com) wrote: > > Hi everyone, > > > > The following new patches are queued for QEMU stable v1.7.2: > > > > https://github.com/mdroth/qemu/commits/stable-1.7-staging > > > > The release is planned for 2014-07-21: > > > > http://wiki.qemu.org/Planning/1.7 > > > > Please respond here or CC qemu-sta...@nongnu.org on any patches > > you think should be included in the release. > > You might want to include: > a890a2f9137ac3cf5b607649e66a6f3a5512d8dc - virtio: validate config_len on load > > which guards against a mismatched config len on the migration stream > overwriting things. > > however, if you do you should also include: > 2f5732e9648fcddc8759a8fd25c0b41a38352be6 - Allow mismatched virtio config-len > which instead of erroring, just discards the data to cope with > changes in the config len.
Thanks, first one was already in, but just pushed the 2nd to avoid compat issues. > > Dave > > > > Testing/feedback is greatly appreciated. > > > > > > As you maybe have noticed, the 1.7.2 stable release is late by > > almost an entire release cycle. There were some important fixes > > planned for 1.7.2 however, so hopefully better late than never. > > Due to the delay the patch queue for this release is quite a bit > > longer than usual, so anyone interested in this release is highly > > encouraged to review/test. > > > > 2.0.1 has similarly slipped by half a release cycle, so 2.0.1 will > > be going out during the originally planned date release date for > > 2.0.2, and is the only planned stable release for the 2.0 series: > > > > http://wiki.qemu.org/Planning/2.0 > > > > My apologies for the delays. For 2.1.x, we should be back on track > > for the normal stable release schedule (2.1.1 midway through 2.2 > > development, and 2.1.2 roughly coinciding with 2.2 release). > > > > Thanks! > > > > ---------------------------------------------------------------- > > Alexander Graf (3): > > kvmclock: Ensure time in migration never goes backward > > KVM: Fix GSI number space limit > > virtio-serial: don't migrate the config space > > > > Alexey Kardashevskiy (1): > > spapr_pci: Fix number of returned vectors in ibm, change-msi > > > > Andreas Färber (2): > > sdhci: Fix misuse of qemu_free_irqs() > > hw: Fix qemu_allocate_irqs() leaks > > > > Benoît Canet (2): > > ide: Correct improper smart self test counter reset in ide core. > > block: Prevent coroutine stack overflow when recursing in > > bdrv_open_backing_file. > > > > ChenLiang (1): > > migration: remove duplicate code > > > > Cornelia Huck (1): > > s390x/css: handle emw correctly for tsch > > > > Cédric Le Goater (1): > > virtio-net: byteswap virtio-net header > > > > David Hildenbrand (1): > > s390x: empty function stubs in preparation for __KVM_HAVE_GUEST_DEBUG > > > > Dmitry Fleytman (4): > > vmxnet3: validate interrupt indices coming from guest > > vmxnet3: validate queues configuration coming from guest > > vmxnet3: validate interrupt indices read on migration > > vmxnet3: validate queues configuration read on migration > > > > Dr. David Alan Gilbert (1): > > Fix vmstate_info_int32_le comparison/assign > > > > Edgar E. Iglesias (1): > > target-arm: Make vbar_write 64bit friendly on 32bit hosts > > > > Eduardo Habkost (1): > > target-i386: Filter FEAT_7_0_EBX TCG features too > > > > Fam Zheng (2): > > scsi: Change scsi sense buf size to 252 > > curl: check data size before memcpy to local buffer. (CVE-2014-0144) > > > > Gal Hammer (1): > > char: restore read callback on a reattached (hotplug) chardev > > > > Gonglei (1): > > qga: Fix handle fd leak in acquire_privilege() > > > > Hani Benhabiles (5): > > usb: Fix usb-bt-dongle initialization. > > nbd: Don't export a block device with no medium. > > nbd: Don't validate from and len in NBD_CMD_DISC. > > nbd: Close socket on negotiation failure. > > nbd: Shutdown socket before closing. > > > > Hannes Reinecke (1): > > megasas: Implement LD_LIST_QUERY > > > > Hu Tao (1): > > qcow2: fix offset overflow in qcow2_alloc_clusters_at() > > > > Jeff Cody (3): > > vpc/vhd: add bounds check for max_table_entries and block_size > > (CVE-2014-0144) > > vdi: add bounds checks for blocks_in_image and disk_size header > > fields (CVE-2014-0144) > > vhdx: Bounds checking for block_size and logical_sector_size > > (CVE-2014-0148) > > > > Kevin Wolf (35): > > qcow2: Flush metadata during read-only reopen > > block: Use BDRV_O_NO_BACKING where appropriate > > qemu-iotests: Support for bochs format > > bochs: Unify header structs and make them QEMU_PACKED > > bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147) > > bochs: Check catalog_size header field (CVE-2014-0143) > > bochs: Check extent_size header field (CVE-2014-0142) > > bochs: Fix bitmap offset calculation > > vpc: Validate block size (CVE-2014-0142) > > qcow2: Check header_length (CVE-2014-0144) > > qcow2: Check backing_file_offset (CVE-2014-0144) > > qcow2: Check refcount table size (CVE-2014-0144) > > qcow2: Validate refcount table offset > > qcow2: Validate snapshot table offset/size (CVE-2014-0144) > > qcow2: Validate active L1 table offset and size (CVE-2014-0144) > > qcow2: Fix backing file name length check > > qcow2: Zero-initialise first cluster for new images > > qcow2: Don't rely on free_cluster_index in alloc_refcount_block() > > (CVE-2014-0147) > > qcow2: Avoid integer overflow in get_refcount (CVE-2014-0143) > > qcow2: Check new refcount table size on growth > > qcow2: Fix types in qcow2_alloc_clusters and alloc_clusters_noref > > qcow2: Protect against some integer overflows in bdrv_check > > qcow2: Fix new L1 table size check (CVE-2014-0143) > > block: Limit request size (CVE-2014-0143) > > qcow2: Fix NULL dereference in qcow2_open() error path (CVE-2014-0146) > > qcow2: Fix copy_sectors() with VM state > > qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() > > (CVE-2014-0145) > > qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() > > (CVE-2014-0143) > > parallels: Fix catalog size integer overflow (CVE-2014-0143) > > parallels: Sanity check for s->tracks (CVE-2014-0142) > > qcow1: Make padding in the header explicit > > qcow1: Check maximum cluster size > > qcow1: Validate L2 table size (CVE-2014-0222) > > qcow1: Validate image size (CVE-2014-0223) > > qcow1: Stricter backing file length check > > > > Le Tan (1): > > pci: assign devfn to pci_dev before calling > > pci_device_iommu_address_space() > > > > Marcelo Tosatti (1): > > kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec > > calculation > > > > Markus Armbruster (10): > > scsi-bus: Fix transfer length for VERIFY with BYTCHK=11b > > virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path > > blockdev: Plug memory leak in blockdev_init() > > blockdev: Plug memory leak in drive_init() > > block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR > > block/vvfat: Plug memory leak in check_directory_consistency() > > block/vvfat: Plug memory leak in read_directory() > > block/sheepdog: Plug memory leak in sd_snapshot_create() > > qemu-img: Plug memory leak in convert command > > vnc: Fix tight_detect_smooth_image() for lossless case > > > > Max Filippov (1): > > target-xtensa: fix cross-page jumps/calls at the end of TB > > > > Max Reitz (1): > > block-commit: speed is an optional parameter > > > > Michael R. Hines (1): > > rdma: bug fixes > > > > Michael Roth (3): > > virtio: avoid buffer overrun on incoming migration > > openpic: avoid buffer overrun on incoming migration > > qapi: zero-initialize all QMP command parameters > > > > Michael S. Tsirkin (27): > > acpi: fix tables for no-hpet configuration > > vmstate: reduce code duplication > > vmstate: add VMS_MUST_EXIST > > vmstate: add VMSTATE_VALIDATE > > virtio-net: fix buffer overflow on invalid state load > > virtio-net: out-of-bounds buffer write on invalid state load > > virtio-net: out-of-bounds buffer write on load > > virtio: out-of-bounds buffer write on invalid state load > > ahci: fix buffer overrun on invalid state load > > hpet: fix buffer overrun on invalid state load > > hw/pci/pcie_aer.c: fix buffer overruns on invalid state load > > pl022: fix buffer overun on invalid state load > > vmstate: fix buffer overflow in target-arm/machine.c > > virtio: validate num_sg when mapping > > pxa2xx: avoid buffer overrun on incoming migration > > ssi-sd: fix buffer overrun on invalid state load > > ssd0323: fix buffer overun on invalid state load > > tsc210x: fix buffer overrun on invalid state load > > zaurus: fix buffer overrun on invalid state load > > virtio-scsi: fix buffer overrun on invalid state load > > vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ > > usb: sanity check setup_index+setup_len in post_load > > virtio: validate config_len on load > > stellaris_enet: block migration > > pci-assign: limit # of msix vectors > > virtio: allow mapping up to max queue size > > vhost: fix resource leak in error handling > > > > Michael Tokarev (1): > > po/Makefile: fix $SRC_PATH reference > > > > Paolo Bonzini (2): > > mirror: fix throttling delay calculation > > target-i386: fix set of registers zeroed on reset > > > > Peter Crosthwaite (1): > > arm: translate.c: Fix smlald Instruction > > > > Peter Lieven (2): > > block/iscsi: fix deadlock on scsi check condition > > migration: catch unknown flags in ram_load > > > > Peter Maydell (9): > > hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer > > overrun > > hw/net/stellaris_enet: Correct handling of packet padding > > savevm: Ignore minimum_version_id_old if there is no load_state_old > > linux-user/elfload.c: Fix incorrect ARM HWCAP bits > > linux-user/elfload.c: Update ARM HWCAP bits > > linux-user/elfload.c: Fix A64 code which was incorrectly acting like > > A32 > > linux-user: Don't overrun guest buffer in sched_getaffinity > > target-arm: Fix errors in writes to generic timer control registers > > coroutine-win32.c: Add noinline attribute to work around gcc bug > > > > Richard Henderson (3): > > target-i386: Fix CC_OP_CLR vs PF > > target-i386: Fix ucomis and comis memory access > > tcg-i386: Fix win64 qemu store > > > > Stefan Fritsch (1): > > virtio-net: Do not filter VLANs without F_CTRL_VLAN > > > > Stefan Hajnoczi (18): > > qom: Avoid leaking str and bool properties on failure > > tap: avoid deadlocking rx > > mirror: fix early wake from sleep due to aio > > qemu-iotests: add ./check -cloop support > > qemu-iotests: add cloop input validation tests > > block/cloop: validate block_size header field (CVE-2014-0144) > > block/cloop: prevent offsets_size integer overflow (CVE-2014-0143) > > block/cloop: refuse images with huge offsets arrays (CVE-2014-0144) > > block/cloop: refuse images with bogus offsets (CVE-2014-0144) > > block/cloop: fix offsets[] size off-by-one > > dmg: coding style and indentation cleanup > > dmg: prevent out-of-bounds array access on terminator > > dmg: drop broken bdrv_pread() loop > > dmg: use appropriate types when reading chunks > > dmg: sanitize chunk length and sectorcount (CVE-2014-0145) > > dmg: use uint64_t consistently for sectors and lengths > > dmg: prevent chunk buffer overflow (CVE-2014-0145) > > aio: fix qemu_bh_schedule() bh->ctx race condition > > > > Stefan Weil (3): > > tests: Fix 'make test' for i686 hosts (build regression) > > configure: Don't use __int128_t for clang versions before 3.2 > > cputlb: Fix regression with TCG interpreter (bug 1310324) > > > > Thomas Huth (2): > > s390x/virtio-hcall: Add range check for hypervisor call > > s390x/helper: Added format control bit to MMU translation > > > > Ulrich Obergfell (1): > > scsi-disk: fix bug in scsi_block_new_request() introduced by commit > > 137745c > > > > arch_init.c | 96 ++++---- > > async.c | 14 +- > > block.c | 40 ++-- > > block/bochs.c | 109 +++++---- > > block/cloop.c | 81 ++++++- > > block/curl.c | 5 + > > block/dmg.c | 275 > > +++++++++++++--------- > > block/iscsi.c | 5 +- > > block/mirror.c | 37 +-- > > block/parallels.c | 14 +- > > block/qapi.c | 1 + > > block/qcow.c | 43 +++- > > block/qcow2-cluster.c | 11 +- > > block/qcow2-refcount.c | 119 ++++++---- > > block/qcow2-snapshot.c | 35 +-- > > block/qcow2.c | 198 > > ++++++++++++---- > > block/qcow2.h | 48 +++- > > block/sheepdog.c | 4 +- > > block/vdi.c | 31 ++- > > block/vhdx.c | 12 +- > > block/vmdk.c | 2 +- > > block/vpc.c | 32 ++- > > block/vvfat.c | 6 +- > > blockdev-nbd.c | 9 +- > > blockdev.c | 11 +- > > configure | 5 + > > coroutine-win32.c | 13 +- > > cputlb.c | 6 +- > > docs/migration.txt | 12 +- > > hw/arm/omap1.c | 14 +- > > hw/arm/omap2.c | 2 +- > > hw/arm/pxa2xx.c | 12 +- > > hw/arm/spitz.c | 4 +- > > hw/arm/z2.c | 2 +- > > hw/char/virtio-serial-bus.c | 16 +- > > hw/core/irq.c | 4 +- > > hw/display/ssd0323.c | 24 ++ > > hw/dma/omap_dma.c | 4 +- > > hw/gpio/zaurus.c | 10 + > > hw/i386/acpi-build.c | 7 +- > > hw/i386/kvm/clock.c | 52 ++++ > > hw/i386/kvm/pci-assign.c | 12 +- > > hw/ide/ahci.c | 2 +- > > hw/ide/core.c | 2 +- > > hw/ide/microdrive.c | 2 +- > > hw/input/tsc210x.c | 12 + > > hw/intc/openpic.c | 16 +- > > hw/misc/cbus.c | 6 +- > > hw/net/stellaris_enet.c | 23 +- > > hw/net/virtio-net.c | 43 +++- > > hw/net/vmxnet3.c | 58 ++++- > > hw/pci/pci.c | 6 +- > > hw/pci/pcie_aer.c | 10 +- > > hw/pcmcia/pxa2xx.c | 2 +- > > hw/ppc/spapr_pci.c | 16 ++ > > hw/s390x/css.c | 24 +- > > hw/s390x/s390-virtio-hcall.c | 11 +- > > hw/scsi/megasas.c | 17 ++ > > hw/scsi/mfi.h | 9 + > > hw/scsi/scsi-bus.c | 2 +- > > hw/scsi/scsi-disk.c | 2 +- > > hw/scsi/scsi-generic.c | 2 - > > hw/scsi/spapr_vscsi.c | 1 - > > hw/scsi/virtio-scsi.c | 12 +- > > hw/sd/omap_mmc.c | 2 +- > > hw/sd/sdhci.c | 8 +- > > hw/sd/ssi-sd.c | 9 + > > hw/sh4/sh7750.c | 3 +- > > hw/ssi/pl022.c | 14 ++ > > hw/timer/hpet.c | 13 + > > hw/timer/omap_gptimer.c | 4 +- > > hw/usb/bus.c | 4 +- > > hw/usb/dev-bluetooth.c | 24 +- > > hw/virtio/vhost.c | 10 +- > > hw/virtio/virtio.c | 25 +- > > include/hw/scsi/scsi.h | 2 +- > > include/hw/virtio/virtio-net.h | 4 +- > > include/migration/vmstate.h | 11 +- > > kvm-all.c | 2 +- > > linux-user/elfload.c | 115 +++++++-- > > linux-user/syscall.c | 16 ++ > > migration-rdma.c | 20 +- > > migration.c | 2 +- > > nbd.c | 7 +- > > net/tap.c | 7 +- > > po/Makefile | 4 +- > > qemu-char.c | 17 +- > > qemu-img.c | 2 +- > > qemu-nbd.c | 5 +- > > qga/commands-win32.c | 6 +- > > qom/object.c | 14 +- > > savevm.c | 136 ++++++----- > > scripts/qapi-commands.py | 2 +- > > target-arm/helper.c | 8 +- > > target-arm/machine.c | 2 +- > > target-arm/translate.c | 34 ++- > > target-i386/cc_helper.c | 2 +- > > target-i386/cpu.c | 5 +- > > target-i386/cpu.h | 4 +- > > target-i386/translate.c | 46 +++- > > target-s390x/cpu.h | 4 + > > target-s390x/helper.c | 70 ++++-- > > target-s390x/kvm.c | 28 +++ > > target-xtensa/translate.c | 4 +- > > tcg/i386/tcg-target.c | 3 +- > > tests/qemu-iotests/026.out | 6 +- > > tests/qemu-iotests/029 | 40 +++- > > tests/qemu-iotests/029.out | 17 ++ > > tests/qemu-iotests/039 | 20 ++ > > tests/qemu-iotests/039.out | 11 + > > tests/qemu-iotests/044.out | 2 +- > > tests/qemu-iotests/075 | 106 +++++++++ > > tests/qemu-iotests/075.out | 38 +++ > > tests/qemu-iotests/076 | 76 ++++++ > > tests/qemu-iotests/076.out | 18 ++ > > tests/qemu-iotests/078 | 87 +++++++ > > tests/qemu-iotests/078.out | 26 ++ > > tests/qemu-iotests/080 | 180 ++++++++++++++ > > tests/qemu-iotests/080.out | 83 +++++++ > > tests/qemu-iotests/088 | 64 +++++ > > tests/qemu-iotests/088.out | 17 ++ > > tests/qemu-iotests/092 | 98 ++++++++ > > tests/qemu-iotests/092.out | 38 +++ > > tests/qemu-iotests/common | 21 ++ > > tests/qemu-iotests/common.rc | 3 + > > tests/qemu-iotests/group | 6 + > > tests/qemu-iotests/sample_images/empty.bochs.bz2 | Bin 0 -> 118 bytes > > tests/qemu-iotests/sample_images/fake.parallels.bz2 | Bin 0 -> 141 bytes > > .../sample_images/simple-pattern.cloop.bz2 | Bin 0 -> 488 bytes > > tests/tcg/test_path.c | 13 +- > > trace-events | 3 +- > > ui/vnc-enc-tight.c | 2 +- > > 132 files changed, 2692 insertions(+), 696 deletions(-) > > create mode 100755 tests/qemu-iotests/075 > > create mode 100644 tests/qemu-iotests/075.out > > create mode 100755 tests/qemu-iotests/076 > > create mode 100644 tests/qemu-iotests/076.out > > create mode 100755 tests/qemu-iotests/078 > > create mode 100644 tests/qemu-iotests/078.out > > create mode 100755 tests/qemu-iotests/080 > > create mode 100644 tests/qemu-iotests/080.out > > create mode 100755 tests/qemu-iotests/088 > > create mode 100644 tests/qemu-iotests/088.out > > create mode 100755 tests/qemu-iotests/092 > > create mode 100644 tests/qemu-iotests/092.out > > create mode 100644 tests/qemu-iotests/sample_images/empty.bochs.bz2 > > create mode 100644 tests/qemu-iotests/sample_images/fake.parallels.bz2 > > create mode 100644 > > tests/qemu-iotests/sample_images/simple-pattern.cloop.bz2 > > > > > -- > Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK
