qemu/qemu.git, branch stable-1.6

Update VERSION for 1.6.2 release

2013-12-10T00:21:01+00:00

Signed-off-by: Michael Roth

scsi_target_send_command(): amend stable-1.6 port of the CVE-2013-4344 fix

2013-12-09T20:49:49+00:00

The originally suggested fix for CVE-2013-4344 introduced a regression in scsi_target_send_command() / REQUEST_SENSE; the third argument passed to scsi_device_get_sense() -- for the "len" parameter -- ignored the possibility of the guest SCSI driver requesting truncated (or shorter than full) sense data. This could result in (r->len > req->cmd.xfer) on return, which is not valid SCSI. The problem was addressed in the second round, and the commit on the master branch (84642435) is correct. However the stable-1.6 branch (the v1.6.1 release) has the original, regressive fix (commit fdcbe7d5); let's update it. Signed-off-by: Laszlo Ersek Reviewed-by: Paolo Bonzini Signed-off-by: Michael Roth

qemu-ga: execute fsfreeze-freeze in reverse order of mounts

2013-12-09T20:45:41+00:00

Currently, fsfreeze-freeze may cause deadlock if a guest has loopback mounts of image files in its disk; e.g.: # mount | grep ^/ /dev/vda1 / type ext4 (rw,noatime,seclabel,data=ordered) /tmp/disk.img on /mnt type ext4 (rw,relatime,seclabel) To avoid the deadlock, this freezes filesystems in reverse order of mounts. Signed-off-by: Tomoki Sekiyama Reviewed-by: Eric Blake *fix up commit msg Signed-off-by: Michael Roth (cherry picked from commit e5d9adbdab972a2172815c1174aed3fabcc448f1) Signed-off-by: Michael Roth

target-mips: fix 64-bit FPU config for user-mode emulation

2013-12-09T20:42:33+00:00

FR bit should be initialized to 1 for MIPS64, under condition that this bit is writable and that CPU has an FPU unit. It should be initialized to zero for MIPS32. This fixes different MIPS32 issues with FPU instructions whose behaviour defaulted to 64-bit FPU mode. Signed-off-by: Petar Jovanovic Signed-off-by: Aurelien Jarno (cherry picked from commit 4d66261f71f2efa31e1052e4041c5ee505572fe5) Signed-off-by: Michael Roth

seccomp: add kill() to the syscall whitelist

2013-12-09T17:40:30+00:00

The kill() syscall is triggered with the following command: # qemu -sandbox on -monitor stdio \ -device intel-hda -device hda-duplex -vnc :0 The resulting syslog/audit message: # ausearch -m SECCOMP ---- time->Wed Nov 20 09:52:08 2013 type=SECCOMP msg=audit(1384912328.482:6656): auid=0 uid=0 gid=0 ses=854 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=12087 comm="qemu-kvm" sig=31 syscall=62 compat=0 ip=0x7f7a1d2abc67 code=0x0 # scmp_sys_resolver 62 kill Reported-by: CongLi Tested-by: CongLi Signed-off-by: Paul Moore Acked-by: Eduardo Otubo (cherry picked from commit e9eecb5bf82a71564bf018fcbbfc6cda19cab6c2) Signed-off-by: Michael Roth

vmdk: Fix creating big description file

2013-12-09T17:40:30+00:00

The buffer for description file was 4096 which only covers a few hundred of extents. This changes the buffer to dynamic allocated with g_strdup_printf in order to support bigger cases. Signed-off-by: Fam Zheng Signed-off-by: Stefan Hajnoczi (cherry picked from commit af057fe74092df2e7a576448ddbdc0daac1370bf) Conflicts: block/vmdk.c tests/qemu-iotests/059 tests/qemu-iotests/059.out *removed dependencies on 4823970b and 4f6fd349 Signed-off-by: Michael Roth

qcow2: Zero-initialise first cluster for new images

2013-12-09T17:40:30+00:00

Strictly speaking, this is only required for has_zero_init() == false, but it's easy enough to just do a cluster-aligned write that is padded with zeros after the header. This fixes that after 'qemu-img create' header extensions are attempted to be parsed that are really just random leftover data. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf Reviewed-by: Fam Zheng Reviewed-by: Paolo Bonzini Signed-off-by: Stefan Hajnoczi (cherry picked from commit f8413b3c23b08a547ce18609acc6fae5fd04ed5c) Signed-off-by: Michael Roth

vfio-pci: Release all MSI-X vectors when disabled

2013-12-09T17:40:30+00:00

We were relying on msix_unset_vector_notifiers() to release all the vectors when we disable MSI-X, but this only happens when MSI-X is still enabled on the device. Perform further cleanup by releasing any remaining vectors listed as in-use after this call. This caused a leak of IRQ routes on hotplug depending on how the guest OS prepared the device for removal. Signed-off-by: Alex Williamson Cc: qemu-stable@nongnu.org (cherry picked from commit 3e40ba0faf0822fa78336fe6cd9d677ea9b14f1b) Signed-off-by: Michael Roth

rng-egd: offset the point when repeatedly read from the buffer

2013-12-09T17:40:30+00:00

The buffer content might be read out more than once, currently we just repeatedly read the first data block, buffer offset is missing. Cc: qemu-stable@nongnu.org Signed-off-by: Amos Kong Message-id: 1385023371-8198-3-git-send-email-akong@redhat.com Signed-off-by: Anthony Liguori (cherry picked from commit 1eb1bd9eafa890f1f4d16ef5cb8b9239a86874d9) Signed-off-by: Michael Roth

pci: unregister vmstate_pcibus on unplug

2013-12-09T17:40:30+00:00

PCIBus registers a vmstate during init. Unregister it upon removal/unplug. Signed-off-by: Bandan Das Cc: qemu-stable@nongnu.org Reviewed-by: Andreas Färber Signed-off-by: Michael S. Tsirkin (cherry picked from commit 5c397242d5d53c1adecce31817bb439383cf8228) Signed-off-by: Michael Roth