qemu/qemu.git, branch stable-6.0

Update version for 6.0.1 release

2021-10-28T23:10:51+00:00

Signed-off-by: Michael Roth

Partially revert "build: -no-pie is no functional linker flag"

2021-10-27T17:01:30+00:00

This partially reverts commit bbd2d5a8120771ec59b86a80a1f51884e0a26e53. This commit was misguided and broke using --disable-pie on any distro that enables PIE by default in their compiler driver, including Debian and its derivatives. Whilst -no-pie is not a linker flag, it is a compiler driver flag that ensures -pie is not automatically passed by it to the linker. Without it, all compile_prog checks will fail as any code built with the explicit -fno-pie will fail to link with the implicit default -pie due to trying to use position-dependent relocations. The only bug that needed fixing was LDFLAGS_NOPIE being used as a flag for the linker itself in pc-bios/optionrom/Makefile. Note this does not reinstate exporting LDFLAGS_NOPIE, as it is unused, since the only previous use was the one that should not have existed. I have also updated the comment for the -fno-pie and -no-pie checks to reflect what they're actually needed for. Fixes: bbd2d5a8120771ec59b86a80a1f51884e0a26e53 Cc: Christian Ehrhardt Cc: Paolo Bonzini Cc: qemu-stable@nongnu.org Signed-off-by: Jessica Clarke Reviewed-by: Richard Henderson Signed-off-by: Michael Roth

hw/display/artist: Fix bug in coordinate extraction in artist_vram_read() and artist_vram_write()

2021-10-27T16:57:47+00:00

The CDE desktop on HP-UX 10 shows wrongly rendered pixels when the local screen menu is closed. This bug was introduced by commit c7050f3f167b ("hw/display/artist: Refactor x/y coordination extraction") which converted the coordinate extraction in artist_vram_read() and artist_vram_write() to use the ADDR_TO_X and ADDR_TO_Y macros, but forgot to right-shift the address by 2 as it was done before. Signed-off-by: Helge Deller Fixes: c7050f3f167b ("hw/display/artist: Refactor x/y coordination extraction") Cc: Philippe Mathieu-Daudé Cc: Richard Henderson Cc: Sven Schnelle Reviewed-by: Philippe Mathieu-Daudé Message-Id: Signed-off-by: Gerd Hoffmann (cherry picked from commit 01f750f5fef1afd8f6abc0548910f87d473e26d5) Signed-off-by: Michael Roth

libvhost-user: fix VHOST_USER_REM_MEM_REG skipping mmap_addr

2021-10-27T16:50:35+00:00

We end up not copying the mmap_addr of all existing regions, resulting in a SEGFAULT once we actually try to map/access anything within our memory regions. Fixes: 875b9fd97b34 ("Support individual region unmap in libvhost-user") Cc: qemu-stable@nongnu.org Cc: Michael S. Tsirkin Cc: Raphael Norwitz Cc: "Marc-André Lureau" Cc: Stefan Hajnoczi Cc: Paolo Bonzini Cc: Coiby Xu Signed-off-by: David Hildenbrand Message-Id: <20211011201047.62587-1-david@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Raphael Norwitz Reviewed-by: Stefan Hajnoczi (cherry picked from commit 6889eb2d431ae962e3e083b57bff47cd573cb1c4) Signed-off-by: Michael Roth

vhost-user: fix duplicated notifier MR init

2021-10-27T16:49:50+00:00

In case of device resume after suspend, VQ notifier MR still valid. Duplicated registrations explode memory block list and slow down device resume. Fixes: 44866521bd6e ("vhost-user: support registering external host notifiers") Cc: tiwei.bie@intel.com Cc: qemu-stable@nongnu.org Cc: Yuwei Zhang Signed-off-by: Xueming Li Message-Id: <20211008080215.590292-1-xuemingl@nvidia.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit a1ed9ef1de87c3e86ff68589604298ec90875a14) Signed-off-by: Michael Roth

pvrdma: Fix the ring init error flow (CVE-2021-3608)

2021-10-18T01:27:51+00:00

Do not unmap uninitialized dma addresses. Fixes: CVE-2021-3608 Reviewed-by: VictorV (Kunlun Lab) Tested-by: VictorV (Kunlun Lab) Signed-off-by: Marcel Apfelbaum Message-Id: <20210630115246.2178219-1-marcel@redhat.com> Tested-by: Yuval Shaia Reviewed-by: Yuval Shaia Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marcel Apfelbaum (cherry picked from commit 66ae37d8cc313f89272e711174a846a229bcdbd3) Signed-off-by: Michael Roth

pvrdma: Ensure correct input on ring init (CVE-2021-3607)

2021-10-18T01:27:24+00:00

Check the guest passed a non zero page count for pvrdma device ring buffers. Fixes: CVE-2021-3607 Reported-by: VictorV (Kunlun Lab) Reviewed-by: VictorV (Kunlun Lab) Signed-off-by: Marcel Apfelbaum Message-Id: <20210630114634.2168872-1-marcel@redhat.com> Reviewed-by: Yuval Shaia Tested-by: Yuval Shaia Signed-off-by: Marcel Apfelbaum (cherry picked from commit 32e5703cfea07c91e6e84bcb0313f633bb146534) Signed-off-by: Michael Roth

hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)

2021-10-18T01:27:12+00:00

Ensure mremap boundaries not trusting the guest kernel to pass the correct buffer length. Fixes: CVE-2021-3582 Reported-by: VictorV (Kunlun Lab) Tested-by: VictorV (Kunlun Lab) Signed-off-by: Marcel Apfelbaum Message-Id: <20210616110600.20889-1-marcel.apfelbaum@gmail.com> Reviewed-by: Yuval Shaia Tested-by: Yuval Shaia Reviewed-by: Prasad J Pandit Signed-off-by: Marcel Apfelbaum (cherry picked from commit 284f191b4abad213aed04cb0458e1600fd18d7c4) Signed-off-by: Michael Roth

vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)

2021-10-18T01:26:37+00:00

If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: Li Qiang Reviewed-by: Prasad J Pandit Signed-off-by: Li Qiang Reviewed-by: Marc-André Lureau Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann (cherry picked from commit 9f22893adcb02580aee5968f32baa2cd109b3ec2) Signed-off-by: Michael Roth

vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544)

2021-10-18T01:26:28+00:00

If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will be leaked. Fixes: CVE-2021-3544 Reported-by: Li Qiang virtio-gpu fix: 33243031da ("virtio-gpu-3d: fix memory leak in resource attach backing") Signed-off-by: Li Qiang Reviewed-by: Marc-André Lureau Message-Id: <20210516030403.107723-7-liq3ea@163.com> Signed-off-by: Gerd Hoffmann (cherry picked from commit 63736af5a6571d9def93769431e0d7e38c6677bf) Signed-off-by: Michael Roth