[Qemu-commits] [qemu/qemu] b02c2a: hw/nvme: Use #define to avoid variable length array

[Alex Bennée]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: b02c2a85a6c8e5ecc1bfca1ef794b5897c9ebad3
      
https://github.com/qemu/qemu/commit/b02c2a85a6c8e5ecc1bfca1ef794b5897c9ebad3
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2023-09-12 (Tue, 12 Sep 2023)

  Changed paths:
    M hw/nvme/ctrl.c

  Log Message:
  -----------
  hw/nvme: Use #define to avoid variable length array

In nvme_map_sgl() we create an array segment[] whose size is the
'const int SEG_CHUNK_SIZE'.  Since this is C, rather than C++, a
"const int foo" is not a true constant, it's merely a variable with a
constant value, and so semantically segment[] is a variable-length
array.  Switch SEG_CHUNK_SIZE to a #define so that we can make the
segment[] array truly fixed-size, in the sense that it doesn't
trigger the -Wvla warning.

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

[PMM: rebased (function has moved file), expand commit message
 based on discussion from previous version of patch]

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>


  Commit: b3c8246750b7077add335559341268f2956f6470
      
https://github.com/qemu/qemu/commit/b3c8246750b7077add335559341268f2956f6470
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-09-12 (Tue, 12 Sep 2023)

  Changed paths:
    M hw/nvme/ctrl.c

  Log Message:
  -----------
  hw/nvme: Avoid dynamic stack allocation

Instead of using a variable-length array in nvme_map_prp(),
allocate on the stack with a g_autofree pointer.

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>


  Commit: fb0a8b0e238277296907ffe765bf76874cfc1df6
      
https://github.com/qemu/qemu/commit/fb0a8b0e238277296907ffe765bf76874cfc1df6
  Author: Jonathan Perkin <jonathan@perkin.org.uk>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M meson.build
    M net/meson.build

  Log Message:
  -----------
  meson: Fix targetos match for illumos and Solaris.

qemu 8.1.0 breaks on illumos platforms due to _XOPEN_SOURCE and others no 
longer being set correctly, leading to breakage such as:

  
https://us-central.manta.mnx.io/pkgsrc/public/reports/trunk/tools/20230908.1404/qemu-8.1.0/build.log

This is a result of meson conversion which incorrectly matches against 
'solaris' instead of 'sunos' for uname.

First time submitting a patch here, hope I did it correctly.  Thanks.

Signed-off-by: Jonathan Perkin <jonathan@perkin.org.uk>
Message-ID: <ZPtdxtum9UVPy58J@perkin.org.uk>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 652a5f22d8312231a50d64ad4c1826947ac5b9a6
      
https://github.com/qemu/qemu/commit/652a5f22d8312231a50d64ad4c1826947ac5b9a6
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M target/i386/cpu.c

  Log Message:
  -----------
  target/i386: Check kvm_hyperv_expand_features() return value

In case more code is added after the kvm_hyperv_expand_features()
call, check its return value (since it can fail).

Fixes: 071ce4b03b ("i386: expand Hyper-V features during CPU feature expansion 
time")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230913093009.83520-2-philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: da472f94871e334ad8123d289df77f17d59f54f7
      
https://github.com/qemu/qemu/commit/da472f94871e334ad8123d289df77f17d59f54f7
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M target/i386/cpu.c

  Log Message:
  -----------
  target/i386: Drop accel_uses_host_cpuid before x86_cpu_get_supported_cpuid

x86_cpu_get_supported_cpuid() already checks for KVM/HVF
accelerators, so it is not needed to manually check it via
a call to accel_uses_host_cpuid() before calling it.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230913093009.83520-3-philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: d04740243604389b6f05baa28fe3a28f016ed37b
      
https://github.com/qemu/qemu/commit/d04740243604389b6f05baa28fe3a28f016ed37b
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M target/i386/cpu.c

  Log Message:
  -----------
  target/i386: Call accel-agnostic x86_cpu_get_supported_cpuid()

x86_cpu_get_supported_cpuid() is generic and handles the different
accelerators. Use it instead of kvm_arch_get_supported_cpuid().

That fixes a link failure introduced by commit 3adce820cf
("target/i386: Remove unused KVM stubs") when QEMU is configured
as:

  $ ./configure --cc=clang \
    --target-list=x86_64-linux-user,x86_64-softmmu \
    --enable-debug

We were getting:

  [71/71] Linking target qemu-x86_64
  FAILED: qemu-x86_64
  /usr/bin/ld: libqemu-x86_64-linux-user.fa.p/target_i386_cpu.c.o: in function 
`cpu_x86_cpuid':
  cpu.c:(.text+0x1374): undefined reference to `kvm_arch_get_supported_cpuid'
  /usr/bin/ld: libqemu-x86_64-linux-user.fa.p/target_i386_cpu.c.o: in function 
`x86_cpu_filter_features':
  cpu.c:(.text+0x81c2): undefined reference to `kvm_arch_get_supported_cpuid'
  /usr/bin/ld: cpu.c:(.text+0x81da): undefined reference to 
`kvm_arch_get_supported_cpuid'
  /usr/bin/ld: cpu.c:(.text+0x81f2): undefined reference to 
`kvm_arch_get_supported_cpuid'
  /usr/bin/ld: cpu.c:(.text+0x820a): undefined reference to 
`kvm_arch_get_supported_cpuid'
  /usr/bin/ld: 
libqemu-x86_64-linux-user.fa.p/target_i386_cpu.c.o:cpu.c:(.text+0x8225): more 
undefined references to `kvm_arch_get_supported_cpuid' follow
  clang: error: linker command failed with exit code 1 (use -v to see 
invocation)
  ninja: build stopped: subcommand failed.

For the record, this is because '--enable-debug' disables
optimizations (CFLAGS=-O0).

While at this (un)optimization level GCC eliminate the
following dead code (CPP output of mentioned build):

 static void x86_cpu_get_supported_cpuid(uint32_t func, uint32_t index,
                                         uint32_t *eax, uint32_t *ebx,
                                         uint32_t *ecx, uint32_t *edx)
 {
     if ((0)) {
         *eax = kvm_arch_get_supported_cpuid(kvm_state, func, index, R_EAX);
         *ebx = kvm_arch_get_supported_cpuid(kvm_state, func, index, R_EBX);
         *ecx = kvm_arch_get_supported_cpuid(kvm_state, func, index, R_ECX);
         *edx = kvm_arch_get_supported_cpuid(kvm_state, func, index, R_EDX);
     } else if (0) {
         *eax = 0;
         *ebx = 0;
         *ecx = 0;
         *edx = 0;
     } else {
         *eax = 0;
         *ebx = 0;
         *ecx = 0;
         *edx = 0;
     }

Clang does not (see commit 2140cfa51d "i386: Fix build by
providing stub kvm_arch_get_supported_cpuid()").

Cc: qemu-stable@nongnu.org
Fixes: 3adce820cf ("target/i386: Remove unused KVM stubs")
Reported-by: Kevin Wolf <kwolf@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230913093009.83520-4-philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 8e32ddff69b6b4547cc00592ad816484e160817a
      
https://github.com/qemu/qemu/commit/8e32ddff69b6b4547cc00592ad816484e160817a
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M backends/tpm/tpm_util.c

  Log Message:
  -----------
  tpm: fix crash when FD >= 1024 and unnecessary errors due to EINTR

Replace select() with poll() to fix a crash when QEMU has a large number
of FDs. Also use RETRY_ON_EINTR to avoid unnecessary errors due to EINTR.

Cc: qemu-stable@nongnu.org
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2020133
Fixes: 56a3c24ffc ("tpm: Probe for connected TPM 1.2 or TPM 2")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>


  Commit: 6c71b8a585383cc33c388778c2a4319bd627bba3
      
https://github.com/qemu/qemu/commit/6c71b8a585383cc33c388778c2a4319bd627bba3
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M hw/nvme/ctrl.c

  Log Message:
  -----------
  Merge tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu into 
staging

hw/nvme updates

Two fixes for dynamic array allocation.

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmUAc8AACgkQTeGvMW1P
# DelwhQgAxD7imw85V89Dz58LgrFoq5XZz2cq6Q5BsudyZd8FW5r7lOn9c1i0Yu2x
# iiP93FX0b5LPQ9/8/liz3oHu1HZ7+hX+VeDZSQ1/bugfXM/eDSPA7lf7GG1np312
# 9lKRs8o+T4Di7v93kdiEi6G3b0jQSmZ722aMa54isk58hy1mcUTnGxvPZpVZutTP
# lYhwuElQIsnnKXB0jaRlpcDkpXdHJ1wwziaYLM7pus+tElMiSkFP05j2pX9iigKu
# 7g+Hs+DaqrOzdoF/6uu72IKygq3/5H8iou1No/7OICWbFti5Qhhra0OKQE6nrlKd
# 51fnWA6VjpO5g9+diwRRYbjEiOrkqQ==
# =wn4B
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 12 Sep 2023 10:20:48 EDT
# gpg:                using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg:                 aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468  4272 63D5 6FC5 E55D A838
#      Subkey fingerprint: 5228 33AA 75E2 DCE6 A247  66C0 4DE1 AF31 6D4F 0DE9

* tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu:
  hw/nvme: Avoid dynamic stack allocation
  hw/nvme: Use #define to avoid variable length array

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


  Commit: 6a2557c2387d566774d468748ccff597dc8ede10
      
https://github.com/qemu/qemu/commit/6a2557c2387d566774d468748ccff597dc8ede10
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M meson.build
    M net/meson.build
    M target/i386/cpu.c

  Log Message:
  -----------
  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* target/i386: fix non-optimized compilation on clang
* fix detection of Solaris/IllumOS

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmUBj8cUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOP7QgApdNqHKH4zNbBRPk/cxYDZEd0maPl
# nolD0eBts5ZWDYnQk/fFzHflzh/b5F119xv9H3fB86i/D2JNUMdqFR8QmQr9ZwEW
# izjXe8CdWto4dsW2RQbxGihThjMGu5BTZucqKSvLiZcyTQhPhwZ917Jo9YM5k072
# /1ECrCZYmCr2RECyNG6/zRrph8hustz5O0QEL65YhqK8ztttr+7E33m3CJ1fGEDy
# nbXu/WKrUxG20ohQJJ7Slpt9XTBGQXlfUO5gSg3nxkS9xqOjc15sCh+yit4gvS8f
# IDi8xD2JTWP05xQppSv33plEvmi+KrCY8d965isRsVbzPh5qB2osBoAa/A==
# =bOr3
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 13 Sep 2023 06:32:39 EDT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  target/i386: Call accel-agnostic x86_cpu_get_supported_cpuid()
  target/i386: Drop accel_uses_host_cpuid before x86_cpu_get_supported_cpuid
  target/i386: Check kvm_hyperv_expand_features() return value
  meson: Fix targetos match for illumos and Solaris.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


  Commit: 005ad32358f12fe9313a4a01918a55e60d4f39e5
      
https://github.com/qemu/qemu/commit/005ad32358f12fe9313a4a01918a55e60d4f39e5
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2023-09-13 (Wed, 13 Sep 2023)

  Changed paths:
    M backends/tpm/tpm_util.c

  Log Message:
  -----------
  Merge tag 'pull-tpm-2023-09-12-3' of https://github.com/stefanberger/qemu-tpm 
into staging

Merge tpm 2023/09/12 v3

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEuBi5yt+QicLVzsZrda1lgCoLQhEFAmUBrwgACgkQda1lgCoL
# QhG9PQgA5drE1s0dYGkAIZimOsRKvduMV/kqeTmqnhGSUBM9jnYLWssnuG7/nDAi
# IXTqoKOzw27TGZKNiKuCO7PvlKCeirPEk7KmHk2JrxjC/QjtExMZLF700eLemP9/
# RBKwHerT8mLAkVuIGFvFgU9nQRrg/YX6kSvOFBJEl4XBn4w/vyY7gp3QbJgqcl36
# jrL7qJXrxQnT0BRRy+NlmmG3WswIY6xZpURdYKWMAINeNSH2DW2JxiDov2+fUVWH
# jp7SKBzCsXvD/RjRz1WWRpsrz3EtC7LiaLiB685XZsMcavb1zy0Pj7pchjr6NkwF
# 2gTWFPr/YG/eYoodtix2r2ElG4hyJQ==
# =WBnS
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 13 Sep 2023 08:46:00 EDT
# gpg:                using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" 
[unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE  C66B 75AD 6580 2A0B 4211

* tag 'pull-tpm-2023-09-12-3' of https://github.com/stefanberger/qemu-tpm:
  tpm: fix crash when FD >= 1024 and unnecessary errors due to EINTR

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


Compare: https://github.com/qemu/qemu/compare/9a8af699677c...005ad32358f1