[Qemu-commits] [qemu/qemu] 24c760: block/iscsi: reenable iscsi_co_get_block_status

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 24c7608a5d973e5d562715998e9887f74deac794
      
https://github.com/qemu/qemu/commit/24c7608a5d973e5d562715998e9887f74deac794
  Author: Peter Lieven <address@hidden>
  Date:   2013-10-09 (Wed, 09 Oct 2013)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  block/iscsi: reenable iscsi_co_get_block_status

Commit f35c934a accidently disabled iscsi_co_get_block_status for all
libiscsi versions. Its not possible to check for enumeration constants
in the C preprocessor. This patch changes the check to the preprocessor
constant LIBISCSI_FEATURE_IOVECTOR which was introduced shortly after
get_lba_status support was added to libiscsi.

Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 846424350b292f16b732b573273a5c1f195cd7a3
      
https://github.com/qemu/qemu/commit/846424350b292f16b732b573273a5c1f195cd7a3
  Author: Asias He <address@hidden>
  Date:   2013-10-09 (Wed, 09 Oct 2013)

  Changed paths:
    M hw/scsi/scsi-bus.c
    M include/hw/scsi/scsi.h

  Log Message:
  -----------
  scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]

r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at
most. If more than 256 luns are specified by user, we have buffer
overflow in scsi_target_emulate_report_luns.

To fix, we allocate the buffer dynamically.

Signed-off-by: Asias He <address@hidden>
Tested-by: Michael Roth <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: a76f48e53382e6f039db6278443e3ce437653302
      
https://github.com/qemu/qemu/commit/a76f48e53382e6f039db6278443e3ce437653302
  Author: Matthew Daley <address@hidden>
  Date:   2013-10-10 (Thu, 10 Oct 2013)

  Changed paths:
    M hw/block/xen_disk.c

  Log Message:
  -----------
  xen_disk: mark ioreq as mapped before unmapping in error case

Commit 4472beae modified the semantics of ioreq_{un,}map so that they are
idempotent if called when they're not needed (ie., twice in a row). However,
it neglected to handle the case where batch mapping is not being used (the
default), and one of the grants fails to map. In this case, ioreq_unmap will
be called to unwind and unmap any mappings already performed, but ioreq_unmap
simply returns due to the aforementioned change (the ioreq has not already
been marked as mapped).

The frontend user can therefore force xen_disk to leak grant mappings, a
per-domain limited resource.

Fix by marking the ioreq as mapped before calling ioreq_unmap in this
situation.

Signed-off-by: Matthew Daley <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>


  Commit: 33876dfad64bc481f59c5e9ccf60db78624c4b93
      
https://github.com/qemu/qemu/commit/33876dfad64bc481f59c5e9ccf60db78624c4b93
  Author: Roger Pau Monné <address@hidden>
  Date:   2013-10-10 (Thu, 10 Oct 2013)

  Changed paths:
    M hw/xen/xen_backend.c
    M xen-all.c

  Log Message:
  -----------
  qemu/xen: make use of xenstore relative paths

Qemu has several hardcoded xenstore paths that are only valid on Dom0.
Attempts to launch a Qemu instance (to act as a userspace backend for
PV disks) will fail because Qemu is not able to access those paths
when running on a domain different than Dom0.

Instead make the xenstore paths relative to the domain where Qemu is
actually running.

Signed-off-by: Roger Pau Monné <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
Reviewed-by: Anthony PERARD <address@hidden>
Cc: address@hidden
Cc: Anthony PERARD <address@hidden>


  Commit: c4ca6901582c00a2d13368520779e4948b184071
      
https://github.com/qemu/qemu/commit/c4ca6901582c00a2d13368520779e4948b184071
  Author: Anthony Liguori <address@hidden>
  Date:   2013-10-10 (Thu, 10 Oct 2013)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  Update email address

Amazon is now funding my work as QEMU maintainer so update addresses
accordingly.

Signed-off-by: Anthony Liguori <address@hidden>


  Commit: 634ebf4b177723f2cf329a719f31913cf9ce5de6
      
https://github.com/qemu/qemu/commit/634ebf4b177723f2cf329a719f31913cf9ce5de6
  Author: Anthony Liguori <address@hidden>
  Date:   2013-10-10 (Thu, 10 Oct 2013)

  Changed paths:
    M block/iscsi.c
    M hw/scsi/scsi-bus.c
    M include/hw/scsi/scsi.h

  Log Message:
  -----------
  Merge remote-tracking branch 'bonzini/scsi-next' into staging

# By Asias He (1) and Peter Lieven (1)
# Via Paolo Bonzini
* bonzini/scsi-next:
  scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]
  block/iscsi: reenable iscsi_co_get_block_status

Message-id: address@hidden
Signed-off-by: Anthony Liguori <address@hidden>


  Commit: f2c6bcfc2e15e1dc5c69c3e579ff2063068ecb85
      
https://github.com/qemu/qemu/commit/f2c6bcfc2e15e1dc5c69c3e579ff2063068ecb85
  Author: Anthony Liguori <address@hidden>
  Date:   2013-10-10 (Thu, 10 Oct 2013)

  Changed paths:
    M hw/block/xen_disk.c
    M hw/xen/xen_backend.c
    M xen-all.c

  Log Message:
  -----------
  Merge remote-tracking branch 'sstabellini/xen-2013-10-10' into staging

# By Matthew Daley (1) and Roger Pau Monné (1)
# Via Stefano Stabellini
* sstabellini/xen-2013-10-10:
  qemu/xen: make use of xenstore relative paths
  xen_disk: mark ioreq as mapped before unmapping in error case


Compare: https://github.com/qemu/qemu/compare/a107170537ab...f2c6bcfc2e15