qemu-commits
[Top][All Lists]
Advanced
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] ade007: contrib/rdmacm-mux: Fix out-of-bounds

From: Peter Maydell
Subject: [Qemu-commits] [qemu/qemu] ade007: contrib/rdmacm-mux: Fix out-of-bounds risk
Date: Sun, 17 Mar 2019 06:59:41 -0700 
  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: ade0075523478fa015afd5c6f6cc70681687818d
      
https://github.com/qemu/qemu/commit/ade0075523478fa015afd5c6f6cc70681687818d
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M contrib/rdmacm-mux/main.c

  Log Message:
  -----------
  contrib/rdmacm-mux: Fix out-of-bounds risk

The function get_fd extract context from the received MAD message and
uses it as a key to fetch the destination fd from the mapping table.
A context can be dgid in case of CM request message or comm_id in case
of CM SIDR response message.

When MAD message with a smaller size as expected for the message type
received we are hitting out-of-bounds where we are looking for the
context out of message boundaries.

Fix it by validating the message size.

Reported-by Sam Smith <address@hidden>
Signed-off-by: Yuval Shaia <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 4d71b38ae8fa436f1707fe98b469a9cea4079503
      
https://github.com/qemu/qemu/commit/4d71b38ae8fa436f1707fe98b469a9cea4079503
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_backend.h
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_rm.h
    M hw/rdma/rdma_utils.c
    M hw/rdma/rdma_utils.h
    M hw/rdma/trace-events
    M hw/rdma/vmw/pvrdma.h
    M hw/rdma/vmw/pvrdma_cmd.c
    M hw/rdma/vmw/pvrdma_dev_ring.c
    M hw/rdma/vmw/pvrdma_main.c
    M hw/rdma/vmw/pvrdma_qp_ops.c
    M hw/rdma/vmw/trace-events

  Log Message:
  -----------
  hw/rdma: Switch to generic error reporting way

Utilize error_report for all pr_err calls and some pr_dbg that are
considered as errors.
For the remaining pr_dbg calls, the important ones were replaced by
trace points while other deleted.
Some of the functions got renamed to include prefix "rdma/pvrdma"
in the function name.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: b20fc7951084bb77e867d114c916e409c3a6821a
      
https://github.com/qemu/qemu/commit/b20fc7951084bb77e867d114c916e409c3a6821a
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_backend_defs.h
    M hw/rdma/rdma_utils.c
    M hw/rdma/rdma_utils.h

  Log Message:
  -----------
  hw/rdma: Introduce protected qlist

To make code more readable move handling of protected list to a
rdma_utils

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 2cfa95300908f401f5b9bdf3de734cf6228a2722
      
https://github.com/qemu/qemu/commit/2cfa95300908f401f5b9bdf3de734cf6228a2722
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_rm_defs.h

  Log Message:
  -----------
  hw/rdma: Protect against concurrent execution of poll_cq

The function rdma_poll_cq is called from two contexts - completion
handler thread which sense new completion on backend channel and
explicitly as result of guest issuing poll_cq command.

Add lock to protect against concurrent executions.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: c2dd117b38583f89d6a2e4a6dfc6d693990ffc39
      
https://github.com/qemu/qemu/commit/c2dd117b38583f89d6a2e4a6dfc6d693990ffc39
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_rm_defs.h
    M hw/rdma/vmw/pvrdma.h
    M hw/rdma/vmw/pvrdma_cmd.c
    M hw/rdma/vmw/pvrdma_main.c

  Log Message:
  -----------
  hw/pvrdma: Collect debugging statistics

Add counters to enable enhance debugging

Signed-off-by: Yuval Shaia <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: f4b2c02a2911b164474b998532b1a963fc9b785b
      
https://github.com/qemu/qemu/commit/f4b2c02a2911b164474b998532b1a963fc9b785b
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hmp-commands-info.hx
    M hmp.c
    M hmp.h
    M hw/rdma/Makefile.objs
    A hw/rdma/rdma.c
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_rm.h
    M hw/rdma/vmw/pvrdma_main.c
    A include/hw/rdma/rdma.h

  Log Message:
  -----------
  {hmp, hw/pvrdma}: Expose device internals via monitor interface

Allow interrogating device internals through HMP interface.
The exposed indicators can be used for troubleshooting by developers or
sysadmin.
There is no need to expose these attributes to a management system (e.x.
libvirt) because (1) most of them are not "device-management' related
info and (2) there is no guarantee the interface is stable.

Signed-off-by: Yuval Shaia <address@hidden>
Acked-by: Dr. David Alan Gilbert <address@hidden>
Acked-by: Markus Armbruster <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: ff30a446b1d13373d35417d77d80b11cfde3fc6c
      
https://github.com/qemu/qemu/commit/ff30a446b1d13373d35417d77d80b11cfde3fc6c
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/vmw/pvrdma_main.c

  Log Message:
  -----------
  hw/rdma: Free all MAD receive buffers when device is closed

When device is going down free all saved MAD buffers.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: bf4414515b468c0a4ca69f1450bfe65418022955
      
https://github.com/qemu/qemu/commit/bf4414515b468c0a4ca69f1450bfe65418022955
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_backend.h
    M hw/rdma/rdma_backend_defs.h
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_utils.c
    M hw/rdma/rdma_utils.h

  Log Message:
  -----------
  hw/rdma: Free all receive buffers when QP is destroyed

When QP is destroyed the backend QP is destroyed as well. This ensures
we clean all received buffer we posted to it.
However, a contexts of these buffers are still remain in the device.
Fix it by maintaining a list of buffer's context and free them when QP
is destroyed.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 3c890bcf3088689c4c5f883b5189646f5862a91f
      
https://github.com/qemu/qemu/commit/3c890bcf3088689c4c5f883b5189646f5862a91f
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_backend.h
    M hw/rdma/vmw/pvrdma_qp_ops.c

  Log Message:
  -----------
  hw/pvrdma: Delete unneeded function argument

The function's argument rdma_dev_res is not needed as it is stored in
the backend_dev object at init.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: a2f1dc6091e801514f955af255af89d440e762fc
      
https://github.com/qemu/qemu/commit/a2f1dc6091e801514f955af255af89d440e762fc
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/vmw/pvrdma_main.c

  Log Message:
  -----------
  hw/pvrdma: Delete pvrdma_exit function

This hook is not called and was implemented by mistake.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: b556c3cefcedec0fc892239f017ef7ddaa515311
      
https://github.com/qemu/qemu/commit/b556c3cefcedec0fc892239f017ef7ddaa515311
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/vmw/pvrdma_main.c

  Log Message:
  -----------
  hw/pvrdma: Unregister from shutdown notifier when device goes down

This hook was installed to close the device when VM is going down.
After the device is closed there is no need to be informed on VM
shutdown.

Signed-off-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: db8b88bf2cb5fc6bae421eb0be488e0047008438
      
https://github.com/qemu/qemu/commit/db8b88bf2cb5fc6bae421eb0be488e0047008438
  Author: Yuval Shaia <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/vmw/pvrdma_main.c

  Log Message:
  -----------
  hw/pvrdma: Provide correct value to object_get_typename

Use base object of PCIDevice in call to object_get_typename().

Signed-off-by: Yuval Shaia <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Kamal Heib <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 59f911938fbaa6a5eff1146c8a4d74e1c55ecc2b
      
https://github.com/qemu/qemu/commit/59f911938fbaa6a5eff1146c8a4d74e1c55ecc2b
  Author: Marcel Apfelbaum <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_rm_defs.h

  Log Message:
  -----------
  hw/rdma: another clang compilation fix

Configuring QEMU with:
   configure --target-list="x86_64-softmmu" --cc=clang --enable-pvrdma
Results in:
   qemu/hw/rdma/rdma_rm_defs.h:108:3: error: redefinition of typedef 
'RdmaDeviceResources' is a C11 feature [-Werror,-Wtypedef-redefinition]
   } RdmaDeviceResources;
     ^
   qemu/hw/rdma/rdma_backend_defs.h:24:36: note: previous definition is here
   typedef struct RdmaDeviceResources RdmaDeviceResources;

Fix by removing one of the 'typedef' definitions.

Signed-off-by: Marcel Apfelbaum <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Acked-by: Kamal Heib <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 7b6f6e8138a462e9b40b008d62c4e0852a5505b8
      
https://github.com/qemu/qemu/commit/7b6f6e8138a462e9b40b008d62c4e0852a5505b8
  Author: Kamal Heib <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/trace-events
    M hw/rdma/vmw/trace-events

  Log Message:
  -----------
  hw/rdma: Fix broken paths to docs/devel/tracing.txt

The tracing.txt file is under "docs/devel" and not "docs".

Reviewed-by: Yuval Shaia <address@hidden>
Signed-off-by: Kamal Heib <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: 1373f4a8728372a2b50ae8e0e53ae79182c1da29
      
https://github.com/qemu/qemu/commit/1373f4a8728372a2b50ae8e0e53ae79182c1da29
  Author: Kamal Heib <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c

  Log Message:
  -----------
  hw/rdma: Remove unused parameter from rdma_poll_cq()

The 'rdma_dev_res' parameter is not used in rdma_poll_cq(), so remove it.

Reviewed-by: Yuval Shaia <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Signed-off-by: Kamal Heib <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: a421c81148925c31c0515aa9d4c543b34e632cea
      
https://github.com/qemu/qemu/commit/a421c81148925c31c0515aa9d4c543b34e632cea
  Author: Kamal Heib <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/rdma_backend.c
    M hw/rdma/vmw/pvrdma_cmd.c
    M hw/rdma/vmw/pvrdma_qp_ops.c

  Log Message:
  -----------
  hw/rdma: Use {} instead of {0}

Initialize structs with {} instead of {0} to make sure that all code is
using the same convention.

Reviewed-by: Marcel Apfelbaum <address@hidden>
Signed-off-by: Kamal Heib <address@hidden>
Reviewed-by: Yuval Shaia <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: d151f5debdf1fe33014205e271e2cedd8fc824a2
      
https://github.com/qemu/qemu/commit/d151f5debdf1fe33014205e271e2cedd8fc824a2
  Author: Kamal Heib <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/vmw/pvrdma_cmd.c

  Log Message:
  -----------
  hw/pvrdma: Fix zero-initialization of resp in {query/modify}_qp

Make sure to zero-initialize only the pvrdma_cmd_query_qp_resp and not
the whole pvrdma_cmd_resp for query_qp, in modify_qp the resp isn't used
so remove it.

Reviewed-by: Yuval Shaia <address@hidden>
Signed-off-by: Kamal Heib <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: cb42a5867e7677a9fa1885a8436d3e7e8cbeeee9
      
https://github.com/qemu/qemu/commit/cb42a5867e7677a9fa1885a8436d3e7e8cbeeee9
  Author: Kamal Heib <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M hw/rdma/vmw/pvrdma_cmd.c

  Log Message:
  -----------
  hw/rdma: Fix the error prints in create_qp_rings()

The prints should indicate that we are talking about QP and not CQ.

Fixes: 98d176f8e592 ("hw/rdma: PVRDMA commands and data-path ops")
Reviewed-by: Yuval Shaia <address@hidden>
Signed-off-by: Kamal Heib <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Marcel Apfelbaum <address@hidden>


  Commit: c4b21ed1cfd2b5c7d191f9e095d3f1b8b28e2513
      
https://github.com/qemu/qemu/commit/c4b21ed1cfd2b5c7d191f9e095d3f1b8b28e2513
  Author: Peter Maydell <address@hidden>
  Date:   2019-03-16 (Sat, 16 Mar 2019)

  Changed paths:
    M contrib/rdmacm-mux/main.c
    M hmp-commands-info.hx
    M hmp.c
    M hmp.h
    M hw/rdma/Makefile.objs
    A hw/rdma/rdma.c
    M hw/rdma/rdma_backend.c
    M hw/rdma/rdma_backend.h
    M hw/rdma/rdma_backend_defs.h
    M hw/rdma/rdma_rm.c
    M hw/rdma/rdma_rm.h
    M hw/rdma/rdma_rm_defs.h
    M hw/rdma/rdma_utils.c
    M hw/rdma/rdma_utils.h
    M hw/rdma/trace-events
    M hw/rdma/vmw/pvrdma.h
    M hw/rdma/vmw/pvrdma_cmd.c
    M hw/rdma/vmw/pvrdma_dev_ring.c
    M hw/rdma/vmw/pvrdma_main.c
    M hw/rdma/vmw/pvrdma_qp_ops.c
    M hw/rdma/vmw/trace-events
    A include/hw/rdma/rdma.h

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into 
staging

RDMA queue

 * Another Clang compilation fix
 * Collect pvrdma debugging statistics
 * Various fixes for the pvrdma device

# gpg: Signature made Sat 16 Mar 2019 14:09:02 GMT
# gpg:                using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <address@hidden>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <address@hidden>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <address@hidden>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F  31F5 36D4 C0F0 CF2F E46D

* remotes/marcel/tags/rdma-pull-request:
  hw/rdma: Fix the error prints in create_qp_rings()
  hw/pvrdma: Fix zero-initialization of resp in {query/modify}_qp
  hw/rdma: Use {} instead of {0}
  hw/rdma: Remove unused parameter from rdma_poll_cq()
  hw/rdma: Fix broken paths to docs/devel/tracing.txt
  hw/rdma: another clang compilation fix
  hw/pvrdma: Provide correct value to object_get_typename
  hw/pvrdma: Unregister from shutdown notifier when device goes down
  hw/pvrdma: Delete pvrdma_exit function
  hw/pvrdma: Delete unneeded function argument
  hw/rdma: Free all receive buffers when QP is destroyed
  hw/rdma: Free all MAD receive buffers when device is closed
  {hmp, hw/pvrdma}: Expose device internals via monitor interface
  hw/pvrdma: Collect debugging statistics
  hw/rdma: Protect against concurrent execution of poll_cq
  hw/rdma: Introduce protected qlist
  hw/rdma: Switch to generic error reporting way
  contrib/rdmacm-mux: Fix out-of-bounds risk

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/8b088d3f8ab5...c4b21ed1cfd2
reply via email to
[Prev in Thread] Current Thread [Next in Thread]