Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 02 4月, 2015 1 次提交
  3. 01 4月, 2015 8 次提交
    • D
      CVE-2015-1779: limit size of HTTP headers from websockets clients · 2cdb5e14
      由 Daniel P. Berrange 提交于 
      The VNC server websockets decoder will read and buffer data from
websockets clients until it sees the end of the HTTP headers,
as indicated by \r\n\r\n. In theory this allows a malicious to
trick QEMU into consuming an arbitrary amount of RAM. In practice,
because QEMU runs g_strstr_len() across the buffered header data,
it will spend increasingly long burning CPU time searching for
the substring match and less & less time reading data. So while
this does cause arbitrary memory growth, the bigger problem is
that QEMU will be burning 100% of available CPU time.

A novnc websockets client typically sends headers of around
512 bytes in length. As such it is reasonable to place a 4096
byte limit on the amount of data buffered while searching for
the end of HTTP headers.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      2cdb5e14
    • D
      CVE-2015-1779: incrementally decode websocket frames · a2bebfd6
      由 Daniel P. Berrange 提交于 
      The logic for decoding websocket frames wants to fully
decode the frame header and payload, before allowing the
VNC server to see any of the payload data. There is no
size limit on websocket payloads, so this allows a
malicious network client to consume 2^64 bytes in memory
in QEMU. It can trigger this denial of service before
the VNC server even performs any authentication.

The fix is to decode the header, and then incrementally
decode the payload data as it is needed. With this fix
the websocket decoder will allow at most 4k of data to
be buffered before decoding and processing payload.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

[ kraxel: fix frequent spurious disconnects, suggested by Peter Maydell ]

  @@ -361,7 +361,7 @@ int vncws_decode_frame_payload(Buffer *input,
  -        *payload_size = input->offset;
  +        *payload_size = *payload_remain;

[ kraxel: fix 32bit build ]

  @@ -306,7 +306,7 @@ struct VncState
  -    uint64_t ws_payload_remain;
  +    size_t ws_payload_remain;
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      a2bebfd6
    • P
      Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging · b8a86c4a
      由 Peter Maydell 提交于 
      Fix for object_del of in-use memory, pvpanic
regression, PPC regression and bogus error message with
Oxygen theme.

# gpg: Signature made Wed Apr  1 09:08:20 2015 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  Revert "exec: Respect as_tranlsate_internal length clamp"
  rcu: do not create thread in pthread_atfork callback
  pc: acpi: fix pvpanic regression
  hostmem: Prevent removing an in-use memory backend
  qom: Add can_be_deleted callback to UserCreatableClass
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      b8a86c4a
    • P
      Revert "exec: Respect as_tranlsate_internal length clamp" · 4025446f
      由 Paolo Bonzini 提交于 
      This reverts commit c3c1bb99.
It causes problems with boards that declare memory regions shorter
than the registers they contain.
Reported-by: NZoltan Balaton <balaton@eik.bme.hu>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      4025446f
    • P
      rcu: do not create thread in pthread_atfork callback · a59629fc
      由 Paolo Bonzini 提交于 
      If QEMU forks after the CPU threads have been created, qemu_mutex_lock_iothread
will not be able to do qemu_cpu_kick_thread.  There is no solution other than
assuming that forks after the CPU threads have been created will end up in an
exec.  Forks before the CPU threads have been created (such as -daemonize)
have to call rcu_after_fork manually.

Notably, the oxygen theme for GTK+ forks and shows a "No such process" error
without this patch.

This patch can be reverted once the iothread loses the "kick the TCG thread"
magic.

User-mode emulation does not use the iothread, so it can also call
rcu_after_fork.

Reported by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Tested by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      a59629fc
    • I
      pc: acpi: fix pvpanic regression · e65bef69
      由 Igor Mammedov 提交于 
      Commit cd61cb2e  pc: acpi-build: generate pvpanic device description dynamically

introduced regression changing pvpanic device HID from
QEMU0001 to QEMU0002.
Fix AML generated code so that pvpanic device
would keep its original HID. i.e. QEMU0001
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reported-by: NGal Hammer <ghammer@redhat.com>
Message-Id: <1427717907-25027-1-git-send-email-imammedo@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      e65bef69
    • L
      hostmem: Prevent removing an in-use memory backend · 36bce5ca
      由 Lin Ma 提交于 
      showing a memory device whose memdev is removed leads an assert:

(qemu) object_add memory-backend-ram,id=ram0,size=128M
(qemu) device_add pc-dimm,id=d0,memdev=ram0
(qemu) object_del ram0
(qemu) info memory-devices
**
ERROR:qom/object.c:1274:object_get_canonical_path_component:\
                            assertion failed: (obj->parent != NULL)
Aborted

The patch prevents removing an in-use mem backend and error out.
Signed-off-by: NLin Ma <lma@suse.com>
Message-Id: <1427704589-7688-3-git-send-email-lma@suse.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      36bce5ca
    • L
      qom: Add can_be_deleted callback to UserCreatableClass · d6edb155
      由 Lin Ma 提交于 
      If backends implement the can_be_deleted and it returns false,
Then the qmp_object_del won't delete the given backends.
Signed-off-by: NLin Ma <lma@suse.com>
Message-Id: <1427704589-7688-2-git-send-email-lma@suse.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      d6edb155
  5. 31 3月, 2015 9 次提交
  7. 30 3月, 2015 5 次提交
  9. 28 3月, 2015 3 次提交
    • P
      Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging · 627f91b1
      由 Peter Maydell 提交于 
      # gpg: Signature made Fri Mar 27 22:19:31 2015 GMT using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  AHCI: Protect cmd register
  AHCI: Do not (re)map FB/CLB buffers while not running
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      627f91b1
    • J
      AHCI: Protect cmd register · fc3d8e11
      由 John Snow 提交于 
      Many bits in the CMD register are supposed to be strictly read-only.
We should not be deleting them on every write.

As a side-effect: pay explicit attention to when a guest marks off
the FIS Receive or Start bits, and disable the status bits ourselves,
instead of letting them implicitly fall off.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Message-id: 1426283454-15590-3-git-send-email-jsnow@redhat.com
      fc3d8e11
    • J
      AHCI: Do not (re)map FB/CLB buffers while not running · a13ab5a3
      由 John Snow 提交于 
      The FIS Receive Buffer and Command List Buffer pointers
should not be edited while the FIS receive engine or
Command Receive engines are running.

Currently, we attempt to re-map the buffers every time they
are adjusted, but while the AHCI engines are off, these registers
may contain stale values, so we should not attempt to re-map these
values until the engines are reactivated.
Reported-by: NJordan Hargrave <jharg93@gmail.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Message-id: 1426283454-15590-2-git-send-email-jsnow@redhat.com
      a13ab5a3
  11. 27 3月, 2015 11 次提交
  13. 26 3月, 2015 3 次提交