1. 17 10月, 2016 16 次提交
    • L
      9pfs: fix memory leak in v9fs_xattrcreate · ff55e94d
      Li Qiang 提交于
      The 'fs.xattr.value' field in V9fsFidState object doesn't consider the
      situation that this field has been allocated previously. Every time, it
      will be allocated directly. This leads to a host memory leak issue if
      the client sends another Txattrcreate message with the same fid number
      before the fid from the previous time got clunked.
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Reviewed-by: NGreg Kurz <groug@kaod.org>
      [groug, updated the changelog to indicate how the leak can occur]
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      ff55e94d
    • L
      9pfs: fix information leak in xattr read · eb687602
      Li Qiang 提交于
      9pfs uses g_malloc() to allocate the xattr memory space, if the guest
      reads this memory before writing to it, this will leak host heap memory
      to the guest. This patch avoid this.
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Reviewed-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      eb687602
    • G
      virtio-9p: add reset handler · 0e44a0fd
      Greg Kurz 提交于
      Virtio devices should implement the VirtIODevice->reset() function to
      perform necessary cleanup actions and to bring the device to a quiescent
      state.
      
      In the case of the virtio-9p device, this means:
      - emptying the list of active PDUs (i.e. draining all in-flight I/O)
      - freeing all fids (i.e. close open file descriptors and free memory)
      
      That's what this patch does.
      
      The reset handler first waits for all active PDUs to complete. Since
      completion happens in the QEMU global aio context, we just have to
      loop around aio_poll() until the active list is empty.
      
      The freeing part involves some actions to be performed on the backend,
      like closing file descriptors or flushing extended attributes to the
      underlying filesystem. The virtfs_reset() function already does the
      job: it calls free_fid() for all open fids not involved in an ongoing
      I/O operation. We are sure this is the case since we have drained
      the PDU active list.
      
      The current code implements all backend accesses with coroutines, but we
      want to stay synchronous on the reset path. We can either change the
      current code to be able to run when not in coroutine context, or create
      a coroutine context and wait for virtfs_reset() to complete. This patch
      goes for the latter because it results in simpler code.
      
      Note that we also need to create a dummy PDU because it is also an API
      to pass the FsContext pointer to all backend callbacks.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
      Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
      0e44a0fd
    • G
      9pfs: only free completed request if not flushed · f74e27bf
      Greg Kurz 提交于
      If a PDU has a flush request pending, the current code calls pdu_free()
      twice:
      
      1) pdu_complete()->pdu_free() with pdu->cancelled set, which does nothing
      
      2) v9fs_flush()->pdu_free() with pdu->cancelled cleared, which moves the
         PDU back to the free list.
      
      This works but it complexifies the logic of pdu_free().
      
      With this patch, pdu_complete() only calls pdu_free() if no flush request
      is pending, i.e. qemu_co_queue_next() returns false.
      
      Since pdu_free() is now supposed to be called with pdu->cancelled cleared,
      the check in pdu_free() is dropped and replaced by an assertion.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      f74e27bf
    • G
      9pfs: drop useless check in pdu_free() · 6868a420
      Greg Kurz 提交于
      Out of the three users of pdu_free(), none ever passes a NULL pointer to
      this function.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      6868a420
    • G
      9pfs: use coroutine_fn annotation in hw/9pfs/9p.[ch] · 8440e22e
      Greg Kurz 提交于
      All these functions either call the v9fs_co_* functions which have the
      coroutine_fn annotation, or pdu_complete() which calls qemu_co_queue_next().
      
      Let's mark them to make it obvious they execute in coroutine context.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      8440e22e
    • G
      9pfs: use coroutine_fn annotation in hw/9pfs/co*.[ch] · 5bdade66
      Greg Kurz 提交于
      All these functions use the v9fs_co_run_in_worker() macro, and thus always
      call qemu_coroutine_self() and qemu_coroutine_yield().
      
      Let's mark them to make it obvious they execute in coroutine context.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      5bdade66
    • G
      9pfs: fsdev: drop useless extern annotation for functions · bc70a592
      Greg Kurz 提交于
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      bc70a592
    • L
      9pfs: fix potential host memory leak in v9fs_read · e95c9a49
      Li Qiang 提交于
      In 9pfs read dispatch function, it doesn't free two QEMUIOVector
      object thus causing potential memory leak. This patch avoid this.
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      e95c9a49
    • L
      9pfs: allocate space for guest originated empty strings · ba42ebb8
      Li Qiang 提交于
      If a guest sends an empty string paramater to any 9P operation, the current
      code unmarshals it into a V9fsString equal to { .size = 0, .data = NULL }.
      
      This is unfortunate because it can cause NULL pointer dereference to happen
      at various locations in the 9pfs code. And we don't want to check str->data
      everywhere we pass it to strcmp() or any other function which expects a
      dereferenceable pointer.
      
      This patch enforces the allocation of genuine C empty strings instead, so
      callers don't have to bother.
      
      Out of all v9fs_iov_vunmarshal() users, only v9fs_xattrwalk() checks if
      the returned string is empty. It now uses v9fs_string_size() since
      name.data cannot be NULL anymore.
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      [groug, rewritten title and changelog,
       fix empty string check in v9fs_xattrwalk()]
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      ba42ebb8
    • P
      Merge remote-tracking branch 'remotes/famz/tags/for-upstream' into staging · ad728364
      Peter Maydell 提交于
      # gpg: Signature made Mon 17 Oct 2016 03:08:28 BST
      # gpg:                using RSA key 0xCA35624C6A9171C6
      # gpg: Good signature from "Fam Zheng <famz@redhat.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 5003 7CB7 9706 0F76 F021  AD56 CA35 624C 6A91 71C6
      
      * remotes/famz/tags/for-upstream:
        tests/docker/Makefile.include: add a generic docker-run target
        tests/docker: make test-mingw honour TARGET_LIST
        tests/docker: test-build script
        tests/docker: add travis dockerfile
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      ad728364
    • P
      Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20161014' into staging · 4378caf5
      Peter Maydell 提交于
      migration/next for 20161014
      
      # gpg: Signature made Fri 14 Oct 2016 16:24:13 BST
      # gpg:                using RSA key 0xF487EF185872D723
      # gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
      # gpg:                 aka "Juan Quintela <quintela@trasno.org>"
      # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03  4B82 F487 EF18 5872 D723
      
      * remotes/juanquintela/tags/migration/20161014:
        docs/xbzrle: correction
        migrate: move max-bandwidth and downtime-limit to migrate_set_parameter
        migration: Fix seg with missing port
        migration/postcopy: Explicitly disallow huge pages
        RAMBlocks: Store page size
        Postcopy vs xbzrle: Don't send xbzrle pages once in postcopy [for 2.8]
        migrate: Fix bounds check for migration parameters in migration.c
        migrate: Use boxed qapi for migrate-set-parameters
        migrate: Share common MigrationParameters struct
        migrate: Fix cpu-throttle-increment regression in HMP
        migration/rdma: Don't flag an error when we've been told about one
        migration: Make failed migration load set file error
        migration/rdma: Pass qemu_file errors across link
        migration: Report values for comparisons
        migration: report an error giving the failed field
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      4378caf5
    • A
      tests/docker/Makefile.include: add a generic docker-run target · e86c9a64
      Alex Bennée 提交于
      This re-factors the docker makefile to include a docker-run target which
      can be controlled entirely from environment variables specified on the
      make command line. This allows us to run against any given docker image
      we may have in our repository, for example:
      
          make docker-run TEST="test-quick" IMAGE="debian:arm64" \
               EXECUTABLE=./aarch64-linux-user/qemu-aarch64
      
      The existing docker-foo@bar targets still work but the inline
      verification has been dropped because we already don't hit that due to
      other pattern rules in rules.mak.
      Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
      
      Message-Id: <20161011161625.9070-5-alex.bennee@linaro.org>
      Message-Id: <20161011161625.9070-6-alex.bennee@linaro.org>
      [Squash in the verification removal patch. - Fam]
      Signed-off-by: NFam Zheng <famz@redhat.com>
      e86c9a64
    • A
      tests/docker: make test-mingw honour TARGET_LIST · 86a17cb3
      Alex Bennée 提交于
      The other builders honour this variable, so should the mingw build.
      Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
      Message-Id: <20161011161625.9070-4-alex.bennee@linaro.org>
      Signed-off-by: NFam Zheng <famz@redhat.com>
      86a17cb3
    • A
      tests/docker: test-build script · bdecba6e
      Alex Bennée 提交于
      Much like test-quick but only builds. This is useful for some of the
      build targets like ThreadSanitizer that don't yet pass "make check".
      Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
      
      Message-Id: <20161011161625.9070-3-alex.bennee@linaro.org>
      Signed-off-by: NFam Zheng <famz@redhat.com>
      bdecba6e
    • A
      tests/docker: add travis dockerfile · 8b9b3177
      Alex Bennée 提交于
      This target grabs the latest Travis containers from their repository at
      quay.io and then installs QEMU's build dependencies. With this it is
      possible to run on broadly the same setup as they have on travis-ci.org.
      Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
      Message-Id: <20161011161625.9070-2-alex.bennee@linaro.org>
      Signed-off-by: NFam Zheng <famz@redhat.com>
      8b9b3177
  2. 13 10月, 2016 24 次提交