From 9b30f13504dfbb13d4c0224e081b7e76800278d7 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 5 Mar 2021 16:06:52 +0800 Subject: [PATCH 1/9] migration: fix memory leak in qmp_migrate_set_parameters "tmp.tls_hostname" and "tmp.tls_creds" allocated by migrate_params_test_apply() is forgot to free at the end of qmp_migrate_set_parameters(). Fix that. The leak stack: Direct leak of 2 byte(s) in 2 object(s) allocated from: #0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b) #1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b) #2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143) #3 0xaaaac52447fb in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1377) #4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192) #5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c:165) #6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125) #7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214) #8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117) #9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459) #10 0xaaaac55cae0f in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268) #11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b) #12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b) #13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb) #14 0xaaaac47f45ef(/usr/bin/qemu-kvm-4.1.0+0x8455ef) #15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f) #16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb) Direct leak of 2 byte(s) in 2 object(s) allocated from: #0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b) #1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b) #2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143) #3 0xaaaac5244893 in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1382) #4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192) #5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c) #6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125) #7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214) #8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117) #9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459) #10 0xaaaac55cae0f in in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268) #11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b) #12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b) #13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb) #14 0xaaaac47f45ef (/usr/bin/qemu-kvm-4.1.0+0x8455ef) #15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f) #16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb) Signed-off-by: Chuan Zheng Reviewed-by: KeQian Zhu Reviewed-by: HaiLiang Reviewed-by: Juan Quintela Signed-off-by: Juan Quintela --- ...mory-leak-in-qmp_migrate_set_paramet.patch | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch diff --git a/migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch b/migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch new file mode 100644 index 0000000..46775ae --- /dev/null +++ b/migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch @@ -0,0 +1,78 @@ +From d65b5b20f4ada9e6c5af37b0fb59fa4709c4bdc9 Mon Sep 17 00:00:00 2001 +From: Chuan Zheng +Date: Fri, 5 Mar 2021 16:06:52 +0800 +Subject: [PATCH] migration: fix memory leak in qmp_migrate_set_parameters + +"tmp.tls_hostname" and "tmp.tls_creds" allocated by migrate_params_test_apply() +is forgot to free at the end of qmp_migrate_set_parameters(). Fix that. + +The leak stack: +Direct leak of 2 byte(s) in 2 object(s) allocated from: + #0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b) + #1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b) + #2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143) + #3 0xaaaac52447fb in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1377) + #4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192) + #5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c:165) + #6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125) + #7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214) + #8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117) + #9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459) + #10 0xaaaac55cae0f in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268) + #11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b) + #12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b) + #13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb) + #14 0xaaaac47f45ef(/usr/bin/qemu-kvm-4.1.0+0x8455ef) + #15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f) + #16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb) + +Direct leak of 2 byte(s) in 2 object(s) allocated from: + #0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b) + #1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b) + #2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143) + #3 0xaaaac5244893 in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1382) + #4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192) + #5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c) + #6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125) + #7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214) + #8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117) + #9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459) + #10 0xaaaac55cae0f in in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268) + #11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b) + #12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b) + #13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb) + #14 0xaaaac47f45ef (/usr/bin/qemu-kvm-4.1.0+0x8455ef) + #15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f) + #16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb) + +Signed-off-by: Chuan Zheng +Reviewed-by: KeQian Zhu +Reviewed-by: HaiLiang +Reviewed-by: Juan Quintela +Signed-off-by: Juan Quintela +--- + migration/migration.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/migration/migration.c b/migration/migration.c +index 17a5c16c79..9b40380d7c 100644 +--- a/migration/migration.c ++++ b/migration/migration.c +@@ -1291,12 +1291,12 @@ static void migrate_params_test_apply(MigrateSetParameters *params, + + if (params->has_tls_creds) { + assert(params->tls_creds->type == QTYPE_QSTRING); +- dest->tls_creds = g_strdup(params->tls_creds->u.s); ++ dest->tls_creds = params->tls_creds->u.s; + } + + if (params->has_tls_hostname) { + assert(params->tls_hostname->type == QTYPE_QSTRING); +- dest->tls_hostname = g_strdup(params->tls_hostname->u.s); ++ dest->tls_hostname = params->tls_hostname->u.s; + } + + if (params->has_max_bandwidth) { +-- +2.27.0 + -- Gitee From 8a4090a5069583c78b047d5a2572ba55b08a9d2d Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 5 Mar 2021 16:09:29 +0800 Subject: [PATCH 2/9] migration/tls: fix inverted semantics in multifd_channel_connect Function multifd_channel_connect() return "true" to indicate failure, which is rather confusing. Fix that. Signed-off-by: Hao Wang --- ...x-inverted-semantics-in-multifd_chan.patch | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 migration-tls-fix-inverted-semantics-in-multifd_chan.patch diff --git a/migration-tls-fix-inverted-semantics-in-multifd_chan.patch b/migration-tls-fix-inverted-semantics-in-multifd_chan.patch new file mode 100644 index 0000000..3f5a52a --- /dev/null +++ b/migration-tls-fix-inverted-semantics-in-multifd_chan.patch @@ -0,0 +1,55 @@ +From ee0d1b508a144ab390fb7bc8b7a4fe3161aebecf Mon Sep 17 00:00:00 2001 +From: Chuan Zheng +Date: Fri, 5 Mar 2021 16:09:29 +0800 +Subject: [PATCH] migration/tls: fix inverted semantics in + multifd_channel_connect + +Function multifd_channel_connect() return "true" to indicate failure, +which is rather confusing. Fix that. + +Signed-off-by: Hao Wang +--- + migration/ram.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/migration/ram.c b/migration/ram.c +index ba1e729c39..3338363e9d 100644 +--- a/migration/ram.c ++++ b/migration/ram.c +@@ -1575,9 +1575,9 @@ static bool multifd_channel_connect(MultiFDSendParams *p, + * function after the TLS handshake, + * so we mustn't call multifd_send_thread until then + */ +- return false; +- } else { + return true; ++ } else { ++ return false; + } + } else { + /* update for tls qio channel */ +@@ -1585,10 +1585,10 @@ static bool multifd_channel_connect(MultiFDSendParams *p, + qemu_thread_create(&p->thread, p->name, multifd_send_thread, p, + QEMU_THREAD_JOINABLE); + } +- return false; ++ return true; + } + +- return true; ++ return false; + } + + static void multifd_new_send_channel_cleanup(MultiFDSendParams *p, +@@ -1620,7 +1620,7 @@ static void multifd_new_send_channel_async(QIOTask *task, gpointer opaque) + p->c = QIO_CHANNEL(sioc); + qio_channel_set_delay(p->c, false); + p->running = true; +- if (multifd_channel_connect(p, sioc, local_err)) { ++ if (!multifd_channel_connect(p, sioc, local_err)) { + goto cleanup; + } + return; +-- +2.27.0 + -- Gitee From edcf07fa2510d9b549caba449a86a5b53b377814 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 5 Mar 2021 16:10:57 +0800 Subject: [PATCH 3/9] migration/tls: add error handling in multifd_tls_handshake_thread If any error happens during multifd send thread creating (e.g. channel broke because new domain is destroyed by the dst), multifd_tls_handshake_thread may exit silently, leaving main migration thread hanging (ram_save_setup -> multifd_send_sync_main -> qemu_sem_wait(&p->sem_sync)). Fix that by adding error handling in multifd_tls_handshake_thread. Signed-off-by: Hao Wang --- ...d-error-handling-in-multifd_tls_hand.patch | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 migration-tls-add-error-handling-in-multifd_tls_hand.patch diff --git a/migration-tls-add-error-handling-in-multifd_tls_hand.patch b/migration-tls-add-error-handling-in-multifd_tls_hand.patch new file mode 100644 index 0000000..de444af --- /dev/null +++ b/migration-tls-add-error-handling-in-multifd_tls_hand.patch @@ -0,0 +1,42 @@ +From 4bf84b63bf1b2fba031fc6c3f4948785d534df3b Mon Sep 17 00:00:00 2001 +From: Chuan Zheng +Date: Fri, 5 Mar 2021 16:10:57 +0800 +Subject: [PATCH] migration/tls: add error handling in + multifd_tls_handshake_thread + +If any error happens during multifd send thread creating (e.g. channel broke +because new domain is destroyed by the dst), multifd_tls_handshake_thread +may exit silently, leaving main migration thread hanging (ram_save_setup -> +multifd_send_sync_main -> qemu_sem_wait(&p->sem_sync)). +Fix that by adding error handling in multifd_tls_handshake_thread. + +Signed-off-by: Hao Wang +--- + migration/ram.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/migration/ram.c b/migration/ram.c +index 3338363e9d..d4ac696899 100644 +--- a/migration/ram.c ++++ b/migration/ram.c +@@ -1516,7 +1516,16 @@ static void multifd_tls_outgoing_handshake(QIOTask *task, + } else { + trace_multifd_tls_outgoing_handshake_complete(ioc); + } +- multifd_channel_connect(p, ioc, err); ++ ++ if (!multifd_channel_connect(p, ioc, err)) { ++ /* ++ * Error happen, mark multifd_send_thread status as 'quit' although it ++ * is not created, and then tell who pay attention to me. ++ */ ++ p->quit = true; ++ qemu_sem_post(&multifd_send_state->channels_ready); ++ qemu_sem_post(&p->sem_sync); ++ } + } + + static void *multifd_tls_handshake_thread(void *opaque) +-- +2.27.0 + -- Gitee From c74e27f1794dcf2e3aae96b8c2d4b9e6eb553034 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 12 Mar 2021 15:53:46 +0800 Subject: [PATCH 4/9] spec: Update patch and changelog with !79 migration: backport migration/tls patches from upstream !79 migration: fix memory leak in qmp_migrate_set_parameters migration/tls: fix inverted semantics in multifd_channel_connect migration/tls: add error handling in multifd_tls_handshake_thread Signed-off-by: Chen Qun --- qemu.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/qemu.spec b/qemu.spec index ffe2ca6..4b6dfa2 100644 --- a/qemu.spec +++ b/qemu.spec @@ -311,6 +311,9 @@ Patch0298: sd-sdhci-assert-data_count-is-within-fifo_buffer.patch Patch0299: msix-add-valid.accepts-methods-to-check-address.patch Patch0300: ide-atapi-check-io_buffer_index-in-ide_atapi_cmd_rep.patch Patch0301: block-backend-Stop-retrying-when-draining.patch +Patch0302: migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch +Patch0303: migration-tls-fix-inverted-semantics-in-multifd_chan.patch +Patch0304: migration-tls-add-error-handling-in-multifd_tls_hand.patch BuildRequires: flex BuildRequires: bison @@ -701,6 +704,11 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Fri Mar 12 2021 Chen Qun +- migration: fix memory leak in qmp_migrate_set_parameters +- migration/tls: fix inverted semantics in multifd_channel_connect +- migration/tls: add error handling in multifd_tls_handshake_thread + * Thu Mar 11 2021 Huawei Technologies Co., Ltd - qemu.spec: add iscsi rpm package requirement -- Gitee From 5d4b7eace32feaf17e2a7922b04ef31884d4037c Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Tue, 9 Mar 2021 17:37:20 +0800 Subject: [PATCH 5/9] net: vmxnet3: validate configuration values during activate (CVE-2021-20203) fix CVE-2021-20203 #I3A34O While activating device in vmxnet3_acticate_device(), it does not validate guest supplied configuration values against predefined minimum - maximum limits. This may lead to integer overflow or OOB access issues. Add checks to avoid it. Fixes: CVE-2021-20203 Buglink: https://bugs.launchpad.net/qemu/+bug/1913873 Reported-by: Gaoning Pan Signed-off-by: Prasad J Pandit Signed-off-by: Jiajie Li --- ...date-configuration-values-during-act.patch | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 net-vmxnet3-validate-configuration-values-during-act.patch diff --git a/net-vmxnet3-validate-configuration-values-during-act.patch b/net-vmxnet3-validate-configuration-values-during-act.patch new file mode 100644 index 0000000..a4ed4bc --- /dev/null +++ b/net-vmxnet3-validate-configuration-values-during-act.patch @@ -0,0 +1,79 @@ +From 18d22b1f2b2f89bbdd77bd4d62e0fe42f19b3962 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Tue, 9 Mar 2021 17:37:20 +0800 +Subject: [PATCH] net: vmxnet3: validate configuration values during activate + (CVE-2021-20203) + +fix CVE-2021-20203 #I3A34O + +While activating device in vmxnet3_acticate_device(), it does not +validate guest supplied configuration values against predefined +minimum - maximum limits. This may lead to integer overflow or +OOB access issues. Add checks to avoid it. + +Fixes: CVE-2021-20203 +Buglink: https://bugs.launchpad.net/qemu/+bug/1913873 +Reported-by: Gaoning Pan +Signed-off-by: Prasad J Pandit + +Signed-off-by: Jiajie Li +--- + hw/net/vmxnet3.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c +index 10d01d0058..ecc4f5bcf0 100644 +--- a/hw/net/vmxnet3.c ++++ b/hw/net/vmxnet3.c +@@ -1418,6 +1418,7 @@ static void vmxnet3_activate_device(VMXNET3State *s) + vmxnet3_setup_rx_filtering(s); + /* Cache fields from shared memory */ + s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu); ++ assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU); + VMW_CFPRN("MTU is %u", s->mtu); + + s->max_rx_frags = +@@ -1471,7 +1472,9 @@ static void vmxnet3_activate_device(VMXNET3State *s) + /* Read rings memory locations for TX queues */ + pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, conf.txRingBasePA); + size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, conf.txRingSize); +- ++ if (size > VMXNET3_TX_RING_MAX_SIZE) { ++ size = VMXNET3_TX_RING_MAX_SIZE; ++ } + vmxnet3_ring_init(d, &s->txq_descr[i].tx_ring, pa, size, + sizeof(struct Vmxnet3_TxDesc), false); + VMXNET3_RING_DUMP(VMW_CFPRN, "TX", i, &s->txq_descr[i].tx_ring); +@@ -1481,6 +1484,9 @@ static void vmxnet3_activate_device(VMXNET3State *s) + /* TXC ring */ + pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, conf.compRingBasePA); + size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, conf.compRingSize); ++ if (size > VMXNET3_TC_RING_MAX_SIZE) { ++ size = VMXNET3_TC_RING_MAX_SIZE; ++ } + vmxnet3_ring_init(d, &s->txq_descr[i].comp_ring, pa, size, + sizeof(struct Vmxnet3_TxCompDesc), true); + VMXNET3_RING_DUMP(VMW_CFPRN, "TXC", i, &s->txq_descr[i].comp_ring); +@@ -1522,6 +1528,9 @@ static void vmxnet3_activate_device(VMXNET3State *s) + /* RX rings */ + pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, conf.rxRingBasePA[j]); + size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, conf.rxRingSize[j]); ++ if (size > VMXNET3_RX_RING_MAX_SIZE) { ++ size = VMXNET3_RX_RING_MAX_SIZE; ++ } + vmxnet3_ring_init(d, &s->rxq_descr[i].rx_ring[j], pa, size, + sizeof(struct Vmxnet3_RxDesc), false); + VMW_CFPRN("RX queue %d:%d: Base: %" PRIx64 ", Size: %d", +@@ -1531,6 +1540,9 @@ static void vmxnet3_activate_device(VMXNET3State *s) + /* RXC ring */ + pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, conf.compRingBasePA); + size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, conf.compRingSize); ++ if (size > VMXNET3_RC_RING_MAX_SIZE) { ++ size = VMXNET3_RC_RING_MAX_SIZE; ++ } + vmxnet3_ring_init(d, &s->rxq_descr[i].comp_ring, pa, size, + sizeof(struct Vmxnet3_RxCompDesc), true); + VMW_CFPRN("RXC queue %d: Base: %" PRIx64 ", Size: %d", i, pa, size); +-- +2.27.0 + -- Gitee From cc34546b748f679e18d56c92f304083ee0de5ad8 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 12 Mar 2021 15:53:49 +0800 Subject: [PATCH 6/9] spec: Update patch and changelog with !81 fix CVE-2021-20203 #I3A34O !81 net: vmxnet3: validate configuration values during activate (CVE-2021-20203) Signed-off-by: Chen Qun --- qemu.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qemu.spec b/qemu.spec index 4b6dfa2..9ec8740 100644 --- a/qemu.spec +++ b/qemu.spec @@ -314,6 +314,7 @@ Patch0301: block-backend-Stop-retrying-when-draining.patch Patch0302: migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch Patch0303: migration-tls-fix-inverted-semantics-in-multifd_chan.patch Patch0304: migration-tls-add-error-handling-in-multifd_tls_hand.patch +Patch0305: net-vmxnet3-validate-configuration-values-during-act.patch BuildRequires: flex BuildRequires: bison @@ -704,6 +705,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Fri Mar 12 2021 Chen Qun +- net: vmxnet3: validate configuration values during activate (CVE-2021-20203) + * Fri Mar 12 2021 Chen Qun - migration: fix memory leak in qmp_migrate_set_parameters - migration/tls: fix inverted semantics in multifd_channel_connect -- Gitee From 06777f70c19af666289d14320c5ac070de290453 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Wed, 10 Mar 2021 15:29:47 +0800 Subject: [PATCH 7/9] doc: Update multi-thread compression doc Signed-off-by: Jiajie Li --- doc-Update-multi-thread-compression-doc.patch | 85 +++---------------- 1 file changed, 13 insertions(+), 72 deletions(-) diff --git a/doc-Update-multi-thread-compression-doc.patch b/doc-Update-multi-thread-compression-doc.patch index 33ef835..2d2a35f 100644 --- a/doc-Update-multi-thread-compression-doc.patch +++ b/doc-Update-multi-thread-compression-doc.patch @@ -1,85 +1,26 @@ -From 642df85795097017e9370a9721f702cbec50c173 Mon Sep 17 00:00:00 2001 -From: Zeyu Jin -Date: Sat, 30 Jan 2021 16:36:47 +0800 +From a88a27c5e6639652c1fbbcd5259bb5f1b26cbe70 Mon Sep 17 00:00:00 2001 +From: Jiajie Li +Date: Wed, 10 Mar 2021 15:29:47 +0800 Subject: [PATCH] doc: Update multi-thread compression doc -Modify the doc to fit the previous changes. - -Signed-off-by: Zeyu Jin -Signed-off-by: Ying Fang +Signed-off-by: Jiajie Li --- - docs/multi-thread-compression.txt | 31 ++++++++++++++++++------------- - 1 file changed, 18 insertions(+), 13 deletions(-) + docs/multi-thread-compression.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/multi-thread-compression.txt b/docs/multi-thread-compression.txt -index bb88c6bdf1..d429963cb0 100644 +index d429963cb0..26107478cb 100644 --- a/docs/multi-thread-compression.txt +++ b/docs/multi-thread-compression.txt -@@ -33,14 +33,15 @@ thread compression can be used to accelerate the compression process. - - The decompression speed of Zlib is at least 4 times as quick as - compression, if the source and destination CPU have equal speed, --keeping the compression thread count 4 times the decompression --thread count can avoid resource waste. -+and you choose Zlib as compression method, keeping the compression -+thread count 4 times the decompression thread count can avoid resource waste. - - Compression level can be used to control the compression speed and the --compression ratio. High compression ratio will take more time, level 0 --stands for no compression, level 1 stands for the best compression --speed, and level 9 stands for the best compression ratio. Users can --select a level number between 0 and 9. -+compression ratio. High compression ratio will take more time, -+level 1 stands for the best compression speed, and higher level means higher -+compression ration. For Zlib, users can select a level number between 0 and 9, -+where level 0 stands for no compression. For Zstd, users can select a -+level number between 1 and 22. +@@ -41,7 +41,7 @@ compression ratio. High compression ratio will take more time, + level 1 stands for the best compression speed, and higher level means higher + compression ration. For Zlib, users can select a level number between 0 and 9, + where level 0 stands for no compression. For Zstd, users can select a +-level number between 1 and 22. ++level number between 1 and 19. When to use the multiple thread compression in live migration -@@ -116,16 +117,19 @@ to support the multiple thread compression migration: - 2. Activate compression on the source: - {qemu} migrate_set_capability compress on - --3. Set the compression thread count on source: -+3. Set the compression method: -+ {qemu} migrate_set_parameter compress_method zstd -+ -+4. Set the compression thread count on source: - {qemu} migrate_set_parameter compress_threads 12 - --4. Set the compression level on the source: -+5. Set the compression level on the source: - {qemu} migrate_set_parameter compress_level 1 - --5. Set the decompression thread count on destination: -+6. Set the decompression thread count on destination: - {qemu} migrate_set_parameter decompress_threads 3 - --6. Start outgoing migration: -+7. Start outgoing migration: - {qemu} migrate -d tcp:destination.host:4444 - {qemu} info migrate - Capabilities: ... compress: on -@@ -136,6 +140,7 @@ The following are the default settings: - compress_threads: 8 - decompress_threads: 2 - compress_level: 1 (which means best speed) -+ compress_method: zlib - - So, only the first two steps are required to use the multiple - thread compression in migration. You can do more if the default -@@ -143,7 +148,7 @@ settings are not appropriate. - - TODO - ==== --Some faster (de)compression method such as LZ4 and Quicklz can help --to reduce the CPU consumption when doing (de)compression. If using --these faster (de)compression method, less (de)compression threads -+Comparing to Zlib, Some faster (de)compression method such as LZ4 -+and Quicklz can help to reduce the CPU consumption when doing (de)compression. -+If using these faster (de)compression method, less (de)compression threads - are needed when doing the migration. -- 2.27.0 -- Gitee From ef2c08d005d94ebffc6a253e6fc4f896c0710630 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 12 Mar 2021 15:53:52 +0800 Subject: [PATCH 8/9] spec: Update patch and changelog with !82 doc: Update multi-thread compression doc !82 doc: Update multi-thread compression doc !82 doc: Update multi-thread compression doc Signed-off-by: Chen Qun --- qemu.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qemu.spec b/qemu.spec index 9ec8740..bb925fd 100644 --- a/qemu.spec +++ b/qemu.spec @@ -315,6 +315,7 @@ Patch0302: migration-fix-memory-leak-in-qmp_migrate_set_paramet.patch Patch0303: migration-tls-fix-inverted-semantics-in-multifd_chan.patch Patch0304: migration-tls-add-error-handling-in-multifd_tls_hand.patch Patch0305: net-vmxnet3-validate-configuration-values-during-act.patch +Patch0306: doc-Update-multi-thread-compression-doc.patch BuildRequires: flex BuildRequires: bison @@ -705,6 +706,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Fri Mar 12 2021 Chen Qun +- doc: Update multi-thread compression doc + * Fri Mar 12 2021 Chen Qun - net: vmxnet3: validate configuration values during activate (CVE-2021-20203) -- Gitee From 81df5726b99684e6a87e7c3786c3e7e78aee9916 Mon Sep 17 00:00:00 2001 From: Chen Qun Date: Fri, 12 Mar 2021 15:53:54 +0800 Subject: [PATCH 9/9] spec: Update release version with !79 !81 !82 increase release verison by one Signed-off-by: Chen Qun --- qemu.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index bb925fd..67aa3a2 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 50 +Release: 51 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 -- Gitee