Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: qemu/qemu
base: 11a629d246e4
Choose a base ref
...
head repository: qemu/qemu
compare: 5dfd80e38b63
Choose a head ref
  • 20 commits
  • 26 files changed
  • 3 contributors

Commits on Sep 25, 2023

  1. pc_piix: remove pc-i440fx-1.4 up to pc-i440fx-1.7 

    These are the last users of the 128K SeaBIOS blob in the i440FX family.
Removing them allows us to drop PCI support from the 128K blob,
thus making it easier to update SeaBIOS to newer versions.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    ea985d2 View commit details
    Browse the repository at this point in the history

  2. seabios: remove PCI drivers from bios.bin 

    bios.bin is now used only by ISA PC, so PCI drivers are not necessary.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    a1fadbc View commit details
    Browse the repository at this point in the history

  3. user-exec-stub: remove unused variable 

    enable_cpu_pm is only used by softmmu-specific code, namely target/i386/host-cpu.c
and target/i386/kvm/*.  It does not need a stub definition anymore.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    8a9fc82 View commit details
    Browse the repository at this point in the history

  4. hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467 

    ]

We are doing things like

    nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);

in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @huth @bonzini
    huth authored and bonzini committed Sep 25, 2023
    Copy the full SHA
    7cfcc79 View commit details
    Browse the repository at this point in the history

  5. vl: remove shadowed local variables 

    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    c431ffd View commit details
    Browse the repository at this point in the history

  6. ui/vnc: fix debug output for invalid audio message 

    The debug message was cut and pasted from the invalid audio format
case, but the audio message is at bytes 2-3.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    0cb9c58 View commit details
    Browse the repository at this point in the history

  7. ui/vnc: fix handling of VNC_FEATURE_XVP 

    VNC_FEATURE_XVP was not shifted left before adding it to vs->features,
so it was never enabled; but it was also checked the wrong way with
a logical AND instead of vnc_has_feature.  Fix both places.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    477b301 View commit details
    Browse the repository at this point in the history

  8. mptsas: avoid shadowed local variables 

    Rename the argument so that "addr" is only used inside the for loop.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 25, 2023
    Copy the full SHA
    4c18684 View commit details
    Browse the repository at this point in the history

Commits on Sep 26, 2023

  1. pm_smbus: rename variable to avoid shadowing 

    Acked-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    973d3ea View commit details
    Browse the repository at this point in the history

  2. m48t59-test: avoid possible overflow on ABS 

    Originally meant to avoid a shadowed variable "s", which was fixed by
renaming the outer declaration to "qts".  Avoid the chance of an overflow
in the computation of ABS(t - s).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    168d467 View commit details
    Browse the repository at this point in the history

  3. target/i386/kvm: eliminate shadowed local variables 

    These are harmless are they die immediately after their use.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    e0c3ef7 View commit details
    Browse the repository at this point in the history

  4. target/i386/cpu: avoid shadowed local variables 

    Reuse the pointer variable used for the unversioned model.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    637123a View commit details
    Browse the repository at this point in the history

  5. target/i386/translate: avoid shadowed local variables 

    Just remove the declaration.  There is nothing in the function after the
switch statement, so it is safe to do.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    19729af View commit details
    Browse the repository at this point in the history

  6. target/i386/seg_helper: introduce tss_set_busy 

    Eliminate a shadowed local variable in the process.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    a908985 View commit details
    Browse the repository at this point in the history

  7. target/i386/seg_helper: remove shadowed variable 

    Return the width of the new task directly from switch_tss_ra.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    4995805 View commit details
    Browse the repository at this point in the history

  8. target/i386/svm_helper: eliminate duplicate local variable 

    This shadows an outer "cs" variable that is initialized to the
same expression.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    1bce34a View commit details
    Browse the repository at this point in the history

  9. block: mark mixed functions that can suspend 

    The marking should be extended transitively to all functions that call
these ones, so that static analysis can be done much more efficiently.
However, this is a start and makes it possible to use vrc's path-based
searches to find potential bugs where coroutine_fns call blocking functions.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    e2dbca0 View commit details
    Browse the repository at this point in the history

  10. compiler: introduce QEMU_ANNOTATE 

    Allow a more shorter syntax when defining wrapper macros for
__attribute__((annotate(...))).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    d79b920 View commit details
    Browse the repository at this point in the history

  11. audio: remove shadowed locals 

    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    @bonzini
    bonzini committed Sep 26, 2023
    Copy the full SHA
    417f8c8 View commit details
    Browse the repository at this point in the history

Commits on Sep 27, 2023

  1. Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging 

    * new round of audio cleanups
* various shadowed local variable fixes in vl, mptsas, pm_smbus, target/i386
* remove deprecated pc-i440fx-1.4 up to pc-i440fx-1.7
* remove PCI drivers from 128K bios.bin
* remove unused variable in user-exec-stub.c
* small fixes for ui/vnc
* scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmUTDaoUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroMvEgf+NrSaP4pmHrYcVtm43fnKXoLHFrCx
# KYfoK9Lke/DDkTff6rrcfW/Wyqid6Pp9Ch4Rrpr/X71X5gi+c6xb5klC8cpSfLg4
# gtuGctj7WL7KR/067EsLqHvzBob/iebFhZwhtsBrI+z65X+J9pOK78efBTdhezq4
# EEHTWohMAg1I/MWBK5VnOk2fI4+9z9K9zP5AtWmJzwwJkQUoEyl+YDkVmIhMYoGn
# CapRO7i2wIvtoF4wuQUCGsOLmrcWTvRIOcV13k3b6PYCPC40/N9AOpiiyg3XqNah
# UKKM9CcgVnCzCc4Jar2QD+MzkTDxhmQSyLFJgtzrW7CQSE5YB3sUHj3CXg==
# =8nvs
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Sep 2023 12:58:18 EDT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  audio: remove shadowed locals
  compiler: introduce QEMU_ANNOTATE
  block: mark mixed functions that can suspend
  target/i386/svm_helper: eliminate duplicate local variable
  target/i386/seg_helper: remove shadowed variable
  target/i386/seg_helper: introduce tss_set_busy
  target/i386/translate: avoid shadowed local variables
  target/i386/cpu: avoid shadowed local variables
  target/i386/kvm: eliminate shadowed local variables
  m48t59-test: avoid possible overflow on ABS
  pm_smbus: rename variable to avoid shadowing
  mptsas: avoid shadowed local variables
  ui/vnc: fix handling of VNC_FEATURE_XVP
  ui/vnc: fix debug output for invalid audio message
  vl: remove shadowed local variables
  hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
  user-exec-stub: remove unused variable
  seabios: remove PCI drivers from bios.bin
  pc_piix: remove pc-i440fx-1.4 up to pc-i440fx-1.7

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Stefan Hajnoczi committed Sep 27, 2023
    Copy the full SHA
    5dfd80e View commit details
    Browse the repository at this point in the history