The following changes since commit fff3159900d2b95613a9cb75fc3703e67a674729:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20190726' into staging (2019-07-26 16:23:07 +0100)

for you to fetch changes up to f77bed14f01557596727c4eea042e9818c242049:

net/colo-compare.c: Fix memory leak and code style issue. (2019-07-29 16:29:30 +0800)

Jason Wang (1):

e1000: don't raise interrupt in pre_save()

Prasad J Pandit (3):

qemu-bridge-helper: restrict interface name to IFNAMSIZ

qemu-bridge-helper: move repeating code in parse_acl_file

net: tap: replace snprintf with g_strdup_printf calls

Zhang Chen (1):

net/colo-compare.c: Fix memory leak and code style issue.

hw/net/e1000.c | 8 ++------

net/colo-compare.c | 27 ++++++++++++++++++++-------

net/tap.c | 19 +++++++++++--------

qemu-bridge-helper.c | 24 +++++++++++++++++-------

4 files changed, 50 insertions(+), 28 deletions(-)

We should not raise any interrupt after VM has been stopped but this

is what e1000 currently did when mit timer is active in

pre_save(). Fixing this by scheduling a timer in post_load() which can

make sure the interrupt was raised when VM is running.

Reported-and-tested-by: Longpeng <longpeng2@huawei.com>

hw/net/e1000.c | 8 ++------

1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c

--- a/hw/net/e1000.c

+++ b/hw/net/e1000.c

@@ -XXX,XX +XXX,XX @@ static int e1000_pre_save(void *opaque)

E1000State *s = opaque;

NetClientState *nc = qemu_get_queue(s->nic);

- /* If the mitigation timer is active, emulate a timeout now. */

- if (s->mit_timer_on) {

- e1000_mit_timer(s);

/*

* If link is down and auto-negotiation is supported and ongoing,

* complete auto-negotiation immediately. This allows us to look

@@ -XXX,XX +XXX,XX @@ static int e1000_post_load(void *opaque, int version_id)

s->mit_irq_level = false;

}

s->mit_ide = 0;

- s->mit_timer_on = false;

+ s->mit_timer_on = true;

+ timer_mod(s->mit_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1);

/* nc.link_down can't be migrated, so infer link_down according

* to link status bit in mac_reg[STATUS].

2.5.0

From: Prasad J Pandit <pjp@fedoraproject.org>

The network interface name in Linux is defined to be of size

IFNAMSIZ(=16), including the terminating null('\0') byte.

The same is applied to interface names read from 'bridge.conf'

file to form ACL rules. If user supplied '--br=bridge' name

is not restricted to the same length, it could lead to ACL bypass

issue. Restrict interface name to IFNAMSIZ, including null byte.

Reported-by: Riccardo Schirone <rschiron@redhat.com>

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

Reviewed-by: Li Qiang <liq3ea@gmail.com>

qemu-bridge-helper.c | 11 +++++++++++

1 file changed, 11 insertions(+)

diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c

--- a/qemu-bridge-helper.c

+++ b/qemu-bridge-helper.c

@@ -XXX,XX +XXX,XX @@ static int parse_acl_file(const char *filename, ACLList *acl_list)

*argend = 0;

+ if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {

+ fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));

+ fclose(f);

+ errno = EINVAL;

if (strcmp(cmd, "deny") == 0) {

acl_rule = g_malloc(sizeof(*acl_rule));

if (strcmp(arg, "all") == 0) {

@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)

usage();

return EXIT_FAILURE;

}

+ if (strlen(bridge) >= IFNAMSIZ) {

+ fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));

+ return EXIT_FAILURE;

+ }

/* parse default acl file */

QSIMPLEQ_INIT(&acl_list);

2.5.0

From: Zhang Chen <chen.zhang@intel.com>

This patch to fix the origin "char *data" memory leak, code style issue

and add necessary check here.

Reported-by: Coverity (CID 1402785)

Signed-off-by: Zhang Chen <chen.zhang@intel.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

net/colo-compare.c | 27 ++++++++++++++++++++-------

1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c

--- a/net/colo-compare.c

+++ b/net/colo-compare.c

@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CompareState *s,

uint32_t vnet_hdr_len,

bool notify_remote_frame);

+static bool packet_matches_str(const char *str,

+ const uint8_t *buf,

+ uint32_t packet_len)

+{

+ if (packet_len != strlen(str)) {

+ return false;

+ return !memcmp(str, buf, strlen(str));

+}

+

static void notify_remote_frame(CompareState *s)

{

char msg[] = "DO_CHECKPOINT";

@@ -XXX,XX +XXX,XX @@ static void compare_notify_rs_finalize(SocketReadState *notify_rs)

{

CompareState *s = container_of(notify_rs, CompareState, notify_rs);

- /* Get Xen colo-frame's notify and handle the message */

- char *data = g_memdup(notify_rs->buf, notify_rs->packet_len);

- char msg[] = "COLO_COMPARE_GET_XEN_INIT";

+ const char msg[] = "COLO_COMPARE_GET_XEN_INIT";

int ret;

- if (!strcmp(data, "COLO_USERSPACE_PROXY_INIT")) {

+ if (packet_matches_str("COLO_USERSPACE_PROXY_INIT",

+ notify_rs->buf,

+ notify_rs->packet_len)) {

ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);

if (ret < 0) {

error_report("Notify Xen COLO-frame INIT failed");

}

- }

-

- if (!strcmp(data, "COLO_CHECKPOINT")) {

+ } else if (packet_matches_str("COLO_CHECKPOINT",

+ notify_rs->buf,

+ notify_rs->packet_len)) {

/* colo-compare do checkpoint, flush pri packet and remove sec packet */

g_queue_foreach(&s->conn_list, colo_flush_packets, s);

+ } else {

+ error_report("COLO compare got unsupported instruction");

2.5.0

From: Prasad J Pandit <pjp@fedoraproject.org>

When invoking qemu-bridge-helper in 'net_bridge_run_helper',

instead of using fixed sized buffers, use dynamically allocated

ones initialised and returned by g_strdup_printf().

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Reviewed-by: Li Qiang <liq3ea@gmail.com>