The following changes since commit cfe68ae025f704f336d7dd3d1903ce37b445831d:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-26 20:55:54 +0000)

for you to fetch changes up to f3b364f4f77fcb24cec468f518bf5e093dc27cb7:

hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads (2020-03-27 18:59:47 +0800)

Andrew Melnychenko (1):

Fixed integer overflow in e1000e

Peter Maydell (2):

hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads

Philippe Mathieu-Daudé (7):

hw/net/i82596: Correct command bitmask (CID 1419392)

hw/net/e1000e_core: Let e1000e_can_receive() return a boolean

hw/net/smc91c111: Let smc91c111_can_receive() return a boolean

hw/net/rtl8139: Simplify if/else statement

hw/net/rtl8139: Update coding style to make checkpatch.pl happy

hw/net: Make NetCanReceive() return a boolean

hw/net/can: Make CanBusClientInfo::can_receive() return a boolean

Prasad J Pandit (1):

net: tulip: check frame size and r/w data length

Zhang Chen (2):

net/colo-compare.c: Expose "compare_timeout" to users

net/colo-compare.c: Expose "expired_scan_cycle" to users

hw/net/allwinner-sun8i-emac.c | 12 ++----

hw/net/allwinner_emac.c | 2 +-

hw/net/cadence_gem.c | 8 ++--

hw/net/can/can_sja1000.c | 8 ++--

hw/net/can/can_sja1000.h | 2 +-

hw/net/dp8393x.c | 8 ++--

hw/net/e1000.c | 2 +-

hw/net/e1000e.c | 4 +-

hw/net/e1000e_core.c | 2 +-

hw/net/e1000e_core.h | 2 +-

hw/net/ftgmac100.c | 6 +--

hw/net/i82596.c | 66 ++++++++++++++++++++----------

hw/net/i82596.h | 2 +-

hw/net/imx_fec.c | 2 +-

hw/net/opencores_eth.c | 5 +--

hw/net/rtl8139.c | 22 +++++-----

hw/net/smc91c111.c | 10 ++---

hw/net/spapr_llan.c | 4 +-

hw/net/sungem.c | 6 +--

hw/net/sunhme.c | 4 +-

hw/net/tulip.c | 36 ++++++++++++----

hw/net/virtio-net.c | 10 ++---

hw/net/xilinx_ethlite.c | 2 +-

include/net/can_emu.h | 2 +-

include/net/net.h | 2 +-

net/can/can_socketcan.c | 4 +-

net/colo-compare.c | 95 ++++++++++++++++++++++++++++++++++++++++---

net/filter-buffer.c | 2 +-

net/hub.c | 6 +--

qemu-options.hx | 10 +++--

30 files changed, 235 insertions(+), 111 deletions(-)

From: Peter Maydell <peter.maydell@linaro.org>

Coverity points out (CID 1421926) that the read code for

REG_ADDR_HIGH reads off the end of the buffer, because it does a

32-bit read from byte 4 of a 6-byte buffer.

The code also has an endianness issue for both REG_ADDR_HIGH and

REG_ADDR_LOW, because it will do the wrong thing on a big-endian

host.

Rewrite the read code to use ldl_le_p() and lduw_le_p() to fix this;

the write code is not incorrect, but for consistency we make it use

stl_le_p() and stw_le_p().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/net/allwinner-sun8i-emac.c | 12 ++++--------

1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c

--- a/hw/net/allwinner-sun8i-emac.c

+++ b/hw/net/allwinner-sun8i-emac.c

@@ -XXX,XX +XXX,XX @@ static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,

value = s->mii_data;

break;

case REG_ADDR_HIGH: /* MAC Address High */

- value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);

+ value = lduw_le_p(s->conf.macaddr.a + 4);

break;

case REG_ADDR_LOW: /* MAC Address Low */

- value = *(uint32_t *) (s->conf.macaddr.a);

+ value = ldl_le_p(s->conf.macaddr.a);

break;

case REG_TX_DMA_STA: /* Transmit DMA Status */

break;

@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,

s->mii_data = value;

break;

case REG_ADDR_HIGH: /* MAC Address High */

- s->conf.macaddr.a[4] = (value & 0xff);

- s->conf.macaddr.a[5] = (value & 0xff00) >> 8;

+ stw_le_p(s->conf.macaddr.a + 4, value);

break;

case REG_ADDR_LOW: /* MAC Address Low */

- s->conf.macaddr.a[0] = (value & 0xff);

- s->conf.macaddr.a[1] = (value & 0xff00) >> 8;

- s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;

- s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;

+ stl_le_p(s->conf.macaddr.a, value);

break;

case REG_TX_DMA_STA: /* Transmit DMA Status */

case REG_TX_CUR_DESC: /* Transmit Current Descriptor */

2.5.0

From: Zhang Chen <chen.zhang@intel.com>

The "expired_scan_cycle" determines period of scanning expired

primary node net packets.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>

net/colo-compare.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---

qemu-options.hx | 4 +++-

2 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c

--- a/net/colo-compare.c

+++ b/net/colo-compare.c

@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =

#define COLO_COMPARE_FREE_PRIMARY 0x01

#define COLO_COMPARE_FREE_SECONDARY 0x02

-/* TODO: Should be configurable */

#define REGULAR_PACKET_CHECK_MS 3000

#define DEFAULT_TIME_OUT_MS 3000

@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {

SocketReadState notify_rs;

bool vnet_hdr;

uint32_t compare_timeout;

+ uint32_t expired_scan_cycle;

/*

* Record the connection that through the NIC

@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)

/* if have old packet we will notify checkpoint */

colo_old_packet_check(s);

timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +

- REGULAR_PACKET_CHECK_MS);

+ s->expired_scan_cycle);

/* Public API, Used for COLO frame to notify compare event */

@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)

SCALE_MS, check_old_packet_regular,

s);

timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +

- REGULAR_PACKET_CHECK_MS);

+ s->expired_scan_cycle);

static void colo_compare_timer_del(CompareState *s)

@@ -XXX,XX +XXX,XX @@ out:

error_propagate(errp, local_err);

+static void compare_get_expired_scan_cycle(Object *obj, Visitor *v,

+ const char *name, void *opaque,

+ Error **errp)

+ CompareState *s = COLO_COMPARE(obj);

+ uint32_t value = s->expired_scan_cycle;

+ visit_type_uint32(v, name, &value, errp);

+static void compare_set_expired_scan_cycle(Object *obj, Visitor *v,

+ const char *name, void *opaque,

+ Error **errp)

+{

+ CompareState *s = COLO_COMPARE(obj);

+ Error *local_err = NULL;

+ uint32_t value;

+

+ visit_type_uint32(v, name, &value, &local_err);

+ if (local_err) {

+ goto out;

+ }

+ if (!value) {

+ error_setg(&local_err, "Property '%s.%s' requires a positive value",

+ object_get_typename(obj), name);

+ goto out;

+ }

+ s->expired_scan_cycle = value;

+

+out:

+ error_propagate(errp, local_err);

+}

+

static void compare_pri_rs_finalize(SocketReadState *pri_rs)

CompareState *s = container_of(pri_rs, CompareState, pri_rs);

@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)

s->compare_timeout = DEFAULT_TIME_OUT_MS;

}

+ if (!s->expired_scan_cycle) {

+ /* Set default value to 3000 MS */

+ s->expired_scan_cycle = REGULAR_PACKET_CHECK_MS;

+ }

+

if (find_and_check_chardev(&chr, s->pri_indev, errp) ||

!qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {

return;

@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)

compare_get_timeout,

compare_set_timeout, NULL, NULL, NULL);

+ object_property_add(obj, "expired_scan_cycle", "uint32",

+ compare_get_expired_scan_cycle,

+ compare_set_expired_scan_cycle, NULL, NULL, NULL);

+

s->vnet_hdr = false;

object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,

compare_set_vnet_hdr, NULL);

diff --git a/qemu-options.hx b/qemu-options.hx

--- a/qemu-options.hx

+++ b/qemu-options.hx

@@ -XXX,XX +XXX,XX @@ SRST

stored. The file format is libpcap, so it can be analyzed with

tools such as tcpdump or Wireshark.

- ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``

+ ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}][,expired_scan_cycle=@var{ms}``

Colo-compare gets packet from primary\_inchardevid and

secondary\_inchardevid, than compare primary packet with

secondary packet. If the packets are same, we will output

@@ -XXX,XX +XXX,XX @@ SRST

vnet\_hdr\_support flag, colo compare will send/recv packet with

vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the

maximum delay colo-compare wait for the packet.

+ The expired\_scan\_cycle=@var{ms} to set the period of scanning

+ expired primary node network packets.

If you want to use Xen COLO, will need the notify\_dev to

notify Xen colo-frame to do checkpoint.

2.5.0

From: Prasad J Pandit <pjp@fedoraproject.org>

Tulip network driver while copying tx/rx buffers does not check

frame size against r/w data length. This may lead to OOB buffer

access. Add check to avoid it.

Limit iterations over descriptors to avoid potential infinite

loop issue in tulip_xmit_list_update.

Reported-by: Li Qiang <pangpei.lq@antfin.com>

Reported-by: Ziming Zhang <ezrakiez@gmail.com>

Reported-by: Jason Wang <jasowang@redhat.com>

Tested-by: Li Qiang <liq3ea@gmail.com>

Reviewed-by: Li Qiang <liq3ea@gmail.com>

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------

1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/tulip.c

+++ b/hw/net/tulip.c

@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)

} else {

len = s->rx_frame_len;

}

+

+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {

+ return;

+ }

pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +

(s->rx_frame_size - s->rx_frame_len), len);

s->rx_frame_len -= len;

@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)

} else {

len = s->rx_frame_len;

}

+

+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {

+ return;

+ }

pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +

(s->rx_frame_size - s->rx_frame_len), len);

s->rx_frame_len -= len;

@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)

trace_tulip_receive(buf, size);

- if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {

+ if (size < 14 || size > sizeof(s->rx_frame) - 4

+ || s->rx_frame_len || tulip_rx_stopped(s)) {

return 0;

}

@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive_nc(NetClientState *nc,

return tulip_receive(qemu_get_nic_opaque(nc), buf, size);

}

-

static NetClientInfo net_tulip_info = {

.type = NET_CLIENT_DRIVER_NIC,

.size = sizeof(NICState),

@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)

if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {

/* Internal or external Loopback */

tulip_receive(s, s->tx_frame, s->tx_frame_len);

- } else {

+ } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {

qemu_send_packet(qemu_get_queue(s->nic),

s->tx_frame, s->tx_frame_len);

}

@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)

}

}

-static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)

+static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)

{

int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;

int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;

+ if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {

if (len1) {

pci_dma_read(&s->dev, desc->buf_addr1,

s->tx_frame + s->tx_frame_len, len1);

s->tx_frame_len += len1;

}

+ if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {

+ return -1;

+ }

if (len2) {

pci_dma_read(&s->dev, desc->buf_addr2,

s->tx_frame + s->tx_frame_len, len2);

s->tx_frame_len += len2;

}

desc->status = (len1 + len2) ? 0 : 0x7fffffff;

}

static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)

@@ -XXX,XX +XXX,XX @@ static uint32_t tulip_ts(TULIPState *s)

static void tulip_xmit_list_update(TULIPState *s)

{

+#define TULIP_DESC_MAX 128

+ uint8_t i = 0;

struct tulip_descriptor desc;

if (tulip_ts(s) != CSR5_TS_SUSPENDED) {

return;

}

- for (;;) {

+ for (i = 0; i < TULIP_DESC_MAX; i++) {

tulip_desc_read(s, s->current_tx_desc, &desc);

tulip_dump_tx_descriptor(s, &desc);

@@ -XXX,XX +XXX,XX @@ static void tulip_xmit_list_update(TULIPState *s)

s->tx_frame_len = 0;

}

- tulip_copy_tx_buffers(s, &desc);

-

- if (desc.control & TDES1_LS) {

- tulip_tx(s, &desc);

+ if (!tulip_copy_tx_buffers(s, &desc)) {

+ if (desc.control & TDES1_LS) {

+ tulip_tx(s, &desc);

+ }

}

}

tulip_desc_write(s, s->current_tx_desc, &desc);

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The CanBusClientInfo::can_receive handler return whether the

device can or can not receive new frames. Make it obvious by

returning a boolean type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

hw/net/can/can_sja1000.c | 8 ++++----

hw/net/can/can_sja1000.h | 2 +-

include/net/can_emu.h | 2 +-

net/can/can_socketcan.c | 4 ++--

4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c