Series comparison

-[Qemu-devel] [PULL 0/1] Block patches
+[PULL for-9.0 0/1] Block patches
-The following changes since commit 64175afc695c0672876fbbfc31b299c86d562cb4:
+The following changes since commit 786fd793b81410fb2a28914315e2f05d2ff6733b:
-  arm_gicv3: Fix ICC_BPR1 reset value when EL3 not implemented (2017-06-07 17:21:44 +0100)
+  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2024-04-03 12:52:03 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 56faeb9bb6872b3f926b3b3e0452a70beea10af2:
+for you to fetch changes up to bbdf9023665f409113cb07b463732861af63fb47:
-  block/gluster.c: Handle qdict_array_entries() failure (2017-06-09 08:41:29 -0400)
+  block/virtio-blk: Fix memory leak from virtio_blk_zone_report (2024-04-04 09:29:42 -0400)
 ----------------------------------------------------------------
-Gluster patch
+Pull request
 Fix a memory leak in virtio-blk zone report emulation code when the request is
 invalid.
 ----------------------------------------------------------------
-Peter Maydell (1):
+Zheyu Ma (1):
-  block/gluster.c: Handle qdict_array_entries() failure
+  block/virtio-blk: Fix memory leak from virtio_blk_zone_report
- block/gluster.c | 3 +--
+ hw/block/virtio-blk.c | 3 ++-
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
 --
-.9.3
+.44.0

-[Qemu-devel] [PULL 1/1] block/gluster.c: Handle qdict_array_entries() failure
+[PULL for-9.0 1/1] block/virtio-blk: Fix memory leak from virtio_blk_zone_report
-From: Peter Maydell <peter.maydell@linaro.org>
+From: Zheyu Ma <zheyuma97@gmail.com>
-In qemu_gluster_parse_json(), the call to qdict_array_entries()
+This modification ensures that in scenarios where the buffer size is
-could return a negative error code, which we were ignoring
+insufficient for a zone report, the function will now properly set an
-because we assigned the result to an unsigned variable.
+error status and proceed to a cleanup label, instead of merely
-Fix this by using the 'int' type instead, which matches the
+returning.
 return type of qdict_array_entries() and also the type
 we use for the loop enumeration variable 'i'.
-(Spotted by Coverity, CID 1360960.)
+The following ASAN log reveals it:
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+==1767400==ERROR: LeakSanitizer: detected memory leaks
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Direct leak of 312 byte(s) in 1 object(s) allocated from:
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+    #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
-Message-id: 1496682098-1540-1-git-send-email-peter.maydell@linaro.org
+    #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+    #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
     #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
     #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
     #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
     #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5
 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
 Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/gluster.c | 3 +--
+ hw/block/virtio-blk.c | 3 ++-
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/block/gluster.c b/block/gluster.c
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/gluster.c
+--- a/hw/block/virtio-blk.c
-+++ b/block/gluster.c
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
-     Error *local_err = NULL;
+             sizeof(struct virtio_blk_zone_report) +
-     char *str = NULL;
+             sizeof(struct virtio_blk_zone_descriptor)) {
-     const char *ptr;
+         virtio_error(vdev, "in buffer too small for zone report");
--    size_t num_servers;
+-        return;
--    int i, type;
++        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
-+    int i, type, num_servers;
++        goto out;
+     }
-     /* create opts info from runtime_json_opts list */
-     opts = qemu_opts_create(&runtime_json_opts, NULL, 0, &error_abort);
+     /* start byte offset of the zone report */
 --
-.9.3
+.44.0

From: Peter Maydell <peter.maydell@linaro.org>

In qemu_gluster_parse_json(), the call to qdict_array_entries()
could return a negative error code, which we were ignoring
because we assigned the result to an unsigned variable.
Fix this by using the 'int' type instead, which matches the
return type of qdict_array_entries() and also the type
we use for the loop enumeration variable 'i'.

(Spotted by Coverity, CID 1360960.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Message-id: 1496682098-1540-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/gluster.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/block/gluster.c b/block/gluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
     Error *local_err = NULL;
     char *str = NULL;
     const char *ptr;
-    size_t num_servers;
-    int i, type;
+    int i, type, num_servers;
 
     /* create opts info from runtime_json_opts list */
     opts = qemu_opts_create(&runtime_json_opts, NULL, 0, &error_abort);
-- 
2.9.3

From: Zheyu Ma <zheyuma97@gmail.com>

This modification ensures that in scenarios where the buffer size is
insufficient for a zone report, the function will now properly set an
error status and proceed to a cleanup label, instead of merely
returning.

The following ASAN log reveals it:

==1767400==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 312 byte(s) in 1 object(s) allocated from:
    #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
    #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
    #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
    #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
    #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
    #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
             sizeof(struct virtio_blk_zone_report) +
             sizeof(struct virtio_blk_zone_descriptor)) {
         virtio_error(vdev, "in buffer too small for zone report");
-        return;
+        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
+        goto out;
     }
 
     /* start byte offset of the zone report */
-- 
2.44.0