Series comparison

-[Qemu-devel] [PULL 0/2] Block patches
+[PULL 0/1] Block patches
-The following changes since commit b384cd95eb9c6f73ad84ed1bb0717a26e29cc78f:
+The following changes since commit 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56:
-  Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-01-19 16:35:25 +0000)
+  scripts/checkpatch: Fix a typo (2025-03-04 09:30:26 +0800)
 are available in the Git repository at:
-  git://github.com/stefanha/qemu.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 91661dbdff76d526d22bc7ddf9df3d41e80cdbbf:
+for you to fetch changes up to 2ad638a3d160923ef3dbf87c73944e6e44bdc724:
-  block: add block_set_io_throttle virtio-blk-pci QMP example (2018-01-22 12:19:14 +0000)
+  block/qed: fix use-after-free by nullifying timer pointer after free (2025-03-06 10:19:54 +0800)
 ----------------------------------------------------------------
 Pull request
 QED need_check_timer use-after-free fix
 ----------------------------------------------------------------
-----------------------------------------------------------------
+Denis Rastyogin (1):
   block/qed: fix use-after-free by nullifying timer pointer after free
-Mao Zhongyi (1):
+ block/qed.c | 1 +
-  hw/block: Use errp directly rather than local_err
+file changed, 1 insertion(+)
 Stefan Hajnoczi (1):
   block: add block_set_io_throttle virtio-blk-pci QMP example
  qapi/block-core.json  | 18 ++++++++++++++++++
  hw/block/virtio-blk.c |  5 +----
 files changed, 19 insertions(+), 4 deletions(-)
 --
-.14.3
+.48.1

-[Qemu-devel] [PULL 1/2] hw/block: Use errp directly rather than local_err
+Deleted patch
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
-Cc: John Snow <jsnow@redhat.com>
-Cc: Kevin Wolf <kwolf@redhat.com>
-Cc: Max Reitz <mreitz@redhat.com>
-Cc: Keith Busch <keith.busch@intel.com>
-Cc: Stefan Hajnoczi <stefanha@redhat.com>
-Cc: "Michael S. Tsirkin" <mst@redhat.com>
-Cc: Paolo Bonzini <pbonzini@redhat.com>
-Cc: Gerd Hoffmann <kraxel@redhat.com>
-Cc: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: e77848d3735ba590f23ffbf8094379c646c33d79.1511317952.git.maozy.fnst@cn.fujitsu.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
-     VirtIOBlock *s = VIRTIO_BLK(dev);
-     VirtIOBlkConf *conf = &s->conf;
--    Error *err = NULL;
-     unsigned i;
-     if (!conf->conf.blk) {
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < conf->num_queues; i++) {
-         virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
-     }
--    virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
--    if (err != NULL) {
--        error_propagate(errp, err);
-+    if (!virtio_blk_data_plane_create(vdev, conf, &s->dataplane, errp)) {
-         virtio_cleanup(vdev);
-         return;
-     }
---
-.14.3

-[Qemu-devel] [PULL 2/2] block: add block_set_io_throttle virtio-blk-pci QMP example
+[PULL 1/1] block/qed: fix use-after-free by nullifying timer pointer after free
-The block_set_io_throttle command can look up BlockBackends by the
+From: Denis Rastyogin <gerben@altlinux.org>
 attached qdev device ID.  virtio-blk-pci is a special case because the
 actual VirtIOBlock device is the "/virtio-backend" child of the PCI
 adapter device.
-Add a QMP schema example so clients will know how to use
+This error was discovered by fuzzing qemu-img.
 block_set_io_throttle on the virtio-blk-pci device.
-The alternative is to implement some sort of aliasing for qmp_get_blk()
+In the QED block driver, the need_check_timer timer is freed in
-but that is likely to cause confusion and could break future use cases.
+bdrv_qed_detach_aio_context, but the pointer to the timer is not
-Let's not go there.
+set to NULL. This can lead to a use-after-free scenario
 in bdrv_qed_drain_begin().
-Cc: Kevin Wolf <kwolf@redhat.com>
+The need_check_timer pointer is set to NULL after freeing the timer.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Which helps catch this condition when checking in bdrv_qed_drain_begin().
-Reviewed-by: Alberto Garcia <berto@igalia.com>
-Message-id: 20180117090700.25811-1-stefanha@redhat.com
+Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
 Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
 Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- qapi/block-core.json | 18 ++++++++++++++++++
+ block/qed.c | 1 +
-file changed, 18 insertions(+)
+file changed, 1 insertion(+)
-diff --git a/qapi/block-core.json b/qapi/block-core.json
+diff --git a/block/qed.c b/block/qed.c
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/block-core.json
+--- a/block/qed.c
-+++ b/qapi/block-core.json
++++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
- # Example:
- #
+     qed_cancel_need_check_timer(s);
- # -> { "execute": "block_set_io_throttle",
+     timer_free(s->need_check_timer);
-+#      "arguments": { "id": "virtio-blk-pci0/virtio-backend",
++    s->need_check_timer = NULL;
-+#                     "bps": 0,
+ }
-+#                     "bps_rd": 0,
-+#                     "bps_wr": 0,
+ static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
 +#                     "iops": 512,
 +#                     "iops_rd": 0,
 +#                     "iops_wr": 0,
 +#                     "bps_max": 0,
 +#                     "bps_rd_max": 0,
 +#                     "bps_wr_max": 0,
 +#                     "iops_max": 0,
 +#                     "iops_rd_max": 0,
 +#                     "iops_wr_max": 0,
 +#                     "bps_max_length": 0,
 +#                     "iops_size": 0 } }
 +# <- { "return": {} }
 +#
 +# -> { "execute": "block_set_io_throttle",
  #      "arguments": { "id": "ide0-1-0",
  #                     "bps": 1000000,
  #                     "bps_rd": 0,
 --
-.14.3
+.48.1

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Cc: John Snow <jsnow@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Keith Busch <keith.busch@intel.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: e77848d3735ba590f23ffbf8094379c646c33d79.1511317952.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOBlock *s = VIRTIO_BLK(dev);
     VirtIOBlkConf *conf = &s->conf;
-    Error *err = NULL;
     unsigned i;
 
     if (!conf->conf.blk) {
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < conf->num_queues; i++) {
         virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
     }
-    virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
+    if (!virtio_blk_data_plane_create(vdev, conf, &s->dataplane, errp)) {
         virtio_cleanup(vdev);
         return;
     }
-- 
2.14.3

The block_set_io_throttle command can look up BlockBackends by the
attached qdev device ID.  virtio-blk-pci is a special case because the
actual VirtIOBlock device is the "/virtio-backend" child of the PCI
adapter device.

Add a QMP schema example so clients will know how to use
block_set_io_throttle on the virtio-blk-pci device.

The alternative is to implement some sort of aliasing for qmp_get_blk()
but that is likely to cause confusion and could break future use cases.
Let's not go there.

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180117090700.25811-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-core.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 # Example:
 #
 # -> { "execute": "block_set_io_throttle",
+#      "arguments": { "id": "virtio-blk-pci0/virtio-backend",
+#                     "bps": 0,
+#                     "bps_rd": 0,
+#                     "bps_wr": 0,
+#                     "iops": 512,
+#                     "iops_rd": 0,
+#                     "iops_wr": 0,
+#                     "bps_max": 0,
+#                     "bps_rd_max": 0,
+#                     "bps_wr_max": 0,
+#                     "iops_max": 0,
+#                     "iops_rd_max": 0,
+#                     "iops_wr_max": 0,
+#                     "bps_max_length": 0,
+#                     "iops_size": 0 } }
+# <- { "return": {} }
+#
+# -> { "execute": "block_set_io_throttle",
 #      "arguments": { "id": "ide0-1-0",
 #                     "bps": 1000000,
 #                     "bps_rd": 0,
-- 
2.14.3

From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().

The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
 
     qed_cancel_need_check_timer(s);
     timer_free(s->need_check_timer);
+    s->need_check_timer = NULL;
 }
 
 static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
-- 
2.48.1