The following changes since commit 5704c36d25ee84e7129722cb0db53df9faefe943:

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging (2018-11-12 15:55:40 +0000)

for you to fetch changes up to 1a42e5d8298d1b0f90d2254e7d559391dd3a45ca:

Merge remote-tracking branch 'mreitz/tags/pull-block-2018-11-12' into queue-block (2018-11-12 17:57:32 +0100)

Block layer patches:

- file-posix: Don't waste a file descriptor for locking, don't lock the

same bit multiple times

- nvme: Fix double free and memory leak

- Misc error handling fixes

- Added NULL checks found by static analysis

- Allow more block drivers to not be included in the qemu build

Fam Zheng (4):

file-posix: Use error API properly

file-posix: Skip effectiveless OFD lock operations

file-posix: Drop s->lock_fd

tests: Add unit tests for image locking

Jeff Cody (1):

block: Make more block drivers compile-time configurable

Kevin Wolf (1):

Merge remote-tracking branch 'mreitz/tags/pull-block-2018-11-12' into queue-block

Li Qiang (2):

nvme: don't unref ctrl_mem when device unrealized

nvme: free cmbuf in nvme_exit

Liam Merwick (5):

job: Fix off-by-one assert checks for JobSTT and JobVerbTable

block: Null pointer dereference in blk_root_get_parent_desc()

qemu-img: assert block_job_get() does not return NULL in img_commit()

block: Fix potential Null pointer dereferences in vvfat.c

qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()

Peter Maydell (1):

blockdev: Consistently use snapshot_node_name in external_snapshot_prepare()

zhenwei pi (1):

blockdev: handle error on block latency histogram set error

configure | 91 ++++++++++++++++++++++++++

block/block-backend.c | 3 +-

block/file-posix.c | 122 ++++++++++++++++++++---------------

block/qcow2-refcount.c | 18 +++---

block/vvfat.c | 46 ++++++++-----

blockdev.c | 21 ++++--

hw/block/nvme.c | 6 +-

job.c | 4 +-

qemu-img.c | 1 +

tests/test-image-locking.c | 157 +++++++++++++++++++++++++++++++++++++++++++++

block/Makefile.objs | 22 +++++--

tests/Makefile.include | 2 +

12 files changed, 400 insertions(+), 93 deletions(-)

create mode 100644 tests/test-image-locking.c

From: Liam Merwick <Liam.Merwick@oracle.com>

The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not

add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[].

As a result, an array dereference of metadata_ol_names[8] in

qcow2_pre_write_overlap_check() could result in a read outside of the array bounds.

Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory')

Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>

Reviewed-by: Eric Blake <eblake@redhat.com>

Reviewed-by: Max Reitz <mreitz@redhat.com>

Message-id: 1541453919-25973-6-git-send-email-Liam.Merwick@oracle.com

Signed-off-by: Max Reitz <mreitz@redhat.com>

block/qcow2-refcount.c | 18 ++++++++++--------

1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c

--- a/block/qcow2-refcount.c

+++ b/block/qcow2-refcount.c

@@ -XXX,XX +XXX,XX @@ int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,

static const char *metadata_ol_names[] = {

- [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header",

- [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table",

- [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table",

- [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table",

- [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block",

- [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table",

- [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table",

- [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table",

+ [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header",

+ [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table",

+ [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table",

+ [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table",

+ [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block",

+ [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table",

+ [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table",

+ [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table",

+ [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = "bitmap directory",

};

+QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));

/*

* First performs a check for metadata overlaps (through

2.19.1

From: Liam Merwick <Liam.Merwick@oracle.com>

The dev_id returned by the call to blk_get_attached_dev_id() in

blk_root_get_parent_desc() can be NULL (an internal call to

object_get_canonical_path may have returned NULL).

Instead of just checking this case before before dereferencing,

adjust blk_get_attached_dev_id() to return the empty string if no

object path can be found (similar to the case when blk->dev is NULL

and an empty string is returned).

Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>

Message-id: 1541453919-25973-3-git-send-email-Liam.Merwick@oracle.com

Reviewed-by: Max Reitz <mreitz@redhat.com>

Signed-off-by: Max Reitz <mreitz@redhat.com>

block/block-backend.c | 3 ++-

1 file changed, 2 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ char *blk_get_attached_dev_id(BlockBackend *blk)

} else if (dev->id) {

return g_strdup(dev->id);

- return object_get_canonical_path(OBJECT(dev));

+

+ return object_get_canonical_path(OBJECT(dev)) ?: g_strdup("");

}

/*

2.19.1

From: zhenwei pi <pizhenwei@bytedance.com>

Function block_latency_histogram_set may return error, but qapi ignore this.

This can be reproduced easily by qmp command:

virsh qemu-monitor-command INSTANCE '{"execute":"x-block-latency-histogram-set",

"arguments":{"device":"drive-virtio-disk1","boundaries":[10,200,40]}}'

In fact this command does not work, but we still get success result.

qmp_x_block_latency_histogram_set is a batch setting API, report error ASAP.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

blockdev.c | 19 ++++++++++++++++---

1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/blockdev.c b/blockdev.c

--- a/blockdev.c

+++ b/blockdev.c

@@ -XXX,XX +XXX,XX @@ void qmp_x_block_latency_histogram_set(

BlockBackend *blk = blk_by_name(device);

BlockAcctStats *stats;

+ int ret;

if (!blk) {

error_setg(errp, "Device '%s' not found", device);

@@ -XXX,XX +XXX,XX @@ void qmp_x_block_latency_histogram_set(

if (has_boundaries || has_boundaries_read) {

- block_latency_histogram_set(

+ ret = block_latency_histogram_set(

stats, BLOCK_ACCT_READ,

has_boundaries_read ? boundaries_read : boundaries);

+ if (ret) {

+ error_setg(errp, "Device '%s' set read boundaries fail", device);

+ return;

+ }

if (has_boundaries || has_boundaries_write) {

- block_latency_histogram_set(

+ ret = block_latency_histogram_set(

stats, BLOCK_ACCT_WRITE,

has_boundaries_write ? boundaries_write : boundaries);

+ if (ret) {

+ error_setg(errp, "Device '%s' set write boundaries fail", device);

+ return;

+ }

if (has_boundaries || has_boundaries_flush) {

- block_latency_histogram_set(

+ ret = block_latency_histogram_set(

stats, BLOCK_ACCT_FLUSH,

has_boundaries_flush ? boundaries_flush : boundaries);

+ if (ret) {

+ error_setg(errp, "Device '%s' set flush boundaries fail", device);

+ return;

+ }

}

2.19.1

From: Li Qiang <liq3ea@gmail.com>

Currently, when hotplug/unhotplug nvme device, it will cause an

assert in object.c. Following is the backtrack:

ERROR:qom/object.c:981:object_unref: assertion failed: (obj->ref > 0)

Thread 2 "qemu-system-x86" received signal SIGABRT, Aborted.

[Switching to Thread 0x7fffcbd32700 (LWP 18844)]

0x00007fffdb9e4fff in raise () from /lib/x86_64-linux-gnu/libc.so.6

(gdb) bt

/lib/x86_64-linux-gnu/libglib-2.0.so.0

/lib/x86_64-linux-gnu/libglib-2.0.so.0

qom/object.c:981

/home/liqiang02/qemu-upstream/qemu/memory.c:1732

/home/liqiang02/qemu-upstream/qemu/memory.c:285

util/qemu-thread-posix.c:504

/lib/x86_64-linux-gnu/libpthread.so.0

This is caused by memory_region_unref in nvme_exit.

Remove it to make the PCIdevice refcount correct.

Signed-off-by: Li Qiang <liq3ea@gmail.com>

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

hw/block/nvme.c | 3 ---

1 file changed, 3 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c

--- a/hw/block/nvme.c

+++ b/hw/block/nvme.c

@@ -XXX,XX +XXX,XX @@ static void nvme_exit(PCIDevice *pci_dev)

g_free(n->namespaces);

g_free(n->cq);

g_free(n->sq);

- if (n->cmbsz) {

- memory_region_unref(&n->ctrl_mem);

- }

msix_uninit_exclusive_bar(pci_dev);

2.19.1

From: Fam Zheng <famz@redhat.com>

Signed-off-by: Fam Zheng <famz@redhat.com>

tests/test-image-locking.c | 157 +++++++++++++++++++++++++++++++++++++

tests/Makefile.include | 2 +

2 files changed, 159 insertions(+)

create mode 100644 tests/test-image-locking.c

diff --git a/tests/test-image-locking.c b/tests/test-image-locking.c

+++ b/tests/test-image-locking.c

+ * Image locking tests

+ * Copyright (c) 2018 Red Hat Inc.

+ * Author: Fam Zheng <famz@redhat.com>

+ * Permission is hereby granted, free of charge, to any person obtaining a copy

+ * of this software and associated documentation files (the "Software"), to deal

+ * in the Software without restriction, including without limitation the rights

+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

+ * copies of the Software, and to permit persons to whom the Software is

+ * furnished to do so, subject to the following conditions:

+ * The above copyright notice and this permission notice shall be included in

+ * all copies or substantial portions of the Software.

+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

+ * THE SOFTWARE.

+#include "block/block.h"

+#include "sysemu/block-backend.h"

+#include "qapi/error.h"

+#include "qapi/qmp/qdict.h"

+