[PULL 0/1] Block patches
[PULL 0/1] Block patches
1
The following changes since commit d145c0da22cde391d8c6672d33146ce306e8bf75:
1
The following changes since commit fd87be1dada5672f877e03c2ca8504458292c479:
2
2
3
Merge tag 'pull-tcg-20230701' of https://gitlab.com/rth7680/qemu into staging (2023-07-01 08:55:37 +0200)
3
Merge tag 'accel-20240426' of https://github.com/philmd/qemu into staging (2024-04-26 15:28:13 -0700)
4
4
5
are available in the Git repository at:
5
are available in the Git repository at:
6
6
7
https://gitlab.com/stefanha/qemu.git tags/block-pull-request
7
https://gitlab.com/stefanha/qemu.git tags/block-pull-request
8
8
9
for you to fetch changes up to c21eae1ccc782440f320accb6f90c66cb8f45ee9:
9
for you to fetch changes up to d1c4580662bf75bf6875bb5e1ad446b300816ac7:
10
10
11
block/blkio: fix module_block.py parsing (2023-07-04 17:28:25 +0200)
11
hw/ufs: Fix buffer overflow bug (2024-04-29 09:33:06 -0400)
12
12
13
----------------------------------------------------------------
13
----------------------------------------------------------------
14
Pull request
14
Pull request
15
15
16
Fix --enable-modules with the blkio block driver.
16
Buffer overflow fix for Universal Flash Storage (UFS) emulation.
17
17
18
----------------------------------------------------------------
18
----------------------------------------------------------------
19
19
20
Stefan Hajnoczi (1):
20
Jeuk Kim (1):
21
block/blkio: fix module_block.py parsing
21
hw/ufs: Fix buffer overflow bug
22
22
23
block/blkio.c | 108 ++++++++++++++++++++++++++------------------------
23
hw/ufs/ufs.c | 8 ++++++++
24
1 file changed, 56 insertions(+), 52 deletions(-)
24
1 file changed, 8 insertions(+)
25
25
26
--
26
--
27
2.40.1
27
2.44.0
diff view generated by jsdifflib
[PULL 1/1] block/blkio: fix module_block.py parsing
[PULL 1/1] hw/ufs: Fix buffer overflow bug
1
When QEMU is built with --enable-modules, the module_block.py script
1
From: Jeuk Kim <jeuk20.kim@samsung.com>
2
parses block/*.c to find block drivers that are built as modules. The
3
script generates a table of block drivers called block_driver_modules[].
4
This table is used for block driver module loading.
5
2
6
The blkio.c driver uses macros to define its BlockDriver structs. This
3
It fixes the buffer overflow vulnerability in the ufs device.
7
was done to avoid code duplication but the module_block.py script is
4
The bug was detected by sanitizers.
8
unable to parse the macro. The result is that libblkio-based block
9
drivers can be built as modules but will not be found at runtime.
10
5
11
One fix is to make the module_block.py script or build system fancier so
6
You can reproduce it by:
12
it can parse C macros (e.g. by parsing the preprocessed source code). I
13
chose not to do this because it raises the complexity of the build,
14
making future issues harder to debug.
15
7
16
Keep things simple: use the macro to avoid duplicating BlockDriver
8
cat << EOF |\
17
function pointers but define .format_name and .protocol_name manually
9
qemu-system-x86_64 \
18
for each BlockDriver. This way the module_block.py is able to parse the
10
-display none -machine accel=qtest -m 512M -M q35 -nodefaults -drive \
19
code.
11
file=null-co://,if=none,id=disk0 -device ufs,id=ufs_bus -device \
12
ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio
13
outl 0xcf8 0x80000810
14
outl 0xcfc 0xe0000000
15
outl 0xcf8 0x80000804
16
outw 0xcfc 0x06
17
write 0xe0000058 0x1 0xa7
18
write 0xa 0x1 0x50
19
EOF
20
20
21
Also get rid of the block driver name macros (e.g. DRIVER_IO_URING)
21
Resolves: #2299
22
because module_block.py cannot parse them either.
22
Fixes: 329f16624499 ("hw/ufs: Support for Query Transfer Requests")
23
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
24
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
25
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
26
Message-ID: <f2c8aeb1afefcda92054c448b21fc59cdd99db30.1714360640.git.jeuk20.kim@samsung.com>
27
---
28
hw/ufs/ufs.c | 8 ++++++++
29
1 file changed, 8 insertions(+)
23
30
24
Fixes: fd66dbd424f5 ("blkio: add libblkio block driver")
31
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
25
Reported-by: Qing Wang <qinwang@redhat.com>
26
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
27
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
28
Message-id: 20230704123436.187761-1-stefanha@redhat.com
29
Cc: Stefano Garzarella <sgarzare@redhat.com>
30
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
31
---
32
block/blkio.c | 108 ++++++++++++++++++++++++++------------------------
33
1 file changed, 56 insertions(+), 52 deletions(-)
34
35
diff --git a/block/blkio.c b/block/blkio.c
36
index XXXXXXX..XXXXXXX 100644
32
index XXXXXXX..XXXXXXX 100644
37
--- a/block/blkio.c
33
--- a/hw/ufs/ufs.c
38
+++ b/block/blkio.c
34
+++ b/hw/ufs/ufs.c
39
@@ -XXX,XX +XXX,XX @@
35
@@ -XXX,XX +XXX,XX @@ static MemTxResult ufs_dma_read_req_upiu(UfsRequest *req)
40
36
copy_size = sizeof(UtpUpiuHeader) + UFS_TRANSACTION_SPECIFIC_FIELD_SIZE +
41
#include "block/block-io.h"
37
data_segment_length;
42
38
43
-/*
39
+ if (copy_size > sizeof(req->req_upiu)) {
44
- * Keep the QEMU BlockDriver names identical to the libblkio driver names.
40
+ copy_size = sizeof(req->req_upiu);
45
- * Using macros instead of typing out the string literals avoids typos.
41
+ }
46
- */
42
+
47
-#define DRIVER_IO_URING "io_uring"
43
ret = ufs_addr_read(u, req_upiu_base_addr, &req->req_upiu, copy_size);
48
-#define DRIVER_NVME_IO_URING "nvme-io_uring"
44
if (ret) {
49
-#define DRIVER_VIRTIO_BLK_VFIO_PCI "virtio-blk-vfio-pci"
45
trace_ufs_err_dma_read_req_upiu(req->slot, req_upiu_base_addr);
50
-#define DRIVER_VIRTIO_BLK_VHOST_USER "virtio-blk-vhost-user"
46
@@ -XXX,XX +XXX,XX @@ static MemTxResult ufs_dma_write_rsp_upiu(UfsRequest *req)
51
-#define DRIVER_VIRTIO_BLK_VHOST_VDPA "virtio-blk-vhost-vdpa"
47
copy_size = rsp_upiu_byte_len;
52
-
53
/*
54
* Allocated bounce buffers are kept in a list sorted by buffer address.
55
*/
56
@@ -XXX,XX +XXX,XX @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
57
return ret;
58
}
48
}
59
49
60
- if (strcmp(blkio_driver, DRIVER_IO_URING) == 0) {
50
+ if (copy_size > sizeof(req->rsp_upiu)) {
61
+ if (strcmp(blkio_driver, "io_uring") == 0) {
51
+ copy_size = sizeof(req->rsp_upiu);
62
ret = blkio_io_uring_open(bs, options, flags, errp);
52
+ }
63
- } else if (strcmp(blkio_driver, DRIVER_NVME_IO_URING) == 0) {
64
+ } else if (strcmp(blkio_driver, "nvme-io_uring") == 0) {
65
ret = blkio_nvme_io_uring(bs, options, flags, errp);
66
- } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VFIO_PCI) == 0) {
67
+ } else if (strcmp(blkio_driver, "virtio-blk-vfio-pci") == 0) {
68
ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
69
- } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_USER) == 0) {
70
+ } else if (strcmp(blkio_driver, "virtio-blk-vhost-user") == 0) {
71
ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
72
- } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_VDPA) == 0) {
73
+ } else if (strcmp(blkio_driver, "virtio-blk-vhost-vdpa") == 0) {
74
ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
75
} else {
76
g_assert_not_reached();
77
@@ -XXX,XX +XXX,XX @@ static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
78
* - truncate
79
*/
80
81
-#define BLKIO_DRIVER(name, ...) \
82
- { \
83
- .format_name = name, \
84
- .protocol_name = name, \
85
- .instance_size = sizeof(BDRVBlkioState), \
86
- .bdrv_file_open = blkio_file_open, \
87
- .bdrv_close = blkio_close, \
88
- .bdrv_co_getlength = blkio_co_getlength, \
89
- .bdrv_co_truncate = blkio_truncate, \
90
- .bdrv_co_get_info = blkio_co_get_info, \
91
- .bdrv_attach_aio_context = blkio_attach_aio_context, \
92
- .bdrv_detach_aio_context = blkio_detach_aio_context, \
93
- .bdrv_co_pdiscard = blkio_co_pdiscard, \
94
- .bdrv_co_preadv = blkio_co_preadv, \
95
- .bdrv_co_pwritev = blkio_co_pwritev, \
96
- .bdrv_co_flush_to_disk = blkio_co_flush, \
97
- .bdrv_co_pwrite_zeroes = blkio_co_pwrite_zeroes, \
98
- .bdrv_refresh_limits = blkio_refresh_limits, \
99
- .bdrv_register_buf = blkio_register_buf, \
100
- .bdrv_unregister_buf = blkio_unregister_buf, \
101
- __VA_ARGS__ \
102
- }
103
+/*
104
+ * Do not include .format_name and .protocol_name because module_block.py
105
+ * does not parse macros in the source code.
106
+ */
107
+#define BLKIO_DRIVER_COMMON \
108
+ .instance_size = sizeof(BDRVBlkioState), \
109
+ .bdrv_file_open = blkio_file_open, \
110
+ .bdrv_close = blkio_close, \
111
+ .bdrv_co_getlength = blkio_co_getlength, \
112
+ .bdrv_co_truncate = blkio_truncate, \
113
+ .bdrv_co_get_info = blkio_co_get_info, \
114
+ .bdrv_attach_aio_context = blkio_attach_aio_context, \
115
+ .bdrv_detach_aio_context = blkio_detach_aio_context, \
116
+ .bdrv_co_pdiscard = blkio_co_pdiscard, \
117
+ .bdrv_co_preadv = blkio_co_preadv, \
118
+ .bdrv_co_pwritev = blkio_co_pwritev, \
119
+ .bdrv_co_flush_to_disk = blkio_co_flush, \
120
+ .bdrv_co_pwrite_zeroes = blkio_co_pwrite_zeroes, \
121
+ .bdrv_refresh_limits = blkio_refresh_limits, \
122
+ .bdrv_register_buf = blkio_register_buf, \
123
+ .bdrv_unregister_buf = blkio_unregister_buf,
124
125
-static BlockDriver bdrv_io_uring = BLKIO_DRIVER(
126
- DRIVER_IO_URING,
127
+/*
128
+ * Use the same .format_name and .protocol_name as the libblkio driver name for
129
+ * consistency.
130
+ */
131
+
53
+
132
+static BlockDriver bdrv_io_uring = {
54
ret = ufs_addr_write(u, rsp_upiu_base_addr, &req->rsp_upiu, copy_size);
133
+ .format_name = "io_uring",
55
if (ret) {
134
+ .protocol_name = "io_uring",
56
trace_ufs_err_dma_write_rsp_upiu(req->slot, rsp_upiu_base_addr);
135
.bdrv_needs_filename = true,
136
-);
137
+ BLKIO_DRIVER_COMMON
138
+};
139
140
-static BlockDriver bdrv_nvme_io_uring = BLKIO_DRIVER(
141
- DRIVER_NVME_IO_URING,
142
-);
143
+static BlockDriver bdrv_nvme_io_uring = {
144
+ .format_name = "nvme-io_uring",
145
+ .protocol_name = "nvme-io_uring",
146
+ BLKIO_DRIVER_COMMON
147
+};
148
149
-static BlockDriver bdrv_virtio_blk_vfio_pci = BLKIO_DRIVER(
150
- DRIVER_VIRTIO_BLK_VFIO_PCI
151
-);
152
+static BlockDriver bdrv_virtio_blk_vfio_pci = {
153
+ .format_name = "virtio-blk-vfio-pci",
154
+ .protocol_name = "virtio-blk-vfio-pci",
155
+ BLKIO_DRIVER_COMMON
156
+};
157
158
-static BlockDriver bdrv_virtio_blk_vhost_user = BLKIO_DRIVER(
159
- DRIVER_VIRTIO_BLK_VHOST_USER
160
-);
161
+static BlockDriver bdrv_virtio_blk_vhost_user = {
162
+ .format_name = "virtio-blk-vhost-user",
163
+ .protocol_name = "virtio-blk-vhost-user",
164
+ BLKIO_DRIVER_COMMON
165
+};
166
167
-static BlockDriver bdrv_virtio_blk_vhost_vdpa = BLKIO_DRIVER(
168
- DRIVER_VIRTIO_BLK_VHOST_VDPA
169
-);
170
+static BlockDriver bdrv_virtio_blk_vhost_vdpa = {
171
+ .format_name = "virtio-blk-vhost-vdpa",
172
+ .protocol_name = "virtio-blk-vhost-vdpa",
173
+ BLKIO_DRIVER_COMMON
174
+};
175
176
static void bdrv_blkio_init(void)
177
{
178
--
57
--
179
2.40.1
58
2.44.0
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.