a05903a904
- kvm-spapr-xive-Mask-the-EAS-when-allocating-an-IRQ.patch [bz#1748725] - kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch [bz#1746267] - kvm-virtio-blk-Cancel-the-pending-BH-when-the-dataplane-.patch [bz#1717321] - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749737] - Resolves: bz#1717321 (qemu-kvm core dumped when repeat "system_reset" multiple times during guest boot) - Resolves: bz#1746267 (qemu coredump: qemu-kvm: block/create.c:68: qmp_blockdev_create: Assertion `drv' failed) - Resolves: bz#1748725 ([ppc][migration][v6.3-rc1-p1ce8930]basic migration failed with "qemu-kvm: KVM_SET_DEVICE_ATTR failed: Group 3 attr 0x0000000000001309: Device or resource busy") - Resolves: bz#1749737 (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-av-8])
108 lines
4.4 KiB
Diff
108 lines
4.4 KiB
Diff
From df8fadfd9450c8709864db44c2f676d40f323f95 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
|
|
Date: Fri, 13 Sep 2019 14:12:25 +0100
|
|
Subject: [PATCH 2/4] block/create: Do not abort if a block driver is not
|
|
available
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Message-id: <20190913141225.12022-2-philmd@redhat.com>
|
|
Patchwork-id: 90451
|
|
O-Subject: [RHEL-7.7 qemu-kvm-rhev + RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/1] block/create: Do not abort if a block driver is not available
|
|
Bugzilla: 1746267
|
|
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
|
|
RH-Acked-by: John Snow <jsnow@redhat.com>
|
|
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
|
The 'blockdev-create' QMP command was introduced as experimental
|
|
feature in commit b0292b851b8, using the assert() debug call.
|
|
It got promoted to 'stable' command in 3fb588a0f2c, but the
|
|
assert call was not removed.
|
|
|
|
Some block drivers are optional, and bdrv_find_format() might
|
|
return a NULL value, triggering the assertion.
|
|
|
|
Stable code is not expected to abort, so return an error instead.
|
|
|
|
This is easily reproducible when libnfs is not installed:
|
|
|
|
./configure
|
|
[...]
|
|
module support no
|
|
Block whitelist (rw)
|
|
Block whitelist (ro)
|
|
libiscsi support yes
|
|
libnfs support no
|
|
[...]
|
|
|
|
Start QEMU:
|
|
|
|
$ qemu-system-x86_64 -S -qmp unix:/tmp/qemu.qmp,server,nowait
|
|
|
|
Send the 'blockdev-create' with the 'nfs' driver:
|
|
|
|
$ ( cat << 'EOF'
|
|
{'execute': 'qmp_capabilities'}
|
|
{'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
|
|
EOF
|
|
) | socat STDIO UNIX:/tmp/qemu.qmp
|
|
{"QMP": {"version": {"qemu": {"micro": 50, "minor": 1, "major": 4}, "package": "v4.1.0-733-g89ea03a7dc"}, "capabilities": ["oob"]}}
|
|
{"return": {}}
|
|
|
|
QEMU crashes:
|
|
|
|
$ gdb qemu-system-x86_64 core
|
|
Program received signal SIGSEGV, Segmentation fault.
|
|
(gdb) bt
|
|
#0 0x00007ffff510957f in raise () at /lib64/libc.so.6
|
|
#1 0x00007ffff50f3895 in abort () at /lib64/libc.so.6
|
|
#2 0x00007ffff50f3769 in _nl_load_domain.cold.0 () at /lib64/libc.so.6
|
|
#3 0x00007ffff5101a26 in .annobin_assert.c_end () at /lib64/libc.so.6
|
|
#4 0x0000555555d7e1f1 in qmp_blockdev_create (job_id=0x555556baee40 "x", options=0x555557666610, errp=0x7fffffffc770) at block/create.c:69
|
|
#5 0x0000555555c96b52 in qmp_marshal_blockdev_create (args=0x7fffdc003830, ret=0x7fffffffc7f8, errp=0x7fffffffc7f0) at qapi/qapi-commands-block-core.c:1314
|
|
#6 0x0000555555deb0a0 in do_qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false, errp=0x7fffffffc898) at qapi/qmp-dispatch.c:131
|
|
#7 0x0000555555deb2a1 in qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false) at qapi/qmp-dispatch.c:174
|
|
|
|
With this patch applied, QEMU returns a QMP error:
|
|
|
|
{'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
|
|
{"id": "x", "error": {"class": "GenericError", "desc": "Block driver 'nfs' not found or not supported"}}
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Reported-by: Xu Tian <xutian@redhat.com>
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Reviewed-by: Eric Blake <eblake@redhat.com>
|
|
Reviewed-by: John Snow <jsnow@redhat.com>
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
(cherry picked from commit d90d5cae2b10efc0e8d0b3cc91ff16201853d3ba)
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
---
|
|
block/create.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/block/create.c b/block/create.c
|
|
index 9534121..de5e97b 100644
|
|
--- a/block/create.c
|
|
+++ b/block/create.c
|
|
@@ -63,9 +63,13 @@ void qmp_blockdev_create(const char *job_id, BlockdevCreateOptions *options,
|
|
const char *fmt = BlockdevDriver_str(options->driver);
|
|
BlockDriver *drv = bdrv_find_format(fmt);
|
|
|
|
+ if (!drv) {
|
|
+ error_setg(errp, "Block driver '%s' not found or not supported", fmt);
|
|
+ return;
|
|
+ }
|
|
+
|
|
/* If the driver is in the schema, we know that it exists. But it may not
|
|
* be whitelisted. */
|
|
- assert(drv);
|
|
if (bdrv_uses_whitelist() && !bdrv_is_whitelisted(drv, false)) {
|
|
error_setg(errp, "Driver is not whitelisted");
|
|
return;
|
|
--
|
|
1.8.3.1
|
|
|