Re: [Qemu-devel] [Qemu-stable] Patch Round-up for stable 1.3.1, freeze Monday

[Michael Tokarev]

16.01.2013 20:49, Michael Roth wrote:
> Hi everyone,
>
> The following new patches are queued for QEMU stable v1.3.1:
>
> https://github.com/mdroth/qemu/commits/stable-1.3-staging
>
> The release is planned for 01-25-2013:
>
> http://wiki.qemu.org/Planning/1.3
>
> Please CC address@hidden on any patches you think should be
> included in the release. The cut-off date is 01-21-2013 for new patches.
>
> Testing/feedback is greatly appreciated.
>
> Thanks!

Actual commit IDs from the master branch, with some comments
(with just one useful for 1.3 comment, about e1000 security fix):

> 204dd38 raw-posix: fix bdrv_aio_ioctl (Paolo Bonzini)
b608c8dc02c78ee95455a0989bdf1b41c768b2ef

> 86bab45 vfio-pci: Loosen sanity checks to allow future features (Alex 
> Williamson)
8fc94e5a8046e349e07976f9bcaffbcd5833f3a2

> 006c747 pci-assign: Enable MSIX on device to match guest (Alex Williamson)
feb9a2ab4b0260d8d680a7ffd25063dafc7ec628

This is applicable to old qemu-kvm (pre-1.3-merge), so it is qemu-kvm 1.1
and qemu-kvm 1.2.  I missed it for 1.1 because it is qemu-kvm-specific.
Queued for debian qemu-kvm package.

> f042cca vfio-pci: Make host MSI-X enable track guest (Alex Williamson)
b0223e29afdc88cc262a764026296414396cd129

> 1205b80 target-xtensa: fix search_pc for the last TB opcode (Max Filippov)
36f25d2537c40c6c47f4abee5d31a24863d1adf7

Now queued to stable-1.1 too.

> ff0c079 buffered_file: do not send more than s->bytes_xfer bytes per tick 
> (Paolo Bonzini)
bde54c08b4854aceee3dee25121a2b835cb81166

Now queued to stable-1.1 too, with backport changes.

> d745511 migration: fix migration_bitmap leak (Paolo Bonzini)
244eaa7514a944b36273eb8428f32da8e9124fcf

> 5afd0ec e1000: Discard oversized packets based on SBP|LPE (Michael Contreras)
2c0331f4f7d241995452b99afaf0aab00493334a

Guys, this is just one half of the CVE-2012-6075 fix.
Please don't repeat the same mistake again and again.
Second patch by Michael is neede to fix this too.

Note that recent Xen advisory (Xen Security Advisory 41)
has the same issu, they fixed just the half of it.

Both are applied to stable-1.1.

> c4cd5b0 qxl+vnc: register a vm state change handler for dummy spice_server (Uri 
> Lublin)
938b8a36b65e44c44ca29245437f8d7ac0f826e8
post-1.2 material, needs 938b8a36b65e44c44ca29245437f8d7ac0f826e8 and probably
a bunch of other stuff.

> 7ca2496 qxl: save qemu_create_displaysurface_from result (Gerd Hoffmann)
2f464b5a32b414adb545acc6d94b5c35c7d258ba

Now queued to stable-1.1

> bfae937 target-xtensa: fix ITLB/DTLB page protection flags (Max Filippov)
659f807c0a700317a7a0fae7a6e6ebfe68bfbbc4

Now queued to stable-1.1

> b68c48f pixman: fix vnc tight png/jpeg support (Gerd Hoffmann)
bc210eb163b162ff2e94e5c8f4307715731257f8
1.3+ material

> 36fd817 Update seabios to a810e4e72a0d42c7bc04eda57382f8e019add901 (Gerd 
> Hoffmann)
15faf946f7a17a5fab0d05a2312d43249d81af3c

> 0bc5f4a seabios: update to e8a76b0f225bba5ba9d63ab227e0a37b3beb1059 (Gerd 
> Hoffmann)
ff1562908d1da12362aa9e3f3bfc7ba0da8114a4

> 37e1428 vfio-pci: Don't use kvm_irqchip_in_kernel (Alex Williamson)
d281084d3e51f03999d12a506491a0c6f31b40e8

> 518799a target-mips: Fix incorrect shift for SHILO and SHILOV (Petar Jovanovic)
19e6c50d2d843220efbdd3b2db21d83c122c364a
1.3+ material

> 16c5fe4 target-mips: Fix incorrect code and test for INSV (Petar Jovanovic)
34f5606ee101f82a247d09d05644ad2a63c8e342
1.3+ material

> f1a2195 migration: Fix madvise breakage if host and guest have different page 
> sizes (David Gibson)
45e6cee42b98d10e2e14885ab656541a9ffd5187

Now queued up for stable-1.1

> 3b4fc1f Fix off-by-1 error in RAM migration code (David Gibson)
7ec81e56edc2b2007ce0ae3982aa5c18af9546ab
1.3+ (past c6bf8e0e0cf04b40a8a22426e00ebbd727331d8b)

> d67d95f Disable semaphores fallback code for OpenBSD (Brad Smith)
927fa909d5d5cf8c07673cd16a6d3bdc81250bc0
1.3+ (past c166cb72f1676855816340666c3b618beef4b976)

> 0a7ad69 Fix semaphores fallback code (Brad Smith)
a795ef8dcb8cbadffc996c41ff38927a97645234
1.3+ (past c166cb72f1676855816340666c3b618beef4b976)

Thanks,

/mjt