Merge tag 'trivial-patches-20230610' of https://gitlab.com/mjt0k/qemu into staging

trivial-patches-20230610

# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmSEG50PH

Merge tag 'trivial-patches-20230610' of https://gitlab.com/mjt0k/qemu into staging

trivial-patches-20230610

# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmSEG50PHG1qdEB0bHMu
# bXNrLnJ1AAoJEHAbT2saaT5ZKSEIAJ/KCuwY0LNFhJKwxT8a8VCdgW5efW4Ji1NR
# qZ4gv0BgI0VE0SlYgaorWxaeiQ6+pJnLInCAa5591OHIftCGM9iWl/SN0EhBehJR
# tKL7o0FzARCZdQgdQYr8k169ojogauoGl2SyB+BewlK7m+PexXat/XVHPIme6150
# YZZF0wKfnI2NhesRMuVzK8WbBSXeNH4bGCsBJaGC9ewaCXKvNjf8urZQ1RX4GAeN
# 1vyN1YDCc7PyBGzBa+1bREToF+3JB0eAedEk+GMkvl8aB+r0I9K9A9k0r8rvRHm/
# j0KV5JMiMF/ZTc+3AyRGkFETWNuZekjE3bf34NukA34m8x9e3HQ=
# =ME9P
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 09 Jun 2023 11:43:41 PM PDT
# gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59
# gpg: issuer "mjt@tls.msk.ru"
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: aka "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg: aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5
# Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59

* tag 'trivial-patches-20230610' of https://gitlab.com/mjt0k/qemu:
linux-user: elfload: Specify -R is an option for qemu-user binaries
linux-user: elfload: s/min_mmap_addr/mmap_min_addr/
vnc: move assert in vnc_worker_thread_loop
linux-user: Return EINVAL for getgroups() with negative gidsetsize
linux-user: add comments for TARGET_NR_[gs]etgroups{,32}
hw/usb/hcd-ehci-pci: Simplify using DEVICE_GET_CLASS() macro
hw/pci/pci: Simplify pci_bar_address() using MACHINE_GET_CLASS() macro
hw/i386/microvm: Simplify using object_dynamic_cast()
hw/core/cpu: Simplify realize() using MACHINE_GET_CLASS() macro
target/m68k/fpu_helper: Use FloatRelation enum to hold comparison result
meson: install keyboard maps only if necessary
block.c: add newline for "Detected format" warning
hw/remote: Fix vfu_cfg trace offset format
spelling: information
hw/virtio/virtio-qmp.c: spelling: suppoted
docs: Fix trivial typos in vhost-user.rst

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

vnc: move assert in vnc_worker_thread_loop

job may be NULL if queue->exit is true. Check
it before dereference job.

Fixes: f31f9c1080 ("vnc: add magic cookie to VncState")
Signed-off-by: Anastasia

vnc: move assert in vnc_worker_thread_loop

job may be NULL if queue->exit is true. Check
it before dereference job.

Fixes: f31f9c1080 ("vnc: add magic cookie to VncState")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

show more ...

Merge tag 'trivial-branch-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging

Pull request

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFA

Merge tag 'trivial-branch-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging

Pull request

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmNXleQSHGxhdXJlbnRA
# dml2aWVyLmV1AAoJEPMMOL0/L748TIsP/1gulTFpYAs3Kao6IZonsuCzrjQrJWqv
# 5SD7cVb7isOWdOSNK3glE4dG54Q38PaS9GHaCvzIndjHxlWddCCUuwiw6p1Wdo70
# fjNfcCOEPoalQbkZvLejhs5n2rlfTvS5JUnLKVD9+ton7hjnTyKGDDYao5mYhtzv
# Kn9NpCD3m+K3orzG2Jj7jR1UAumg4cW4YQEpT8ItDT4Y5UAxjL6TZQ6CE220DQDq
# YwDrHEgDYr/UKlTbIC/JwlKOLr0sh+UB1VV8GZS6e6pU9u5WpDDHlQZpU8W2tLLg
# cG5m8tLG2avFxRMUFrPNZ8Lx2xKO8wL1PtgAO9w7qFK+r0soZvv+Zh4ev/t5zGLf
# ciliItqf97yPYNIc3su75jqdQHed7lmZc3m9LBHg8VXN6rAatt8vWUbG90sAZuTU
# tWBZHvQmG0s2MK4UYqeQ59tc21v9T2+VCiiv/1vjgEUr8tBhXS562jrDt/bNEqKa
# eRzT4h4ffbP6BJRnyakxkFkQ7nd2OdlLNKUAr9Tk6T2fYuarfEdbYx//0950agqD
# AAtdQ/AJm6Pq1Px0/RuMKK5WsL818BoAkfr6n7qXleunytJ1W5hjW9EmFIPZWPTR
# ce/lSFHA0+MCpg6C8zAa4iNBg/Pk0p3GRrTeWyHK1FjV+Gep1QtE/a1vk/qiPzTM
# qZVfPxa8cXXe
# =caiq
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 25 Oct 2022 03:53:08 EDT
# gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg: issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C

* tag 'trivial-branch-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu:
accel/tcg/tcg-accel-ops-rr: fix trivial typo
ui: remove useless typecasts
treewide: Remove the unnecessary space before semicolon
include/hw/scsi/scsi.h: Remove unused scsi_legacy_handle_cmdline() prototype
vmstate-static-checker:remove this redundant return
tests/qtest: vhost-user-test: Fix [-Werror=format-overflow=] build warning
tests/qtest: migration-test: Fix [-Werror=format-overflow=] build warning
Drop useless casts from g_malloc() & friends to pointer
elf2dmp: free memory in failure
hw/core: Tidy up unnecessary casting away of const
.gitignore: add multiple items to .gitignore

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

treewide: Remove the unnecessary space before semicolon

%s/return ;/return;

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Christian

treewide: Remove the unnecessary space before semicolon

%s/return ;/return;

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20221024072802.457832-1-bmeng@tinylab.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20210316-pull-request' into staging

vnc+spice: password-secret option.
bugfixes for cocoa, vnc, opengl.

# gpg: Signature made Tue 16 Mar 2021 05

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20210316-pull-request' into staging

vnc+spice: password-secret option.
bugfixes for cocoa, vnc, opengl.

# gpg: Signature made Tue 16 Mar 2021 05:37:58 GMT
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20210316-pull-request:
ui/cocoa: Comment about modifier key input quirks
ui: fold qemu_alloc_display in only caller
ui: honour the actual guest display dimensions without rounding
ui: use client width/height in WMVi message
ui: avoid sending framebuffer updates outside client desktop bounds
ui: add more trace points for VNC client/server messages
ui/cocoa: Do not exit immediately after shutdown
opengl: Do not convert format with glTexImage2D on OpenGL ES
ui: deprecate "password" option for SPICE server
ui: introduce "password-secret" option for SPICE server
ui: introduce "password-secret" option for VNC servers

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

ui: avoid sending framebuffer updates outside client desktop bounds

We plan framebuffer update rects based on the VNC server surface. If the
client doesn't support desktop resize, then the client bo

ui: avoid sending framebuffer updates outside client desktop bounds

We plan framebuffer update rects based on the VNC server surface. If the
client doesn't support desktop resize, then the client bounds may differ
from the server surface bounds. VNC clients may become upset if we then
send an update message outside the bounds of the client desktop.

This takes the approach of clamping the rectangles from the worker
thread immediately before sending them. This may sometimes results in
sending a framebuffer update message with zero rectangles.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210311182957.486939-3-berrange@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20201104-pull-request' into staging

misc bugfixes for 5.2

# gpg: Signature made Wed 04 Nov 2020 15:46:33 GMT
# gpg: using RSA

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20201104-pull-request' into staging

misc bugfixes for 5.2

# gpg: Signature made Wed 04 Nov 2020 15:46:33 GMT
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-20201104-pull-request:
roms/Makefile: Add qboot to .PHONY list
ati: check x y display parameter values
vnc: fix resource leak when websocket channel error

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vnc: fix resource leak when websocket channel error

When we connect to vnc by websocket channel, and disconnect
(maybe by some network exception) before handshake,
qemu will left CLOSE_WAIT socket a

vnc: fix resource leak when websocket channel error

When we connect to vnc by websocket channel, and disconnect
(maybe by some network exception) before handshake,
qemu will left CLOSE_WAIT socket and never close it

After 04d2529da2 ("ui: convert VNC server to use QIOChannelSocket")
and dd154c4d9f ("io: fix handling of EOF / error conditions in websock GSource"),
the vnc call qio_channel_add_watch only care about G_IO_IN,
but mising G_IO_HUP and G_IO_ERR.
When the websocket channel get EOF or error, it cannot callback,
because the caller ignore the event, that leads to resource leak

We need handle G_IO_HUP and G_IO_ERR event, then cleanup the channel

Fixes: 04d2529da2 ("ui: convert VNC server to use QIOChannelSocket")
Fixes: dd154c4d9f ("io: fix handling of EOF / error conditions in websock GSource")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Message-id: 20201029032241.11040-1-dinghui@sangfor.com.cn
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180827-v4-pull-request' into staging

ui: misc fixes which piled up during 3.0 release freeze

# gpg: Signature made Mon 27 Aug 2018 09:53:07 BS

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180827-v4-pull-request' into staging

ui: misc fixes which piled up during 3.0 release freeze

# gpg: Signature made Mon 27 Aug 2018 09:53:07 BST
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20180827-v4-pull-request:
util: promote qemu_egl_rendernode_open() to libqemuutil
dmabuf: add y0_top, pass it to spice
ui/vnc: Remove useless parenthesis around DIV_ROUND_UP macro
ui/sdl2: Fix broken -full-screen CLI option
spice-display: fix qemu_spice_cursor_refresh_bh locking
spice-display: access ptr_x/ptr_y under Mutex
vnc: remove support for deprecated tls, x509, x509verify options
doc: switch to modern syntax for VNC TLS setup
sdl2: redraw correctly when scanout_mode enabled.
ui: use enum to string helpers
vnc: fix memleak of the "vnc-worker-output" name
ui/sdl2: Remove the obsolete SDL_INIT_NOPARACHUTE flag

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vnc: fix memleak of the "vnc-worker-output" name

Fixes repeated memory leaks of 18 bytes when using VNC:

Direct leak of 831024 byte(s) in 46168 object(s) allocated from:
...
#4

vnc: fix memleak of the "vnc-worker-output" name

Fixes repeated memory leaks of 18 bytes when using VNC:

Direct leak of 831024 byte(s) in 46168 object(s) allocated from:
...
#4 0x7f6d2f919bdd in g_strdup_vprintf glib/gstrfuncs.c:514
#5 0x56085cdcf660 in buffer_init util/buffer.c:59
#6 0x56085ca6a7ec in vnc_async_encoding_start ui/vnc-jobs.c:177
#7 0x56085ca6b815 in vnc_worker_thread_loop ui/vnc-jobs.c:240

Fixes: 543b95801f98 ("vnc: attach names to buffers")
Cc: Gerd Hoffmann <kraxel@redhat.com>
CC: qemu-stable@nongnu.org
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20180807221830.3844-1-peter@lekensteyn.nl
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180515-pull-request' into staging

ui: qapi parser for -display cmd line.
gtk: multiple fixes.
sdl: opts bugfix.
vnc: magic cookie.

# gpg: Sign

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180515-pull-request' into staging

ui: qapi parser for -display cmd line.
gtk: multiple fixes.
sdl: opts bugfix.
vnc: magic cookie.

# gpg: Signature made Tue 15 May 2018 10:18:51 BST
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20180515-pull-request:
gtk: disable the F10 menubar key
console: use linked list for QemuConsoles
ui: document non-qapi parser cases.
ui: switch gtk display to qapi parser
ui: switch trivial displays to qapi parser
ui: add qapi parser for -display
vnc: add magic cookie to VncState
ui/gtk: Only try to initialize EGL/X11 if GtkGlArea failed
gtk: make it possible to hide the menu bar
sdl2: move opts assignment into loop

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vnc: add magic cookie to VncState

Set magic cookie on initialization. Clear on cleanup. Sprinkle a bunch
of assert()s checking the cookie, to verify the pointer is valid.

Signed-off-by: Gerd Hoff

vnc: add magic cookie to VncState

Set magic cookie on initialization. Clear on cleanup. Sprinkle a bunch
of assert()s checking the cookie, to verify the pointer is valid.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180507102254.12107-1-kraxel@redhat.com

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180216-pull-request' into staging

bugfixes for vnc and sdl2

# gpg: Signature made Fri 16 Feb 2018 11:53:37 GMT
# gpg: using RSA

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180216-pull-request' into staging

bugfixes for vnc and sdl2

# gpg: Signature made Fri 16 Feb 2018 11:53:37 GMT
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20180216-pull-request:
ui: extend VNC trottling tracing to SASL codepaths
ui: check VNC audio frequency limit at time of reading from client
ui: avoid 'local_err' variable shadowing in VNC SASL auth
ui: avoid risk of 32-bit int overflow in VNC buffer check
sdl2: fix mouse grab
sdl: restore optimized redraw
vnc: fix segfault in closed connection handling
vnc: add qapi/error.h include to stubs
vnc: remove bogus object_unref on client socket

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vnc: fix segfault in closed connection handling

On one of our client's node, due to trying to read from closed ioc,
a segmentation fault occured. Corresponding backtrace:

0 object_get_class (obj=o

vnc: fix segfault in closed connection handling

On one of our client's node, due to trying to read from closed ioc,
a segmentation fault occured. Corresponding backtrace:

0 object_get_class (obj=obj@entry=0x0)
1 qio_channel_readv_full (ioc=0x0, iov=0x7ffe55277180 ...
2 qio_channel_read (ioc=<optimized out> ...
3 vnc_client_read_buf (vs=vs@entry=0x55625f3c6000, ...
4 vnc_client_read_plain (vs=0x55625f3c6000)
5 vnc_client_read (vs=0x55625f3c6000)
6 vnc_client_io (ioc=<optimized out>, condition=G_IO_IN, ...
7 g_main_dispatch (context=0x556251568a50)
8 g_main_context_dispatch (context=context@entry=0x556251568a50)
9 glib_pollfds_poll ()
10 os_host_main_loop_wait (timeout=<optimized out>)
11 main_loop_wait (nonblocking=nonblocking@entry=0)
12 main_loop () at vl.c:1909
13 main (argc=<optimized out>, argv=<optimized out>, ...

Having analyzed the coredump, I understood that the reason is that
ioc_tag is reset on vnc_disconnect_start and ioc is cleaned
in vnc_disconnect_finish. Between these two events due to some
reasons the ioc_tag was set again and after vnc_disconnect_finish
the handler is running with freed ioc,
which led to the segmentation fault.

The patch checks vs->disconnecting in places where we call
qio_channel_add_watch and resets handler if disconnecting == TRUE
to prevent such an occurrence.

Signed-off-by: Klim Kireev <klim.kireev@virtuozzo.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20180207094844.21402-1-klim.kireev@virtuozzo.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/vnc-20180112-pull-request' into staging

vnc: limit memory usage (CVE-2017-15124)

# gpg: Signature made Fri 12 Jan 2018 12:57:22 GMT
# gpg:

Merge remote-tracking branch 'remotes/kraxel/tags/vnc-20180112-pull-request' into staging

vnc: limit memory usage (CVE-2017-15124)

# gpg: Signature made Fri 12 Jan 2018 12:57:22 GMT
# gpg: using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vnc-20180112-pull-request:
ui: mix misleading comments & return types of VNC I/O helper methods
ui: add trace events related to VNC client throttling
ui: place a hard cap on VNC server output buffer size
ui: fix VNC client throttling when forced update is requested
ui: fix VNC client throttling when audio capture is active
ui: refactor code for determining if an update should be sent to the client
ui: correctly reset framebuffer update state after processing dirty regions
ui: introduce enum to track VNC client framebuffer update request state
ui: track how much decoded data we consumed when doing SASL encoding
ui: avoid pointless VNC updates if framebuffer isn't dirty
ui: remove redundant indentation in vnc_client_update
ui: remove unreachable code in vnc_update_client
ui: remove 'sync' parameter from vnc_update_client
vnc: fix debug spelling

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

ui: fix VNC client throttling when forced update is requested

The VNC server must throttle data sent to the client to prevent the 'output'
buffer size growing without bound, if the client stops read

ui: fix VNC client throttling when forced update is requested

The VNC server must throttle data sent to the client to prevent the 'output'
buffer size growing without bound, if the client stops reading data off the
socket (either maliciously or due to stalled/slow network connection).

The current throttling is very crude because it simply checks whether the
output buffer offset is zero. This check is disabled if the client has requested
a forced update, because we want to send these as soon as possible.

As a result, the VNC client can cause QEMU to allocate arbitrary amounts of RAM.
They can first start something in the guest that triggers lots of framebuffer
updates eg play a youtube video. Then repeatedly send full framebuffer update
requests, but never read data back from the server. This can easily make QEMU's
VNC server send buffer consume 100MB of RAM per second, until the OOM killer
starts reaping processes (hopefully the rogue QEMU process, but it might pick
others...).

To address this we make the throttling more intelligent, so we can throttle
full updates. When we get a forced update request, we keep track of exactly how
much data we put on the output buffer. We will not process a subsequent forced
update request until this data has been fully sent on the wire. We always allow
one forced update request to be in flight, regardless of what data is queued
for incremental updates or audio data. The slight complication is that we do
not initially know how much data an update will send, as this is done in the
background by the VNC job thread. So we must track the fact that the job thread
has an update pending, and not process any further updates until this job is
has been completed & put data on the output buffer.

This unbounded memory growth affects all VNC server configurations supported by
QEMU, with no workaround possible. The mitigating factor is that it can only be
triggered by a client that has authenticated with the VNC server, and who is
able to trigger a large quantity of framebuffer updates or audio samples from
the guest OS. Mostly they'll just succeed in getting the OOM killer to kill
their own QEMU process, but its possible other processes can get taken out as
collateral damage.

This is a more general variant of the similar unbounded memory usage flaw in
the websockets server, that was previously assigned CVE-2017-15268, and fixed
in 2.11 by:

commit a7b20a8efa28e5f22c26c06cd06c2f12bc863493
Author: Daniel P. Berrange <berrange@redhat.com>
Date: Mon Oct 9 14:43:42 2017 +0100

io: monitor encoutput buffer size from websocket GSource

This new general memory usage flaw has been assigned CVE-2017-15124, and is
partially fixed by this patch.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20171218191228.31018-11-berrange@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/pull-ui-20170209-2' into staging

vnc: add support for multiple listening sockets.
vnc: misc fixes and cleanups.

# gpg: Signature made Thu 09 Feb 20

Merge remote-tracking branch 'remotes/kraxel/tags/pull-ui-20170209-2' into staging

vnc: add support for multiple listening sockets.
vnc: misc fixes and cleanups.

# gpg: Signature made Thu 09 Feb 2017 16:45:02 GMT
# gpg: using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/pull-ui-20170209-2:
ui: add ability to specify multiple VNC listen addresses
util: add iterators for QemuOpts values
ui: let VNC server listen on all resolved IP addresses
ui: extract code to connect/listen from vnc_display_open
ui: refactor code for populating SocketAddress from vnc_display_open
ui: refactor VncDisplay to allow multiple listening sockets
ui: fix reporting of VNC auth in query-vnc-servers
ui: fix regression handling bare 'websocket' option to -vnc
vnc: do not disconnect on EAGAIN
ui/vnc: Drop unused vnc_has_job() and vnc_jobs_clear()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

ui/vnc: Drop unused vnc_has_job() and vnc_jobs_clear()

The functions vnc_has_job() and vnc_jobs_clear() are
never used; remove them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed

ui/vnc: Drop unused vnc_has_job() and vnc_jobs_clear()

The functions vnc_has_job() and vnc_jobs_clear() are
never used; remove them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Message-id: 1486146260-8092-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

ui: Clean up includes

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Signed-off-by

ui: Clean up includes

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1454089805-5470-2-git-send-email-peter.maydell@linaro.org

show more ...

Merge remote-tracking branch 'remotes/berrange/tags/pull-io-channel-vnc-2015-12-18-1' into staging

Merge VNC conversion to I/O channels

# gpg: Signature made Fri 18 Dec 2015 15:44:30 GMT using RSA

Merge remote-tracking branch 'remotes/berrange/tags/pull-io-channel-vnc-2015-12-18-1' into staging

Merge VNC conversion to I/O channels

# gpg: Signature made Fri 18 Dec 2015 15:44:30 GMT using RSA key ID 15104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>"
# gpg: aka "Daniel P. Berrange <berrange@redhat.com>"

* remotes/berrange/tags/pull-io-channel-vnc-2015-12-18-1:
ui: convert VNC server to use QIOChannelWebsock
ui: convert VNC server to use QIOChannelTLS
ui: convert VNC server to use QIOChannelSocket

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

ui: convert VNC server to use QIOChannelSocket

The minimal first step conversion to use QIOChannelSocket
classes instead of directly using POSIX sockets API. This
will later be extended to also cove

ui: convert VNC server to use QIOChannelSocket

The minimal first step conversion to use QIOChannelSocket
classes instead of directly using POSIX sockets API. This
will later be extended to also cover the TLS, SASL and
websockets code.

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20151116-1' into staging

vnc: buffer code improvements, bugfixes.

# gpg: Signature made Mon 16 Nov 2015 17:20:02 GMT using RSA key ID D3E8

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20151116-1' into staging

vnc: buffer code improvements, bugfixes.

# gpg: Signature made Mon 16 Nov 2015 17:20:02 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vnc-20151116-1:
vnc: fix mismerge
buffer: allow a buffer to shrink gracefully
buffer: factor out buffer_adj_size
buffer: factor out buffer_req_size
vnc: recycle empty vs->output buffer
vnc: fix local state init
vnc: only alloc server surface with clients connected
vnc: use vnc_{width,height} in vnc_set_area_dirty
vnc: factor out vnc_update_server_surface
vnc: add vnc_width+vnc_height helpers
vnc: zap dead code
vnc-jobs: move buffer reset, use new buffer move
vnc: kill jobs queue buffer
vnc: attach names to buffers
buffer: add tracing
buffer: add buffer_shrink
buffer: add buffer_move
buffer: add buffer_move_empty
buffer: add buffer_init
buffer: make the Buffer capacity increase in powers of two

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-11-06' into staging

trivial patches for 2015-11-06

# gpg: Signature made Fri 06 Nov 2015 12:42:43 GMT using RSA key ID A4C3D

Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-11-06' into staging

trivial patches for 2015-11-06

# gpg: Signature made Fri 06 Nov 2015 12:42:43 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg: aka "Michael Tokarev <mjt@corpit.ru>"
# gpg: aka "Michael Tokarev <mjt@debian.org>"

* remotes/mjt/tags/pull-trivial-patches-2015-11-06: (24 commits)
tap-bsd: use user-specified tap device if it already exists
qemu-sockets: do not test path with access() before unlinking
taget-ppc: Fix read access to IBAT registers higher than IBAT3
exec: avoid unnecessary cacheline bounce on ram_list.mru_block
target-alpha: fix uninitialized variable
ivshmem-server: fix possible OVERRUN
pci-assign: do not test path with access() before opening
qom/object: fix 2 comment typos
configure: remove help string for 'vnc-tls' option
usb: Use g_new() & friends where that makes obvious sense
qxl: Use g_new() & friends where that makes obvious sense
ui: Use g_new() & friends where that makes obvious sense
bt: fix use of uninitialized variable seqlen
hw/dma/pxa2xx: Remove superfluous memset
linux-user/syscall: Replace g_malloc0 + memcpy with g_memdup
tests/i44fx-test: No need for zeroing memory before memset
hw/input/tsc210x: Remove superfluous memset
xen: fix invalid assertion
tests: ignore test-qga
fix bad indentation in pcie_cap_slot_write_config()
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

ui: Use g_new() & friends where that makes obvious sense

g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Tw

ui: Use g_new() & friends where that makes obvious sense

g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.

This commit only touches allocations with size arguments of the form
sizeof(T). Same Coccinelle semantic patch as in commit b45c03f.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

show more ...

vnc: recycle empty vs->output buffer

If the vs->output buffer is empty it will be dropped
by the next qio_buffer_move_empty in vnc_jobs_consume_buffer
anyway. So reuse the allocated buffer from this

vnc: recycle empty vs->output buffer

If the vs->output buffer is empty it will be dropped
by the next qio_buffer_move_empty in vnc_jobs_consume_buffer
anyway. So reuse the allocated buffer from this buffer
in the worker thread where we otherwise would start with
an empty (unallocated buffer).

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 1446203414-4013-17-git-send-email-kraxel@redhat.com

[ added a comment describing the non-obvious optimization ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...