From 01013d2c10a07bb49da61923dae09968218a520d Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Fri, 28 Apr 2023 17:13:51 +0200 Subject: [PATCH 1/3] tests/qtest: Disable the spice test of readconfig-test on FreeBSD MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The spice test is currently hanging on FreeBSD. It likely was never working before, since in the past, our configure script was failing to detect this feature due to a bug in the spice package there (it just got enabled recently by the commit https://cgit.freebsd.org/ports/commit/?id=cf16b1c9063351325f0 ). To get the CI working again, let's disable the failing test for now until someone has enough spare time to debug and fix the real underlying problem. Message-Id: <20230428151351.1365822-1-thuth@redhat.com> Reviewed-by: Daniel P. Berrangé Reviewed-by: Marc-André Lureau Signed-off-by: Thomas Huth --- tests/qtest/readconfig-test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/qtest/readconfig-test.c b/tests/qtest/readconfig-test.c index 2160603880..918d45684b 100644 --- a/tests/qtest/readconfig-test.c +++ b/tests/qtest/readconfig-test.c @@ -86,8 +86,8 @@ static void test_x86_memdev(void) qtest_quit(qts); } - -#ifdef CONFIG_SPICE +/* FIXME: The test is currently broken on FreeBSD */ +#if defined(CONFIG_SPICE) && !defined(__FreeBSD__) static void test_spice_resp(QObject *res) { Visitor *v; @@ -209,7 +209,7 @@ int main(int argc, char *argv[]) qtest_add_func("readconfig/x86/memdev", test_x86_memdev); qtest_add_func("readconfig/x86/ich9-ehci-uhci", test_docs_config_ich9); } -#ifdef CONFIG_SPICE +#if defined(CONFIG_SPICE) && !defined(__FreeBSD__) qtest_add_func("readconfig/spice", test_spice); #endif From b08dc0f1b7b7b3be27ed3ffd72deeb02a1f669e7 Mon Sep 17 00:00:00 2001 From: Fabiano Rosas Date: Wed, 26 Apr 2023 15:00:12 -0300 Subject: [PATCH 2/3] tests/qtest: Restrict tpm-tis-i2c-test to CONFIG_TCG The test set -accel tcg, so restrict it to when TCG is present. Signed-off-by: Fabiano Rosas Message-Id: <20230426180013.14814-13-farosas@suse.de> Reviewed-by: Thomas Huth Reviewed-by: Richard Henderson Signed-off-by: Thomas Huth --- tests/qtest/meson.build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index cfc66ade6f..48cd35b5b2 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -213,7 +213,8 @@ qtests_aarch64 = \ ['tpm-tis-device-test', 'tpm-tis-device-swtpm-test'] : []) + \ (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 'fuzz-xlnx-dp-test'] : []) + \ (config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) + \ - (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \ + (config_all.has_key('CONFIG_TCG') and \ + config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \ ['arm-cpu-features', 'numa-test', 'boot-serial-test', From 7915bd06f25e1803778081161bf6fa10c42dc7cd Mon Sep 17 00:00:00 2001 From: Alexander Bulekov Date: Mon, 1 May 2023 10:19:56 -0400 Subject: [PATCH 3/3] async: avoid use-after-free on re-entrancy guard A BH callback can free the BH, causing a use-after-free in aio_bh_call. Fix that by keeping a local copy of the re-entrancy guard pointer. Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513 Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API") Signed-off-by: Alexander Bulekov Message-Id: <20230501141956.3444868-1-alxndr@bu.edu> Reviewed-by: Thomas Huth Signed-off-by: Thomas Huth --- util/async.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/util/async.c b/util/async.c index 9df7674b4e..055070ffbd 100644 --- a/util/async.c +++ b/util/async.c @@ -156,18 +156,20 @@ void aio_bh_call(QEMUBH *bh) { bool last_engaged_in_io = false; - if (bh->reentrancy_guard) { - last_engaged_in_io = bh->reentrancy_guard->engaged_in_io; - if (bh->reentrancy_guard->engaged_in_io) { + /* Make a copy of the guard-pointer as cb may free the bh */ + MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard; + if (reentrancy_guard) { + last_engaged_in_io = reentrancy_guard->engaged_in_io; + if (reentrancy_guard->engaged_in_io) { trace_reentrant_aio(bh->ctx, bh->name); } - bh->reentrancy_guard->engaged_in_io = true; + reentrancy_guard->engaged_in_io = true; } bh->cb(bh->opaque); - if (bh->reentrancy_guard) { - bh->reentrancy_guard->engaged_in_io = last_engaged_in_io; + if (reentrancy_guard) { + reentrancy_guard->engaged_in_io = last_engaged_in_io; } }