Summary
[7.2.0-13.el9]
- vfio/migration: Enhance VFIO migration state tracing (Avihai Horon)
- vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon)
- vfio/migration: Emit VFIO migration QAPI event (Avihai Horon)
- qapi/vfio: Add VFIO migration QAPI event (Avihai Horon)
- migration/multifd: solve zero page causing multiple page faults (Yuan Liu) [Orabug: 36727051]
- multifd: Add the ramblock to MultiFDRecvParams (Lukas Straub) [Orabug: 36727051]
- migration: Fix qmp_query_migrate mbps value (Fabiano Rosas) [Orabug: 36727104]
- migration: Allow user to specify available switchover bandwidth (Peter Xu) [Orabug: 35636284]
- migration/dirtyrate: Fix precision losses and g_usleep overshoot (Andrei Gudkov) [Orabug: 36727091]
- Use new created qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- softmmu: Create qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- migration/calc-dirty-rate: replaced CRC32 with xxHash (Andrei Gudkov) [Orabug: 36727063]
- migration/multifd: Enable multifd zero page checking by default. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement zero page transmission on the multifd thread. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Add new migration option zero-page-detection. (Hao Xiang) [Orabug: 34131170]
- migration: Make ram_save_target_page() a pointer (Juan Quintela) [Orabug: 34131170]
- migration: Yield bitmap_mutex properly when sending/sleeping (Peter Xu) [Orabug: 34131170]
- migration/multifd: Add a synchronization point for channel creation (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Unify multifd and TLS connection paths (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup into migration thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup error handling in to the function (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Remove p->running (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Optimize sender side to be lockless (Peter Xu) [Orabug: 34131170]
- migration/multifd: Join the TLS thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Fix MultiFDSendParams.packet_num race (Peter Xu) [Orabug: 34131170]
- migration/multifd: Stick with send/recv on function names (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_load_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_save_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rewrite multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_send_pages() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Split multifd_send_terminate_threads() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Forbid spurious wakeups (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move header prepare/fill into send_prepare() (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_prepare_header() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move trace_multifd_send|recv() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move total_normal_pages accounting (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rename p->num_packets and clean it up (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop pages->num check in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Simplify locking in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Separate SYNC request with normal jobs (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.normal[] array (Peter Xu) [Orabug: 34131170]
- migration/multifd: Postpone reset of MultiFDPages_t (Peter Xu) [Orabug: 34131170]
- migration/multifd: Remove MultiFDPages_t::packet_num (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_kick_main() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Fix leaking of Error in TLS error flow (Avihai Horon) [Orabug: 34131170]
- migration/ram: Merge save_zero_page functions (Fabiano Rosas) [Orabug: 34131170]
- migration/ram: Move xbzrle zero page handling into save_zero_page (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Stop setting p->ioc before connecting (Fabiano Rosas) [Orabug: 34131170]
- migration: Centralize BH creation and dispatch (Fabiano Rosas) [Orabug: 34131170]
- migration: Add a wrapper to qemu_bh_schedule (Fabiano Rosas) [Orabug: 34131170]
- migration: Remove transferred atomic counter (Juan Quintela) [Orabug: 35636284]
- migration: Use migration_transferred_bytes() (Juan Quintela) [Orabug: 35636284]
- migration: migration_rate_limit_reset() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- migration: migration_transferred_bytes() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- multifd: reset next_packet_len after sending pages (Elena Ufimtseva) [Orabug: 35636284]
- multifd: fix counters in multifd_send_thread (Elena Ufimtseva) [Orabug: 35636284]
- migration/multifd: Compute transferred bytes correctly (Juan Quintela) [Orabug: 35636284]
- migration: check for rate_limit_max for RATE_LIMIT_DISABLED (Elena Ufimtseva) [Orabug: 35636284]
- migration: Use the number of transferred bytes directly (Juan Quintela) [Orabug: 35636284]
- qemu_file: Use a stat64 for qemu_file_transferred (Juan Quintela) [Orabug: 35636284]
- migration: set file error on subsection loading (Marc-Andre Lureau) [Orabug: 35636284]
- migration: Receiving a zero page non zero is an error (Juan Quintela) [Orabug: 35636284]
- migration/multifd: Stop checking p->quit in multifd_send_thread (Fabiano Rosas) [Orabug: 35636284]
- migration/multifd: Clarify Error usage in multifd_channel_connect (
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | qemu-guest-agent | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-img | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-block-curl | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-block-iscsi | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-block-rbd | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-block-ssh | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-common | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-kvm-core | 30:7.2.0-13.el9 |
| Oracle Linux · 9 | qemu-virtiofsd | 30:7.2.0-13.el9 |
Vulnerabilities 1
-
Medium 6.0
Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash t…