blktap-3.55.5-9.4

.github/CODEOWNERS

@@ -1,2 +1 @@
-* @xcp-ng-rpms/storage
-* @xcp-ng-rpms/os-platform-release
+* @xcp-ng-rpms/storage @xcp-ng-rpms/os-platform-release

SOURCES/0002-Add-an-option-to-use-backup-footer-when-vhd-util-que.patch → SOURCES/0001-Add-an-option-to-use-backup-footer-when-vhd-util-que.patch

@@ -1,19 +1,19 @@
-From 7c168ec7818aa74bf81ae27ddd808c227b1d2261 Mon Sep 17 00:00:00 2001
+From d8cda8eb7a7404102b10a05e1226129e5c424d0e Mon Sep 17 00:00:00 2001
 From: Ronan Abhamon <ronan.abhamon@vates.tech>
 Date: Wed, 18 Dec 2024 16:55:26 +0100
-Subject: [PATCH 2/2] Add an option to use backup footer when vhd-util query is
+Subject: [PATCH] Add an option to use backup footer when vhd-util query is
  called
 
 This option already exists on td-util but it was not implemented
 on vhd-util.
 
 Signed-off-by: Ronan Abhamon <ronan.abhamon@vates.tech>
 ---
- vhd/lib/vhd-util-query.c | 36 ++++++++++++++++++++----------------
- 1 file changed, 20 insertions(+), 16 deletions(-)
+ vhd/lib/vhd-util-query.c | 38 +++++++++++++++++++++-----------------
+ 1 file changed, 21 insertions(+), 17 deletions(-)
 
 diff --git a/vhd/lib/vhd-util-query.c b/vhd/lib/vhd-util-query.c
-index 0cd0416..13bd563 100644
+index 0cd04166..3aca668c 100644
 --- a/vhd/lib/vhd-util-query.c
 +++ b/vhd/lib/vhd-util-query.c
 @@ -43,29 +43,29 @@
@@ -80,6 +80,15 @@ index 0cd0416..13bd563 100644
  	if (err) {
  		printf("error opening %s: %d\n", name, err);
  		return err;
+@@ -207,7 +210,7 @@ vhd_util_query(int argc, char **argv)
+ 		max_size = vhd.header.max_bat_size << (VHD_BLOCK_SHIFT - 20);
+ 		printf("%"PRIu64"\n", max_size);
+ 	}
+-		
++
+ 	vhd_close(&vhd);
+ 	return err;
+
 @@ -218,6 +221,7 @@ usage:
  	       "[-S print max virtual size (MB) for fast resize] "
  	       "[-a print allocated block count] "

SOURCES/0002-tapdisk-deduplicate-double-assignment-code.patch

@@ -0,0 +1,24 @@
+From da68419a7008aa37563ffe5b3c7fce5b455edb62 Mon Sep 17 00:00:00 2001
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Date: Thu, 16 Jan 2025 14:09:07 +0100
+Subject: [PATCH] tapdisk: deduplicate double assignment code
+
+No functional change expected.
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+---
+ drivers/tapdisk-server.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/tapdisk-server.c b/drivers/tapdisk-server.c
+index 27a42198..a165d2f2 100644
+--- a/drivers/tapdisk-server.c
++++ b/drivers/tapdisk-server.c
+@@ -788,7 +788,6 @@ tapdisk_server_complete(void)
+ 	server.rw_backend = get_libaio_backend();
+ 	server.ro_backend = get_libaio_backend();
+
+-	server.rw_backend = get_libaio_backend();
+ 	err = tapdisk_server_init_aio();
+ 	if (err)
+ 		goto fail;

SOURCES/0003-blktap-fix-a-typo-in-libaio-backend.h-header.patch

@@ -0,0 +1,31 @@
+From 45658a3d9f323a6f1bc512297bebf487287d5f67 Mon Sep 17 00:00:00 2001
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Date: Thu, 16 Jan 2025 14:09:11 +0100
+Subject: [PATCH] blktap: fix a typo in libaio-backend.h header
+
+No functional change expected.
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+---
+ drivers/libaio-backend.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/libaio-backend.h b/drivers/libaio-backend.h
+index 2759307d..21707c4a 100644
+--- a/drivers/libaio-backend.h
++++ b/drivers/libaio-backend.h
+@@ -29,7 +29,7 @@
+  */
+
+ #ifndef LIBAIO_BACKEND_H
+-#define LIBAIO_BACLEND_H
++#define LIBAIO_BACKEND_H
+
+ #include <libaio.h>
+
+@@ -43,4 +43,4 @@ enum {
+
+ struct backend* get_libaio_backend();
+
+-#endif /* LIBAIO_BACLEND_H */
++#endif /* LIBAIO_BACKEND_H */

SOURCES/0004-tapdisk-document-final-param-in-__tapdisk_xenblkif_r.patch

@@ -0,0 +1,26 @@
+From 2de5a44347e224ec3be404860d5d98e6fba1b1ff Mon Sep 17 00:00:00 2001
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Date: Mon, 20 Jan 2025 14:45:35 +0100
+Subject: [PATCH] tapdisk: document final param in
+ __tapdisk_xenblkif_request_cb comment
+
+No functional change expected.
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+---
+ drivers/td-req.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/td-req.c b/drivers/td-req.c
+index e1ce9fd7..178985f3 100644
+--- a/drivers/td-req.c
++++ b/drivers/td-req.c
+@@ -591,7 +591,7 @@ out:
+  * @param vreq the completed request
+  * @param error status of the request
+  * @param token token previously associated with this request
+- * @param final TODO ?
++ * @param final controls whether the other end should be notified
+  */
+ static inline void
+ __tapdisk_xenblkif_request_cb(struct td_vbd_request * const vreq,

SOURCES/0005-tapdisk-use-tapdisk_vbd_for_each_blkif-abstraction.patch

@@ -0,0 +1,25 @@
+From 27d453c5eb2f025b10e7c32ae9239e9d18ce66ab Mon Sep 17 00:00:00 2001
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Date: Wed, 15 Jan 2025 16:33:02 +0100
+Subject: [PATCH] tapdisk: use tapdisk_vbd_for_each_blkif abstraction
+
+No functional change expected.
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+---
+ drivers/tapdisk-control.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tapdisk-control.c b/drivers/tapdisk-control.c
+index c8b9d826..506b203d 100644
+--- a/drivers/tapdisk-control.c
++++ b/drivers/tapdisk-control.c
+@@ -898,7 +898,7 @@ tapdisk_control_close_image(struct tapdisk_ctl_conn *conn,
+ 		tapdisk_nbdserver_pause(vbd->nbdserver_new, true);
+
+     err = 0;
+-    list_for_each_entry_safe(blkif, _blkif, &vbd->rings, entry) {
++    tapdisk_vbd_for_each_blkif(vbd, blkif, _blkif) {
+
+         DPRINTF("implicitly disconnecting ring %p domid=%d, devid=%d\n",
+                 blkif, blkif->domid, blkif->devid);

SOURCES/0006-blkif-Avoid-use-after-free-on-BLKIF_OP_WRITE_BARRIER.patch

@@ -0,0 +1,77 @@
+From 6ed8043712dbc18635fa10d879a9a04eaba7eb2c Mon Sep 17 00:00:00 2001
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Date: Mon, 20 Jan 2025 18:22:07 +0100
+Subject: [PATCH] blkif: Avoid use-after-free on BLKIF_OP_WRITE_BARRIER request
+
+Function tapdisk_xenblkif_make_vbd_request will release
+tapreq->msg and reinsert it in the reqs_free array if the
+request is a BLKIF_OP_WRITE_BARRIER without any segment.
+But tapdisk_xenblkif_queue_request will use it to check if
+it must send the request to VBD layer.
+
+This bug triggers a crash when DEBUG is defined in td-reqs.c
+because DEBUG will poison the msg memory.
+Without DEBUG, the code reads freed memory that still contains
+unchanged data.
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+---
+ drivers/td-req.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/td-req.c b/drivers/td-req.c
+index 178985f3..c35b02c6 100644
+--- a/drivers/td-req.c
++++ b/drivers/td-req.c
+@@ -190,17 +190,21 @@ static void
+ tapdisk_xenblkif_free_request(struct td_xenblkif * const blkif,
+         struct td_xenblkif_req * const tapreq)
+ {
++    int put_bufcache;
++
+     ASSERT(blkif);
+     ASSERT(tapreq);
+     ASSERT(blkif->n_reqs_free < blkif->ring_size);
+
++    put_bufcache = tapreq->msg.nr_segments != 0;
++
+ #ifdef DEBUG
+ 	memset(&tapreq->msg, BLKIF_MSG_POISON, sizeof(tapreq->msg));
+ #endif
+
+     blkif->reqs_free[blkif->ring_size - (++blkif->n_reqs_free)] = &tapreq->msg;
+
+-	if (likely(tapreq->msg.nr_segments))
++	if (likely(put_bufcache))
+ 	    td_xenblkif_bufcache_put(blkif, tapreq->vma);
+ }
+
+@@ -829,11 +833,19 @@ tapdisk_xenblkif_queue_request(struct td_xenblkif * const blkif,
+         blkif_request_t *msg, struct td_xenblkif_req *tapreq)
+ {
+     int err;
++    int queue_request;
+
+     ASSERT(blkif);
+     ASSERT(msg);
+     ASSERT(tapreq);
+
++    queue_request = tapreq->msg.nr_segments != 0;
++
++    /*
++     * Do not use tapreq after tapdisk_xenblkif_make_vbd_request
++     * because this function can release tapreq->msg and reinsert it
++     * in the reqs_free array.
++     */
+     err = tapdisk_xenblkif_make_vbd_request(blkif, tapreq);
+     if (unlikely(err)) {
+         /* TODO log error */
+@@ -841,7 +853,7 @@ tapdisk_xenblkif_queue_request(struct td_xenblkif * const blkif,
+         return err;
+     }
+
+-	if (likely(tapreq->msg.nr_segments)) {
++	if (likely(queue_request)) {
+ 		err = tapdisk_vbd_queue_request(blkif->vbd, &tapreq->vreq);
+ 		if (unlikely(err)) {
+ 			/* TODO log error */