Fix multiple crashes listing interfaces

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

0001-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch

@@ -0,0 +1,40 @@
+From 6f3ee0c553bafec957e69df7fc42f83985d55c0f Mon Sep 17 00:00:00 2001
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Tue, 27 Feb 2024 16:20:12 +0100
+Subject: [PATCH] Fix off-by-one error in udevListInterfacesByStatus
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Ever since this function was introduced in 2012 it could've tried
+filling in an extra interface name.  That was made worse in 2019 when
+the caller functions started accepting NULL arrays of size 0.
+
+This is assigned CVE-2024-1441.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+Reported-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
+Fixes: 5a33366f5c0b18c93d161bd144f9f079de4ac8ca
+Fixes: d6064e2759a24e0802f363e3a810dc5a7d7ebb15
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit c664015fe3a7bf59db26686e9ed69af011c6ebb8)
+---
+ src/interface/interface_backend_udev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
+index ef334f175b..abeb766294 100644
+--- a/src/interface/interface_backend_udev.c
++++ b/src/interface/interface_backend_udev.c
+@@ -222,7 +222,7 @@ udevListInterfacesByStatus(virConnectPtr conn,
+         g_autoptr(virInterfaceDef) def = NULL;
+ 
+         /* Ensure we won't exceed the size of our array */
+-        if (count > names_len)
++        if (count >= names_len)
+             break;
+ 
+         path = udev_list_entry_get_name(dev_entry);
+-- 
+2.43.0
+

0001-interface-fix-udev_device_get_sysattr_value-return-v.patch

@@ -0,0 +1,90 @@
+From 13ea81b22cde0a429aa1de8b58655296084ce8d7 Mon Sep 17 00:00:00 2001
+From: Dmitry Frolov <frolov@swemel.ru>
+Date: Tue, 12 Sep 2023 15:56:47 +0300
+Subject: [PATCH] interface: fix udev_device_get_sysattr_value return value
+ check
+
+Reviewing the code I found that return value of function
+udev_device_get_sysattr_value() is dereferenced without a check.
+udev_device_get_sysattr_value() may return NULL by number of reasons.
+
+v2: VIR_DEBUG added, replaced STREQ(NULLSTR()) with STREQ_NULLABLE()
+v3: More checks added, to skip earlier. More verbose VIR_DEBUG.
+
+Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
+Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 2ca94317ac642a70921947150ced8acc674ccdc8)
+---
+ src/interface/interface_backend_udev.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
+index 54b43fb999..ef334f175b 100644
+--- a/src/interface/interface_backend_udev.c
++++ b/src/interface/interface_backend_udev.c
+@@ -23,6 +23,7 @@
+ #include <dirent.h>
+ #include <libudev.h>
+ 
++#include "virlog.h"
+ #include "virerror.h"
+ #include "virfile.h"
+ #include "datatypes.h"
+@@ -40,6 +41,8 @@
+ 
+ #define VIR_FROM_THIS VIR_FROM_INTERFACE
+ 
++VIR_LOG_INIT("interface.interface_backend_udev");
++
+ struct udev_iface_driver {
+     struct udev *udev;
+     /* pid file FD, ensures two copies of the driver can't use the same root */
+@@ -354,11 +357,20 @@ udevConnectListAllInterfaces(virConnectPtr conn,
+         const char *macaddr;
+         g_autoptr(virInterfaceDef) def = NULL;
+ 
+-        path = udev_list_entry_get_name(dev_entry);
+-        dev = udev_device_new_from_syspath(udev, path);
+-        name = udev_device_get_sysname(dev);
++        if (!(path = udev_list_entry_get_name(dev_entry))) {
++            VIR_DEBUG("Skipping interface, path == NULL");
++            continue;
++        }
++        if (!(dev = udev_device_new_from_syspath(udev, path))) {
++            VIR_DEBUG("Skipping interface '%s', dev == NULL", path);
++            continue;
++        }
++        if (!(name = udev_device_get_sysname(dev))) {
++            VIR_DEBUG("Skipping interface '%s', name == NULL", path);
++            continue;
++        }
+         macaddr = udev_device_get_sysattr_value(dev, "address");
+-        status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
++        status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
+ 
+         def = udevGetMinimalDefForDevice(dev);
+         if (!virConnectListAllInterfacesCheckACL(conn, def)) {
+@@ -962,9 +974,9 @@ udevGetIfaceDef(struct udev *udev, const char *name)
+ 
+     /* MTU */
+     mtu_str = udev_device_get_sysattr_value(dev, "mtu");
+-    if (virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
++    if (!mtu_str || virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
+         virReportError(VIR_ERR_INTERNAL_ERROR,
+-                _("Could not parse MTU value '%s'"), mtu_str);
++                       _("Could not parse MTU value '%s'"), NULLSTR(mtu_str));
+         goto error;
+     }
+     ifacedef->mtu = mtu;
+@@ -1087,7 +1099,7 @@ udevInterfaceIsActive(virInterfacePtr ifinfo)
+        goto cleanup;
+ 
+     /* Check if it's active or not */
+-    status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
++    status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
+ 
+     udev_device_unref(dev);
+ 
+-- 
+2.43.0
+

0001-qemuProcessRefreshDisks-Don-t-skip-filling-of-disk-i.patch

@@ -0,0 +1,58 @@
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Thu, 9 Feb 2023 09:40:32 +0100
+Subject: [PATCH] qemuProcessRefreshDisks: Don't skip filling of disk
+ information if tray state didn't change
+Content-type: text/plain
+
+Commit 5ef2582646eb98 added emitting of even when refreshign disk state,
+where it wanted to avoid sending the event if disk state didn't change.
+This was achieved by using 'continue' in the loop filling the
+information. Unfortunately this skips extraction of whether the device
+has a tray which is propagated into internal structures, which in turn
+broke cdrom media change as the code thought there's no tray for the
+device.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2166411
+Fixes: 5ef2582646eb98af208ce37355f82bdef39931fa
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Kristina Hanicova <khanicov@redhat.com>
+(cherry picked from commit 86cfe93ef7fdc2d665a2fc88b79af89e7978ba78)
+---
+ src/qemu/qemu_process.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
+index ee9f0784d3..0c408ee547 100644
+--- a/src/qemu/qemu_process.c
++++ b/src/qemu/qemu_process.c
+@@ -8724,16 +8724,13 @@ qemuProcessRefreshDisks(virDomainObj *vm,
+             continue;
+ 
+         if (info->removable) {
+-            virObjectEvent *event = NULL;
++            bool emitEvent = info->tray_open != disk->tray_status;
+             int reason;
+ 
+             if (info->empty)
+                 virDomainDiskEmptySource(disk);
+ 
+             if (info->tray) {
+-                if (info->tray_open == disk->tray_status)
+-                    continue;
+-
+                 if (info->tray_open) {
+                     reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_OPEN;
+                     disk->tray_status = VIR_DOMAIN_DISK_TRAY_OPEN;
+@@ -8742,8 +8739,10 @@ qemuProcessRefreshDisks(virDomainObj *vm,
+                     disk->tray_status = VIR_DOMAIN_DISK_TRAY_CLOSED;
+                 }
+ 
+-                event = virDomainEventTrayChangeNewFromObj(vm, disk->info.alias, reason);
+-                virObjectEventStateQueue(driver->domainEventState, event);
++                if (emitEvent) {
++                    virObjectEvent *event = virDomainEventTrayChangeNewFromObj(vm, disk->info.alias, reason);
++                    virObjectEventStateQueue(driver->domainEventState, event);
++                }
+             }
+         }
+ 

0001-util-Fix-logic-in-virFileSetCOW.patch

@@ -1,34 +0,0 @@
-From: Jiri Denemark <jdenemar@redhat.com>
-Date: Wed, 5 Aug 2020 10:01:45 +0200
-Subject: [PATCH] util: Fix logic in virFileSetCOW
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When COW is not explicitly requested to be disabled or enabled, the
-function is supposed to do nothing on non-BTRFS file systems.
-
-Fixes commit 7230bc95aa78379c9ee20cf59394c5fc4305b75b.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1866157
-
-Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 2edd63a0dbd445112db23596ee0128521e8f1ff5)
----
- src/util/virfile.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/util/virfile.c b/src/util/virfile.c
-index af150421e7..a06e7dfcce 100644
---- a/src/util/virfile.c
-+++ b/src/util/virfile.c
-@@ -4550,7 +4550,7 @@ virFileSetCOW(const char *path,
-     }
- 
-     if (buf.f_type != BTRFS_SUPER_MAGIC) {
--        if (state == VIR_TRISTATE_BOOL_ABSENT) {
-+        if (state != VIR_TRISTATE_BOOL_ABSENT) {
-             virReportSystemError(ENOSYS,
-                                  _("unable to control COW flag on '%s', not btrfs"),
-                                  path);

0002-ch-use-CURLOPT_UPLOAD-instead-of-CURLOPT_PUT.patch

@@ -0,0 +1,39 @@
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Wed, 18 Jan 2023 09:45:52 +0000
+Subject: [PATCH] ch: use CURLOPT_UPLOAD instead of CURLOPT_PUT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Content-type: text/plain
+
+The CURLOPT_PUT constant causes a deprecation warning when compiling on
+Alpine Edge.  The docs indicate it is deprecated since 7.2.1
+
+  https://curl.se/libcurl/c/CURLOPT_PUT.html
+
+Since 7.87 the deprecation is now exposed at build time via a compiler
+warning.
+
+We already use CURLOPT_UPLOAD in the ESX driver, so this brings the CH
+driver into line.
+
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 9cd70fb25cad171e415fb05a4e01f244304c602e)
+---
+ src/ch/ch_monitor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/ch/ch_monitor.c b/src/ch/ch_monitor.c
+index 8d8654332f..7b8f0a8077 100644
+--- a/src/ch/ch_monitor.c
++++ b/src/ch/ch_monitor.c
+@@ -660,7 +660,7 @@ virCHMonitorPutNoContent(virCHMonitor *mon, const char *endpoint)
+ 
+     curl_easy_setopt(mon->handle, CURLOPT_UNIX_SOCKET_PATH, mon->socketpath);
+     curl_easy_setopt(mon->handle, CURLOPT_URL, url);
+-    curl_easy_setopt(mon->handle, CURLOPT_PUT, true);
++    curl_easy_setopt(mon->handle, CURLOPT_UPLOAD, 1L);
+     curl_easy_setopt(mon->handle, CURLOPT_HTTPHEADER, NULL);
+ 
+     responseCode = virCHMonitorCurlPerform(mon->handle);

0002-virdevmapper-Don-t-cache-device-mapper-major.patch

@@ -1,88 +0,0 @@
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Tue, 18 Aug 2020 11:08:15 +0200
-Subject: [PATCH] virdevmapper: Don't cache device-mapper major
-
-The device mapper major is needed in virIsDevMapperDevice() which
-determines whether given device is managed by device-mapper. This
-number is obtained by parsing /proc/devices and then stored in a
-global variable so that the file doesn't have to be parsed again.
-However, as it turns out this logic is flawed - the major number
-is not static and can change as it can be specified as a
-parameter when loading the dm-mod module.
-
-Unfortunately, I was not able to come up with a good solution and
-thus the /proc/devices file is being parsed every time we need
-the device mapper major.
-
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Peter Krempa <pkrempa@redhat.com>
-Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-Tested-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-(cherry picked from commit 82bb167f0d15b733b23931205be3488b83cb9ec6)
----
- src/util/virdevmapper.c | 17 +++++------------
- 1 file changed, 5 insertions(+), 12 deletions(-)
-
-diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c
-index a471504176..b43dbefa9a 100644
---- a/src/util/virdevmapper.c
-+++ b/src/util/virdevmapper.c
-@@ -46,11 +46,9 @@
- 
- G_STATIC_ASSERT(BUF_SIZE > sizeof(struct dm_ioctl));
- 
--static unsigned int virDMMajor;
--
- 
- static int
--virDevMapperOnceInit(void)
-+virDevMapperGetMajor(unsigned int *major)
- {
-     g_autofree char *buf = NULL;
-     VIR_AUTOSTRINGLIST lines = NULL;
-@@ -69,7 +67,7 @@ virDevMapperOnceInit(void)
- 
-         if (sscanf(lines[i], "%u %ms\n", &maj, &dev) == 2 &&
-             STREQ(dev, DM_NAME)) {
--            virDMMajor = maj;
-+            *major = maj;
-             break;
-         }
-     }
-@@ -85,9 +83,6 @@ virDevMapperOnceInit(void)
- }
- 
- 
--VIR_ONCE_GLOBAL_INIT(virDevMapper);
--
--
- static void *
- virDMIoctl(int controlFD, int cmd, struct dm_ioctl *dm, char **buf)
- {
-@@ -305,9 +300,6 @@ virDevMapperGetTargets(const char *path,
-      * consist of devices or yet another targets. If that's the
-      * case, we have to stop recursion somewhere. */
- 
--    if (virDevMapperInitialize() < 0)
--        return -1;
--
-     if ((controlFD = virDMOpen()) < 0)
-         return -1;
- 
-@@ -319,13 +311,14 @@ bool
- virIsDevMapperDevice(const char *dev_name)
- {
-     struct stat buf;
-+    unsigned int major;
- 
--    if (virDevMapperInitialize() < 0)
-+    if (virDevMapperGetMajor(&major) < 0)
-         return false;
- 
-     if (!stat(dev_name, &buf) &&
-         S_ISBLK(buf.st_mode) &&
--        major(buf.st_rdev) == virDMMajor)
-+        major(buf.st_rdev) == major)
-         return true;
- 
-     return false;

0003-storage-Fix-returning-of-locked-objects-from-virStor.patch

@@ -0,0 +1,56 @@
+From 9a47442366fcf8a7b6d7422016d7bbb6764a1098 Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Thu, 13 Jul 2023 16:16:37 +0200
+Subject: [PATCH] storage: Fix returning of locked objects from
+ 'virStoragePoolObjListSearch'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2023-3750
+
+'virStoragePoolObjListSearch' explicitly documents that it's returning
+a pointer to a locked and ref'd pool that maches the lookup function.
+
+This was not the case as in commit 0c4b391e2a9 (released in
+libvirt-8.3.0) the code was accidentally converted to use 'VIR_LOCK_GUARD'
+which auto-unlocked it when leaving the scope, even when the code was
+originally "leaking" the lock.
+
+Revert the corresponding conversion and add a comment that this function
+is intentionally leaking a locked object.
+
+Fixes: 0c4b391e2a9
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2221851
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+Signed-off-by: Han Han <hhan@redhat.com>
+---
+ src/conf/virstorageobj.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c
+index 7010e97d61..59fa5da372 100644
+--- a/src/conf/virstorageobj.c
++++ b/src/conf/virstorageobj.c
+@@ -454,11 +454,16 @@ virStoragePoolObjListSearchCb(const void *payload,
+     virStoragePoolObj *obj = (virStoragePoolObj *) payload;
+     struct _virStoragePoolObjListSearchData *data =
+         (struct _virStoragePoolObjListSearchData *)opaque;
+-    VIR_LOCK_GUARD lock = virObjectLockGuard(obj);
+ 
++    virObjectLock(obj);
++
++    /* If we find the matching pool object we must return while the object is
++     * locked as the caller wants to return a locked object. */
+     if (data->searcher(obj, data->opaque))
+         return 1;
+ 
++    virObjectUnlock(obj);
++
+     return 0;
+ }
+ 
+-- 
+2.41.0
+

0003-virdevmapper-Handle-kernel-without-device-mapper-sup.patch

@@ -1,76 +0,0 @@
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Tue, 18 Aug 2020 11:04:24 +0200
-Subject: [PATCH] virdevmapper: Handle kernel without device-mapper support
-
-In one of my latest patch (v6.6.0~30) I was trying to remove
-libdevmapper use in favor of our own implementation. However, the
-code did not take into account that device mapper can be not
-compiled into the kernel (e.g. be a separate module that's not
-loaded) in which case /proc/devices won't have the device-mapper
-major number and thus virDevMapperGetTargets() and/or
-virIsDevMapperDevice() fails.
-
-However, such failure is safe to ignore, because if device mapper
-is missing then there can't be any multipath devices and thus we
-don't need to allow the deps in CGroups, nor create them in the
-domain private namespace, etc.
-
-Fixes: 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e
-Reported-by: Andrea Bolognani <abologna@redhat.com>
-Reported-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Peter Krempa <pkrempa@redhat.com>
-Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-Tested-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-(cherry picked from commit feb8564a3cc63bc8f68284063d53ec0d2d81a1cc)
----
- src/util/virdevmapper.c | 20 ++++++++++++++++++--
- 1 file changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c
-index b43dbefa9a..a81e2edee4 100644
---- a/src/util/virdevmapper.c
-+++ b/src/util/virdevmapper.c
-@@ -54,6 +54,9 @@ virDevMapperGetMajor(unsigned int *major)
-     VIR_AUTOSTRINGLIST lines = NULL;
-     size_t i;
- 
-+    if (!virFileExists(CONTROL_PATH))
-+        return -2;
-+
-     if (virFileReadAll(PROC_DEVICES, BUF_SIZE, &buf) < 0)
-         return -1;
- 
-@@ -126,8 +129,13 @@ virDMOpen(void)
- 
-     memset(&dm, 0, sizeof(dm));
- 
--    if ((controlFD = open(CONTROL_PATH, O_RDWR)) < 0)
-+    if ((controlFD = open(CONTROL_PATH, O_RDWR)) < 0) {
-+        if (errno == ENOENT)
-+            return -2;
-+
-+        virReportSystemError(errno, _("Unable to open %s"), CONTROL_PATH);
-         return -1;
-+    }
- 
-     if (!virDMIoctl(controlFD, DM_VERSION, &dm, &tmp)) {
-         virReportSystemError(errno, "%s",
-@@ -300,8 +308,16 @@ virDevMapperGetTargets(const char *path,
-      * consist of devices or yet another targets. If that's the
-      * case, we have to stop recursion somewhere. */
- 
--    if ((controlFD = virDMOpen()) < 0)
-+    if ((controlFD = virDMOpen()) < 0) {
-+        if (controlFD == -2) {
-+            /* The CONTROL_PATH doesn't exist. Probably the
-+             * module isn't loaded, yet. Don't error out, just
-+             * exit. */
-+            return 0;
-+        }
-+
-         return -1;
-+    }
- 
-     return virDevMapperGetTargetsImpl(controlFD, path, devPaths, ttl);
- }

0004-virdevmapper-Ignore-all-errors-when-opening-dev-mapp.patch

@@ -1,77 +0,0 @@
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Wed, 19 Aug 2020 13:35:55 +0200
-Subject: [PATCH] virdevmapper: Ignore all errors when opening
- /dev/mapper/control
-
-So far, only ENOENT is ignored (to deal with kernels without
-devmapper). However, as reported on the list, under certain
-scenarios a different error can occur. For instance, when libvirt
-is running inside a container which doesn't have permissions to
-talk to the devmapper. If this is the case, then open() returns
--1 and sets errno=EPERM.
-
-Assuming that multipath devices are fairly narrow use case and
-using them in a restricted container is even more narrow the best
-fix seems to be to ignore all open errors BUT produce a warning
-on failure. To avoid flooding logs with warnings on kernels
-without devmapper the level is reduced to a plain debug message.
-
-Reported-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-(cherry picked from commit 53d9af1e7924757e3b5f661131dd707d7110d094)
----
- src/util/virdevmapper.c | 23 +++++++++++++++--------
- 1 file changed, 15 insertions(+), 8 deletions(-)
-
-diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c
-index a81e2edee4..ee2fab5ae3 100644
---- a/src/util/virdevmapper.c
-+++ b/src/util/virdevmapper.c
-@@ -35,9 +35,12 @@
- # include "viralloc.h"
- # include "virstring.h"
- # include "virfile.h"
-+# include "virlog.h"
- 
- # define VIR_FROM_THIS VIR_FROM_STORAGE
- 
-+VIR_LOG_INIT("util.virdevmapper");
-+
- # define PROC_DEVICES "/proc/devices"
- # define DM_NAME "device-mapper"
- # define DEV_DM_DIR "/dev/" DM_DIR
-@@ -130,11 +133,15 @@ virDMOpen(void)
-     memset(&dm, 0, sizeof(dm));
- 
-     if ((controlFD = open(CONTROL_PATH, O_RDWR)) < 0) {
--        if (errno == ENOENT)
--            return -2;
--
--        virReportSystemError(errno, _("Unable to open %s"), CONTROL_PATH);
--        return -1;
-+        /* We can't talk to devmapper. Produce a warning and let
-+         * the caller decide what to do next. */
-+        if (errno == ENOENT) {
-+            VIR_DEBUG("device mapper not available");
-+        } else {
-+            VIR_WARN("unable to open %s: %s",
-+                     CONTROL_PATH, g_strerror(errno));
-+        }
-+        return -2;
-     }
- 
-     if (!virDMIoctl(controlFD, DM_VERSION, &dm, &tmp)) {
-@@ -310,9 +317,9 @@ virDevMapperGetTargets(const char *path,
- 
-     if ((controlFD = virDMOpen()) < 0) {
-         if (controlFD == -2) {
--            /* The CONTROL_PATH doesn't exist. Probably the
--             * module isn't loaded, yet. Don't error out, just
--             * exit. */
-+            /* The CONTROL_PATH doesn't exist or is unusable.
-+             * Probably the module isn't loaded, yet. Don't error
-+             * out, just exit. */
-             return 0;
-         }
- 

0004-virpci-Resolve-leak-in-virPCIVirtualFunctionList-cle.patch

@@ -0,0 +1,51 @@
+From 6425a311b8ad19d6f9c0b315bf1d722551ea3585 Mon Sep 17 00:00:00 2001
+From: Tim Shearer <TShearer@adva.com>
+Date: Mon, 1 May 2023 13:15:48 +0000
+Subject: [PATCH] virpci: Resolve leak in virPCIVirtualFunctionList cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Repeatedly querying an SR-IOV PCI device's capabilities exposes a
+memory leak caused by a failure to free the virPCIVirtualFunction
+array within the parent struct's g_autoptr cleanup.
+
+Valgrind output after getting a single interface's XML description
+1000 times:
+
+==325982== 256,000 bytes in 1,000 blocks are definitely lost in loss record 2,634 of 2,635
+==325982==    at 0x4C3C096: realloc (vg_replace_malloc.c:1437)
+==325982==    by 0x59D952D: g_realloc (in /usr/lib64/libglib-2.0.so.0.5600.4)
+==325982==    by 0x4EE1F52: virReallocN (viralloc.c:52)
+==325982==    by 0x4EE1FB7: virExpandN (viralloc.c:78)
+==325982==    by 0x4EE219A: virInsertElementInternal (viralloc.c:183)
+==325982==    by 0x4EE23B2: virAppendElement (viralloc.c:288)
+==325982==    by 0x4F65D85: virPCIGetVirtualFunctionsFull (virpci.c:2389)
+==325982==    by 0x4F65753: virPCIGetVirtualFunctions (virpci.c:2256)
+==325982==    by 0x505CB75: virNodeDeviceGetPCISRIOVCaps (node_device_conf.c:2969)
+==325982==    by 0x505D181: virNodeDeviceGetPCIDynamicCaps (node_device_conf.c:3099)
+==325982==    by 0x505BC4E: virNodeDeviceUpdateCaps (node_device_conf.c:2677)
+==325982==    by 0x260FCBB2: nodeDeviceGetXMLDesc (node_device_driver.c:355)
+
+Signed-off-by: Tim Shearer <tshearer@adva.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+Signed-off-by: Han Han <hhan@redhat.com>
+---
+ src/util/virpci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/util/virpci.c b/src/util/virpci.c
+index 9e564e4a4f..cc2b07bbba 100644
+--- a/src/util/virpci.c
++++ b/src/util/virpci.c
+@@ -2245,6 +2245,7 @@ virPCIVirtualFunctionListFree(virPCIVirtualFunctionList *list)
+         g_free(list->functions[i].ifname);
+     }
+ 
++    g_free(list->functions);
+     g_free(list);
+ }
+ 
+-- 
+2.41.0
+

0005-util-use-g_autofree-in-virSCSIHostGetUniqueId.patch

@@ -1,57 +0,0 @@
-From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
-Date: Wed, 4 Nov 2020 12:08:19 +0100
-Subject: [PATCH] util: use g_autofree in virSCSIHostGetUniqueId
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Ján Tomko <jtomko@redhat.com>
-Reviewed-by: Erik Skultety <eskultet@redhat.com>
-(cherry picked from commit 843b70995471c1a20822ee62ff084310066b4b4a)
----
- src/util/virscsihost.c | 16 +++++-----------
- 1 file changed, 5 insertions(+), 11 deletions(-)
-
-diff --git a/src/util/virscsihost.c b/src/util/virscsihost.c
-index 7d8e5299b8..4e6d8f7ad6 100644
---- a/src/util/virscsihost.c
-+++ b/src/util/virscsihost.c
-@@ -46,17 +46,16 @@ int
- virSCSIHostGetUniqueId(const char *sysfs_prefix,
-                        int host)
- {
--    char *sysfs_path = NULL;
-+    g_autofree char *sysfs_path = NULL;
-     char *p = NULL;
--    int ret = -1;
--    char *buf = NULL;
-+    g_autofree char *buf = NULL;
-     int unique_id;
- 
-     sysfs_path = g_strdup_printf("%s/host%d/unique_id",
-                                  sysfs_prefix ? sysfs_prefix : SYSFS_SCSI_HOST_PATH, host);
- 
-     if (virFileReadAll(sysfs_path, 1024, &buf) < 0)
--        goto cleanup;
-+        return -1;
- 
-     if ((p = strchr(buf, '\n')))
-         *p = '\0';
-@@ -65,15 +64,10 @@ virSCSIHostGetUniqueId(const char *sysfs_prefix,
-         virReportError(VIR_ERR_INTERNAL_ERROR,
-                        _("unable to parse unique_id: %s"), buf);
- 
--        goto cleanup;
-+        return -1;
-     }
- 
--    ret = unique_id;
--
-- cleanup:
--    VIR_FREE(sysfs_path);
--    VIR_FREE(buf);
--    return ret;
-+    return unique_id;
- }
- 
- 

0006-util-quieten-virSCSIHostGetUniqueId.patch

@@ -1,56 +0,0 @@
-From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
-Date: Wed, 4 Nov 2020 12:29:07 +0100
-Subject: [PATCH] util: quieten virSCSIHostGetUniqueId
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The only caller of this function ignores failure
-and just sets the unique_id to -1.
-
-Failing to read the file is likely to the device no longer
-being present, not a real error.
-
-Stop reporting errors in this function.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1692100
-
-Signed-off-by: Ján Tomko <jtomko@redhat.com>
-Reviewed-by: Erik Skultety <eskultet@redhat.com>
-(cherry picked from commit 4a56278e770c972dbee7be5842b557de152a586e)
----
- src/util/virscsihost.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/util/virscsihost.c b/src/util/virscsihost.c
-index 4e6d8f7ad6..b1d51b40d3 100644
---- a/src/util/virscsihost.c
-+++ b/src/util/virscsihost.c
-@@ -41,6 +41,8 @@ VIR_LOG_INIT("util.scsi_host");
-  * Read the value of the "scsi_host" unique_id file.
-  *
-  * Returns the value on success or -1 on failure.
-+ *
-+ * No errors are reported.
-  */
- int
- virSCSIHostGetUniqueId(const char *sysfs_prefix,
-@@ -54,16 +56,14 @@ virSCSIHostGetUniqueId(const char *sysfs_prefix,
-     sysfs_path = g_strdup_printf("%s/host%d/unique_id",
-                                  sysfs_prefix ? sysfs_prefix : SYSFS_SCSI_HOST_PATH, host);
- 
--    if (virFileReadAll(sysfs_path, 1024, &buf) < 0)
-+    if (virFileReadAllQuiet(sysfs_path, 1024, &buf) < 0)
-         return -1;
- 
-     if ((p = strchr(buf, '\n')))
-         *p = '\0';
- 
-     if (virStrToLong_i(buf, NULL, 10, &unique_id) < 0) {
--        virReportError(VIR_ERR_INTERNAL_ERROR,
--                       _("unable to parse unique_id: %s"), buf);
--
-+        VIR_DEBUG("unable to parse unique_id: '%s'", buf);
-         return -1;
-     }
- 

0007-node_device-Use-udev-monitor-source.patch

@@ -1,46 +0,0 @@
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Tue, 17 Nov 2020 12:56:39 +0100
-Subject: [PATCH] node_device: Use "udev" monitor source
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In v6.3.0-rc1~67 I've made a switch: instead of listening on udev
-events the nodedev driver started listening for kernel events.
-This was because when a device changes its name (e.g. NICs) we
-will get "move" event with DEVPATH_OLD property set, which we can
-then use to remove the old device and thus keep our internal list
-up to date. The switch to "kernel" source was made because if the
-old NICs naming (eth0, eth1, ...) is enabled (e.g. via
-net.ifnames=0 on the kernel cmd line) then udev overwrites the
-property with the new name making our internal list go out of
-sync. Interestingly, when the od NICs naming is not enabled then
-the DEVPATH_OLD contains the correct value.
-
-But as it turns out, "kernel" source might be missing some other
-important properties, e.g. USB vendor/product IDs. Therefore,
-switch back to "udev" source and wish the best of luck to users
-using the old NICs naming.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1897625
-Fixes: 9a13704818e4a018723e0ec5b9e97b176f1c8584
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 7e67a136dab9034dd3cb2ed76fa90c524c800cde)
----
- src/node_device/node_device_udev.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
-index ff558efb83..b7fbd42fa1 100644
---- a/src/node_device/node_device_udev.c
-+++ b/src/node_device/node_device_udev.c
-@@ -1878,7 +1878,7 @@ nodeStateInitialize(bool privileged,
- 
-     virObjectLock(priv);
- 
--    priv->udev_monitor = udev_monitor_new_from_netlink(udev, "kernel");
-+    priv->udev_monitor = udev_monitor_new_from_netlink(udev, "udev");
-     if (!priv->udev_monitor) {
-         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                        _("udev_monitor_new_from_netlink returned NULL"));

sources

@@ -1 +1 @@
-SHA512 (libvirt-6.6.0.tar.xz) = 55091addcf43d3c0bdd50f9378b588351181d191272d5a19220a0babe0893c1f6e0f1e41a7f51b8c1fb8e2098236b273e1a18b81573f4008ee3cf65374ba9465
+SHA512 (libvirt-9.0.0.tar.xz) = 135f690f9fe722161c22579166f10a54d52941a371439165fd0e3d391ca7835049a3bcbff33fc81c50153046230db8a5a318d707383bad3141d489d2faa09ecb