Compare commits

..

71 Commits

Author SHA1 Message Date
jinqiang zhang 10e74b75cb update depends package name for openruyi 2026-03-02 18:00:40 +08:00
Richard W.M. Jones 67283bdf89 Backport fix for IPv6 connections to ESXi 2026-01-26 10:13:31 +00:00
Fedora Release Engineering e092293a63 Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild 2026-01-16 19:44:38 +00:00
Daniel P. Berrangé 41a6b3c03f Update to 12.0.0
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2026-01-15 09:22:17 +00:00
Daniel P. Berrangé 31256f3d0d Bump release for previous commit
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2026-01-12 19:32:49 +00:00
Daniel P. Berrangé abac39a1b8 Disable -Werror on ELN too
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2026-01-12 19:30:03 +00:00
Richard W.M. Jones 39e9be886f Rebuild for xen 4.21.0 2026-01-08 09:14:30 +00:00
Jiri Denemark 3db4281bc0 spec: Fix RPM build when %{fedora} is undefined
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2025-12-23 16:26:17 -05:00
Cole Robinson 249ba7e495 libvirt-11.10.0-1
Update to version 11.10.0
2025-12-01 11:15:36 -05:00
Richard W.M. Jones 33a8555d08 Add upstream patches to fix parallel libguestfs 2025-11-17 18:30:12 +00:00
Tom spot Callaway dfb6f9eee6 rebuild for new fuse3 2025-11-04 16:26:27 -05:00
Daniel P. Berrangé f5c4597c0a Update to 11.9.0 release
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-11-03 14:42:01 +00:00
Peter Robinson 766bb232e8 build against fuse3
Support was added in 8.2 and fuse2 is EOL upstream and hence
unmaintained.
2025-10-29 19:15:04 +00:00
Cole Robinson 266d5e2fcb Fix build with latest wireshark
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-10-14 19:00:29 -04:00
Cole Robinson c6cfdf3963 Update to version 11.8.0
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-10-01 12:06:18 -04:00
Adam Williamson e3da3b01fc Rebuild on a side tag for libiscsi 2025-09-04 17:16:21 -07:00
Adam Williamson b340367499 Disable parallelization on i686
This is to get a build through to make the package installable
against the new libiscsi soname, which is high priority. It'd be
great if someone can look into the -j 64 build failures and fix
the problem going forward, though.
2025-09-04 14:51:18 -07:00
Adam Williamson ca7cc971b8 Rebuild for libiscsi.so.11 2025-09-04 13:27:20 -07:00
Cole Robinson 774125b7ed libvirt-11.7.0-1
Update to version 11.7.0
2025-09-02 10:52:38 -04:00
Cole Robinson afd39d2091 libvirt-11.6.0-1
Update to version 11.6.0
2025-08-05 11:37:25 -04:00
Fedora Release Engineering cc16b7cd3a Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild 2025-07-24 20:32:59 +00:00
Richard W.M. Jones be942ea860 Rebuild for updated Xen 2025-07-16 18:30:24 +01:00
Cole Robinson 938b89f090 libvirt-11.5.0-1
Update to version 11.5.0
2025-07-09 10:04:57 -04:00
Cole Robinson f7283923a3 Fix dumpxml failures after migration (bz 2369243)
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-06-20 10:44:15 -04:00
Cole Robinson 1ad100593a libvirt-11.4.0-1
Update to version 11.4.0
2025-06-02 10:11:59 -04:00
Daniel P. Berrangé 21608be3b1 Sync zfs changes with upstream
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-05-14 11:23:03 +01:00
Adam Williamson 6347aef63f Properly obsolete libvirt-daemon-driver-storage-zfs 2025-05-08 23:52:57 -07:00
Cole Robinson 1c5d25ffeb zfs-fuse is gone from rawhide, drop libvirt-daemon-storage-zfs
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-05-08 19:20:40 -04:00
Cole Robinson 8386ba3e9d Update to version 11.3.0
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-05-07 13:14:23 -04:00
Daniel P. Berrangé 03d3983515 Fix tests with rebuild with GCC 15
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-04-29 15:50:37 +01:00
Daniel P. Berrangé 1b0f3aaf64 Fix Ampere 1 CPU and binary paths
- Fix install of Ampere 1 ARM CPU model (rhbz #2361196)
- Fix location of mount, umount (rhbz #2359196)
- Fix location of numad (rhbz #2359736)

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-04-29 14:50:14 +01:00
Cole Robinson 647354eaf9 libvirt-11.2.0-1
Update to version 11.2.0
2025-04-01 10:45:39 -04:00
Cole Robinson 1392d7120d libvirt-11.1.0-1
Update to version 11.1.0
2025-03-03 09:43:33 -05:00
Yaakov Selkowitz f80d27e126 Fix build with GCC 15
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/EIQKWD2S4TZ2RXP45PBMGNHA6QTUT3BA/
2025-01-26 22:38:21 -05:00
Cole Robinson 63cd2ced20 Update to version 11.0.0
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2025-01-17 12:03:38 -05:00
Fedora Release Engineering cad1b6966f Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild 2025-01-17 14:54:04 +00:00
Daniel P. Berrangé a27f478451 Various dir ownership fixes
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-12-17 11:17:43 +00:00
Cole Robinson b94faf01a5 libvirt-10.10.0-1
Update to version 10.10.0
2024-12-02 12:54:15 -05:00
Daniel P. Berrangé 60a70c925a Update to 10.9.0 release
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-11-01 11:14:26 +00:00
Cole Robinson e184d967ac libvirt-10.8.0-1
Update to version 10.8.0
2024-10-01 11:05:14 -04:00
Yaakov Selkowitz 985ee7390d Fix build with latest libselinux
https://gitlab.com/libvirt/libvirt/-/merge_requests/407
2024-09-24 18:57:21 -04:00
Cole Robinson 156ce5b5c7 libvirt-10.7.0-1
Update to version 10.7.0

Signed-off-by: Cole Robinson <crobinso@redhat.com>
2024-09-02 13:55:47 -04:00
Lumir Balhar 77b02695ab Add new systemtap-sdt-dtrace to build deps
This is a part of approved Fedora change:
https://fedoraproject.org/wiki/Changes/Separate_dtrace_package

systemtap-sdt-devel will stop requiring systemtap-sdt-dtrace
and that would break the build of this package.
2024-08-27 09:09:52 -04:00
Cole Robinson 50057212b3 libvirt-10.6.0-2
Fix  on kernel 6.10 (bz #2302245)
2024-08-27 08:54:25 -04:00
Cole Robinson c61c2c83ef libvirt-10.6.0-1
Update to version 10.6.0
2024-08-06 08:57:52 -04:00
Richard W.M. Jones e3e721c529 Rebuild for Xen 4.19.0 2024-08-05 11:11:49 +01:00
Fedora Release Engineering 7bf08eb7cb Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild 2024-07-18 15:26:05 +00:00
Daniel P. Berrangé 0862e2b778 Rebase to 10.5.0 release
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-07-04 10:31:26 +01:00
Daniel P. Berrangé 9ae002fc72 Fix GSource leak & udev leak
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-06-05 12:55:10 +01:00
Daniel P. Berrangé 7749fc4a26 Update to 10.4.0 release
This switches the virtual network backend from iptables to nftables
and introduces an SSH VSOCK proxy by default for QEMU.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-06-05 10:09:34 +01:00
Daniel P. Berrangé 5b0f05f970 Update to 10.3.0 release
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-05-02 14:38:32 +01:00
Cole Robinson 36079ddefa Rebuild for new libiscsi
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2024-04-06 15:04:19 -04:00
Cole Robinson 9abc69f078 libvirt-10.2.0-1
Update to version 10.2.0
2024-04-05 19:16:45 -04:00
Cole Robinson f4d251ad6e Add sources
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2024-03-01 13:00:28 -05:00
Cole Robinson b0d2e09842 Update to version 10.1.0
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2024-03-01 12:47:39 -05:00
Cole Robinson b0dd011728 spec: Handle bash-completion .pc file move
it's in bash-completion-devel now, but pkgconfig() will handle
that for us.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
2024-02-19 11:35:24 -05:00
Cole Robinson 2513c9ff81 libvirt-10.0.0-4
Rebuild for wireshark soname bump
2024-02-19 10:44:48 -05:00
Fedora Release Engineering 9ef5501a94 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-25 03:55:08 +00:00
Fedora Release Engineering 659f2f0b36 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-21 05:41:08 +00:00
Cole Robinson f3cac3532b libvirt-10.0.0-1
Update to version 10.0.0
2024-01-16 11:11:03 -05:00
jonathanspw 6eb56c2e71 fix regression for default input bus in libvirt >= 9.3
(cherry picked from commit dfeabf11e5)
2024-01-03 22:27:00 +00:00
Richard W.M. Jones 93a549eb1a Bump and rebuild for xen 4.18.0, third attempt 2023-12-08 10:02:08 +00:00
Adam Williamson f2a998ce76 Rebuild for xen 4.18.0 again 2023-12-05 10:41:25 -08:00
Cole Robinson 8556d44e84 libvirt-9.10.0-1
Update to version 9.10.0
2023-12-02 12:22:48 -05:00
Richard W.M. Jones f8539fae13 Backport upstream cfcbba4c2b8a
commit cfcbba4c2b8a2062dec36072a34209229b6c3277
  Author: Michal Prívozník <mprivozn@redhat.com>
  Date:   Wed Nov 22 14:58:49 2023 +0100

    lib: Replace qsort() with g_qsort_with_data()
2023-11-30 10:40:30 +00:00
Richard W.M. Jones 80a3188a20 Fix libxml2 API changes 2023-11-30 09:02:20 +00:00
Richard W.M. Jones 56d89b1d61 Bump and rebuild for xen 4.18.0 2023-11-30 08:35:47 +00:00
Cole Robinson 2a7828bae8 libvirt-9.9.0-2
Fix crash with snapshot restore (bz #2247754)
2023-11-06 09:53:21 -05:00
Cole Robinson c879325741 spec: Fix mingw build
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2023-11-01 17:06:43 -04:00
Cole Robinson edf6aa6cd7 libvirt-9.9.0-1
Update to version 9.9.0
2023-11-01 10:17:27 -04:00
Cole Robinson 163b87484b libvirt-9.8.0-1
Update to version 9.8.0
2023-10-05 20:59:33 -04:00
10 changed files with 751 additions and 765 deletions
@@ -1,40 +0,0 @@
From 76cdc7adf55723ff8da146bd3c15c64d0afd5d93 Mon Sep 17 00:00:00 2001
From: Martin Kletzander <mkletzan@redhat.com>
Date: Tue, 27 Feb 2024 16:20:12 +0100
Subject: [PATCH] Fix off-by-one error in udevListInterfacesByStatus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Ever since this function was introduced in 2012 it could've tried
filling in an extra interface name. That was made worse in 2019 when
the caller functions started accepting NULL arrays of size 0.
This is assigned CVE-2024-1441.
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reported-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
Fixes: 5a33366f5c0b18c93d161bd144f9f079de4ac8ca
Fixes: d6064e2759a24e0802f363e3a810dc5a7d7ebb15
Reviewed-by: Ján Tomko <jtomko@redhat.com>
(cherry picked from commit c664015fe3a7bf59db26686e9ed69af011c6ebb8)
---
src/interface/interface_backend_udev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index fb6799ed94..4091483060 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -222,7 +222,7 @@ udevListInterfacesByStatus(virConnectPtr conn,
g_autoptr(virInterfaceDef) def = NULL;
/* Ensure we won't exceed the size of our array */
- if (count > names_len)
+ if (count >= names_len)
break;
path = udev_list_entry_get_name(dev_entry);
--
2.43.0
@@ -0,0 +1,41 @@
From 845210011a9ffd9d17e30c51cbc81ba67c5d3166 Mon Sep 17 00:00:00 2001
From: Michal Privoznik <mprivozn@redhat.com>
Date: Tue, 20 Jan 2026 10:08:29 +0100
Subject: [PATCH] esx: Allow connecting to IPv6 server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When connecting to a VMWare server, the hostname from URI is
resolved using esxUtil_ResolveHostname() which in turn calls
getaddrinfo(). But in the hints argument, we restrict the return
address to be IPv4 (AF_INET) which obviously fails if the address
to resolve is an IPv6 address. Set the hint to AF_UNSPEC which
allows both IPv4 and IPv6. While at it, also allow IPv4 addresses
mapped in IPv6 by setting AI_V4MAPPED flag.
Resolves: https://issues.redhat.com/browse/RHEL-138300
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/esx/esx_util.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c
index 88b3dc893f..a6275babd5 100644
--- a/src/esx/esx_util.c
+++ b/src/esx/esx_util.c
@@ -275,8 +275,8 @@ esxUtil_ResolveHostname(const char *hostname, char **ipAddress)
int errcode;
g_autofree char *address = NULL;
- hints.ai_flags = AI_ADDRCONFIG;
- hints.ai_family = AF_INET;
+ hints.ai_flags = AI_ADDRCONFIG | AI_V4MAPPED;
+ hints.ai_family = AF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
hints.ai_protocol = 0;
--
2.52.0
@@ -1,41 +0,0 @@
From 3499354e12a1c1832bf4030693a64e03ceb79d05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 5 Jun 2024 11:16:21 +0100
Subject: [PATCH] interface: fix udev reference leak with invalid flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The udevInterfaceGetXMLDesc method takes a reference on the udev
driver as its first action. If the virCheckFlags() condition
fails, however, this reference is never released.
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/interface/interface_backend_udev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index fdf11a8318..e1a50389c9 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -1027,12 +1027,14 @@ static char *
udevInterfaceGetXMLDesc(virInterfacePtr ifinfo,
unsigned int flags)
{
- struct udev *udev = udev_ref(driver->udev);
+ struct udev *udev = NULL;
g_autoptr(virInterfaceDef) ifacedef = NULL;
char *xmlstr = NULL;
virCheckFlags(VIR_INTERFACE_XML_INACTIVE, NULL);
+ udev = udev_ref(driver->udev);
+
/* Recursively build up the interface XML based on the requested
* interface name
*/
--
2.45.1
@@ -1,90 +0,0 @@
From c120b31f826cd51127d28f8beaa61ac0d5f03048 Mon Sep 17 00:00:00 2001
From: Dmitry Frolov <frolov@swemel.ru>
Date: Tue, 12 Sep 2023 15:56:47 +0300
Subject: [PATCH] interface: fix udev_device_get_sysattr_value return value
check
Reviewing the code I found that return value of function
udev_device_get_sysattr_value() is dereferenced without a check.
udev_device_get_sysattr_value() may return NULL by number of reasons.
v2: VIR_DEBUG added, replaced STREQ(NULLSTR()) with STREQ_NULLABLE()
v3: More checks added, to skip earlier. More verbose VIR_DEBUG.
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
(cherry picked from commit 2ca94317ac642a70921947150ced8acc674ccdc8)
---
src/interface/interface_backend_udev.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index a0485ddd21..fb6799ed94 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -23,6 +23,7 @@
#include <dirent.h>
#include <libudev.h>
+#include "virlog.h"
#include "virerror.h"
#include "virfile.h"
#include "datatypes.h"
@@ -40,6 +41,8 @@
#define VIR_FROM_THIS VIR_FROM_INTERFACE
+VIR_LOG_INIT("interface.interface_backend_udev");
+
struct udev_iface_driver {
struct udev *udev;
/* pid file FD, ensures two copies of the driver can't use the same root */
@@ -354,11 +357,20 @@ udevConnectListAllInterfaces(virConnectPtr conn,
const char *macaddr;
g_autoptr(virInterfaceDef) def = NULL;
- path = udev_list_entry_get_name(dev_entry);
- dev = udev_device_new_from_syspath(udev, path);
- name = udev_device_get_sysname(dev);
+ if (!(path = udev_list_entry_get_name(dev_entry))) {
+ VIR_DEBUG("Skipping interface, path == NULL");
+ continue;
+ }
+ if (!(dev = udev_device_new_from_syspath(udev, path))) {
+ VIR_DEBUG("Skipping interface '%s', dev == NULL", path);
+ continue;
+ }
+ if (!(name = udev_device_get_sysname(dev))) {
+ VIR_DEBUG("Skipping interface '%s', name == NULL", path);
+ continue;
+ }
macaddr = udev_device_get_sysattr_value(dev, "address");
- status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
+ status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
def = udevGetMinimalDefForDevice(dev);
if (!virConnectListAllInterfacesCheckACL(conn, def)) {
@@ -964,9 +976,9 @@ udevGetIfaceDef(struct udev *udev, const char *name)
/* MTU */
mtu_str = udev_device_get_sysattr_value(dev, "mtu");
- if (virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
+ if (!mtu_str || virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR,
- _("Could not parse MTU value '%1$s'"), mtu_str);
+ _("Could not parse MTU value '%1$s'"), NULLSTR(mtu_str));
goto error;
}
ifacedef->mtu = mtu;
@@ -1089,7 +1101,7 @@ udevInterfaceIsActive(virInterfacePtr ifinfo)
goto cleanup;
/* Check if it's active or not */
- status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
+ status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
udev_device_unref(dev);
--
2.43.0
@@ -1,49 +0,0 @@
From 98f1cf88fa7e0f992d93f376418fbfb3996a9690 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 17 May 2024 14:55:24 +0100
Subject: [PATCH] rpc: avoid leak of GSource in use for interrupting main loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We never release the reference on the GSource created for
interrupting the main loop, nor do we remove it from the
main context if our thread is woken up prior to the wakeup
callback firing.
This can result in a leak of GSource objects, along with an
ever growing list of GSources attached to the main context,
which will gradually slow down execution of the loop, as
several operations are O(N) for the number of attached GSource
objects.
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/rpc/virnetclient.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 147b0d661a..6d424eb599 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1946,7 +1946,7 @@ static int virNetClientIO(virNetClient *client,
/* Check to see if another thread is dispatching */
if (client->haveTheBuck) {
/* Force other thread to wakeup from poll */
- GSource *wakeup = g_idle_source_new();
+ g_autoptr(GSource) wakeup = g_idle_source_new();
g_source_set_callback(wakeup, virNetClientIOWakeup, client->eventLoop, NULL);
g_source_attach(wakeup, client->eventCtx);
@@ -1968,6 +1968,7 @@ static int virNetClientIO(virNetClient *client,
return -1;
}
+ g_source_destroy(wakeup);
VIR_DEBUG("Woken up from sleep head=%p call=%p",
client->waitDispatch, thiscall);
/* Three reasons we can be woken up
--
2.45.1
@@ -1,99 +0,0 @@
From 8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Apr 2024 11:51:15 +0100
Subject: [PATCH] rpc: ensure temporary GSource is removed from client event
loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Users are seeing periodic segfaults from libvirt client apps,
especially thread heavy ones like virt-manager. A typical
stack trace would end up in the virNetClientIOEventFD method,
with illegal access to stale stack data. eg
==238721==ERROR: AddressSanitizer: stack-use-after-return on address 0x75cd18709788 at pc 0x75cd3111f907 bp 0x75cd181ff550 sp 0x75cd181ff548
WRITE of size 4 at 0x75cd18709788 thread T11
#0 0x75cd3111f906 in virNetClientIOEventFD /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1634:15
#1 0x75cd3210d198 (/usr/lib/libglib-2.0.so.0+0x5a198) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#2 0x75cd3216c3be (/usr/lib/libglib-2.0.so.0+0xb93be) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#3 0x75cd3210ddc6 in g_main_loop_run (/usr/lib/libglib-2.0.so.0+0x5adc6) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#4 0x75cd3111a47c in virNetClientIOEventLoop /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1722:9
#5 0x75cd3111a47c in virNetClientIO /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2002:10
#6 0x75cd3111a47c in virNetClientSendInternal /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2170:11
#7 0x75cd311198a8 in virNetClientSendWithReply /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2198:11
#8 0x75cd31111653 in virNetClientProgramCall /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclientprogram.c:318:9
#9 0x75cd31241c8f in callFull /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6054:10
#10 0x75cd31241c8f in call /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6076:12
#11 0x75cd31241c8f in remoteNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/src/remote/remote_client_bodies.h:5959:9
#12 0x75cd31410ff7 in virNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/libvirt-network.c:952:15
The root cause is a bad assumption in the virNetClientIOEventLoop
method. This method is run by whichever thread currently owns the
buck, and is responsible for handling I/O. Inside a for(;;) loop,
this method creates a temporary GSource, adds it to the event loop
and runs g_main_loop_run(). When I/O is ready, the GSource callback
(virNetClientIOEventFD) will fire and call g_main_loop_quit(), and
return G_SOURCE_REMOVE which results in the temporary GSource being
destroyed. A g_autoptr() will then remove the last reference.
What was overlooked, is that a second thread can come along and
while it can't enter virNetClientIOEventLoop, it will register an
idle source that uses virNetClientIOWakeup to interrupt the
original thread's 'g_main_loop_run' call. When this happens the
virNetClientIOEventFD callback never runs, and so the temporary
GSource is not destroyed. The g_autoptr() will remove a reference,
but by virtue of still being attached to the event context, there
is an extra reference held causing GSource to be leaked. The
next time 'g_main_loop_run' is called, the original GSource will
trigger its callback, and access data that was allocated on the
stack by the previous thread, and likely SEGV.
To solve this, the thread calling 'g_main_loop_run' must call
g_source_destroy, immediately upon return, to guarantee that
the temporary GSource is removed.
CVE-2024-4418
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reported-by: Martin Shirokov <shirokovmartin@gmail.com>
Tested-by: Martin Shirokov <shirokovmartin@gmail.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/rpc/virnetclient.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 68098b1c8d..147b0d661a 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1657,7 +1657,7 @@ static int virNetClientIOEventLoop(virNetClient *client,
#endif /* !WIN32 */
int timeout = -1;
virNetMessage *msg = NULL;
- g_autoptr(GSource) G_GNUC_UNUSED source = NULL;
+ g_autoptr(GSource) source = NULL;
GIOCondition ev = 0;
struct virNetClientIOEventData data = {
.client = client,
@@ -1721,6 +1721,18 @@ static int virNetClientIOEventLoop(virNetClient *client,
g_main_loop_run(client->eventLoop);
+ /*
+ * If virNetClientIOEventFD ran, this GSource will already be
+ * destroyed due to G_SOURCE_REMOVE. It is harmless to re-destroy
+ * it, since we still own a reference.
+ *
+ * If virNetClientIOWakeup ran, it will have interrupted the
+ * g_main_loop_run call, before virNetClientIOEventFD could
+ * run, and thus the GSource is still registered, and we need
+ * to destroy it since it is referencing stack memory for 'data'
+ */
+ g_source_destroy(source);
+
#ifndef WIN32
ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL));
#endif /* !WIN32 */
--
2.45.1
@@ -1,76 +0,0 @@
From 7cb03e6a28e465c49f0cabe8fe2e7d21edb5aadf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 18 Dec 2023 12:17:18 +0000
Subject: [PATCH] rpc: fix race in waking up client event loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The first thread to issue a client RPC request will own the event
loop execution, sitting in the virNetClientIOEventLoop function.
It releases the client lock while running:
virNetClientUnlock()
g_main_loop_run()
virNetClientLock()
If a second thread arrives with an RPC request, it will queue it
for the first thread to process. To inform the first thread that
there's a new request it calls g_main_loop_quit() to break it out
of the main loop.
This works if the first thread is in g_main_loop_run() at that
time. There is a small window of opportunity, however, where
the first thread has released the client lock, but not yet got
into g_main_loop_run(). If that happens, the wakeup from the
second thread is lost.
This patch deals with that by changing the way the wakeup is
performed. Instead of directly calling g_main_loop_quit(), the
second thread creates an idle source to run the quit function
from within the first thread. This guarantees that the first
thread will see the wakeup.
Tested by: Fima Shevrin <efim.shevrin@virtuozzo.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/rpc/virnetclient.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 4ab8af68c5..68098b1c8d 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1848,6 +1848,15 @@ static void virNetClientIOUpdateCallback(virNetClient *client,
}
+static gboolean virNetClientIOWakeup(gpointer opaque)
+{
+ GMainLoop *loop = opaque;
+
+ g_main_loop_quit(loop);
+
+ return G_SOURCE_REMOVE;
+}
+
/*
* This function sends a message to remote server and awaits a reply
*
@@ -1925,7 +1934,9 @@ static int virNetClientIO(virNetClient *client,
/* Check to see if another thread is dispatching */
if (client->haveTheBuck) {
/* Force other thread to wakeup from poll */
- g_main_loop_quit(client->eventLoop);
+ GSource *wakeup = g_idle_source_new();
+ g_source_set_callback(wakeup, virNetClientIOWakeup, client->eventLoop, NULL);
+ g_source_attach(wakeup, client->eventCtx);
/* If we are non-blocking, detach the thread and keep the call in the
* queue. */
--
2.43.0
@@ -1,31 +0,0 @@
From c9056e682a8a67dc29e39eb01392fcf8ee978c31 Mon Sep 17 00:00:00 2001
From: Jonathan Wright <jonathan@almalinux.org>
Date: Wed, 3 Jan 2024 09:26:59 -0600
Subject: [PATCH] conf: Restore setting default bus for input devices
Prior to v9.3.0-rc1~30 we used to set default bus for <input/>
devices, during XML parsing. In the commit this code was moved to
a post parse callback. But somehow the line that sets the bus in
one specific case disappeared. Bring it back.
Resolves: https://gitlab.com/libvirt/libvirt/-/issues/577
Fixes: c4bc4d3b82fbe22e03c986ca896090f481df5c10
Signed-off-by: Jonathan Wright <jonathan@almalinux.org>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
---
src/conf/domain_postparse.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/conf/domain_postparse.c b/src/conf/domain_postparse.c
index e79913b73f..ee27023f3e 100644
--- a/src/conf/domain_postparse.c
+++ b/src/conf/domain_postparse.c
@@ -657,6 +657,7 @@ virDomainInputDefPostParse(virDomainInputDef *input,
if ((input->type == VIR_DOMAIN_INPUT_TYPE_MOUSE ||
input->type == VIR_DOMAIN_INPUT_TYPE_KBD) &&
(ARCH_IS_X86(def->os.arch) || def->os.arch == VIR_ARCH_NONE)) {
+ input->bus = VIR_DOMAIN_INPUT_BUS_PS2;
} else if (ARCH_IS_S390(def->os.arch) ||
input->type == VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH) {
input->bus = VIR_DOMAIN_INPUT_BUS_VIRTIO;
--
+709 -338
View File
File diff suppressed because it is too large Load Diff
+1 -1
View File
@@ -1 +1 @@
SHA512 (libvirt-9.7.0.tar.xz) = dd771822c0fa0861a32cab9d7f82235b101867fa0a4e8cf9a857ddfb2347e41b625b1e6f8791c4b3543fec836a1a23cae1fac4ce4b40debd51f2097bae46c949
SHA512 (libvirt-12.0.0.tar.xz) = 5613e4e59865f688fe4cca2734c6de1cf68d0540c6e3013c9c21e583accd4f4fc21ec98e9c794036c5d6d0c8dd05ad1d22dab61f8c7d2934c8cb507b5bee76ad