Compare commits

..

7 Commits

Author SHA1 Message Date
Mark McLoughlin 3a44160f46 * Fri Oct 9 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
- Fix libvirtd memory leak during error reply sending (#528162)
- Add several PCI hot-unplug typo fixes from upstream
2009-10-09 14:55:28 +00:00
Mark McLoughlin 5e8ea6c64c * Tue Oct 6 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
- Create /var/log/libvirt/{lxc,uml} dirs for logrotate
- Make libvirt-python dependon on libvirt-client
- Sync misc minor changes from upstream spec
2009-10-06 12:42:16 +00:00
Mark McLoughlin 00ce651fb8 * Tue Oct 6 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-9
- Change logrotate config to weekly (#526769)
2009-10-06 09:43:52 +00:00
Mark McLoughlin 3c684a55ed - Re-label qcow2 backing files (#497131) 2009-10-01 15:17:32 +00:00
Mark McLoughlin b1ea570e48 * Thu Oct 1 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
- Disable sound backend, even when selinux is disabled (#524499)
2009-10-01 08:35:16 +00:00
Mark McLoughlin 6ccf4c1a0c * Wed Sep 30 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-7
- Fix USB device passthrough (#522683)
2009-09-30 17:57:50 +00:00
Jesse Keating dbaa6786af Initialize branch F-12 for libvirt 2009-09-29 05:24:04 +00:00
27 changed files with 2966 additions and 2998 deletions
-31
View File
@@ -1,31 +0,0 @@
[suppress_function]
symbol_version_regexp = LIBVIRT_PRIVATE.*
soname_regexp = libvirt\\.so.*
[suppress_function]
symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
soname_regexp = libvirt-admin\\.so.*
[suppress_variable]
symbol_version_regexp = LIBVIRT_PRIVATE.*
soname_regexp = libvirt\\.so.*
[suppress_variable]
symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
soname_regexp = libvirt-admin\\.so.*
[suppress_function]
symbol_version_regexp = .*
soname_regexp = libvirt_storage_.*\\.so.*
[suppress_variable]
symbol_version_regexp = .*
soname_regexp = libvirt_storage_.*\\.so.*
[suppress_function]
symbol_version_regexp = .*
soname_regexp = libvirt_driver_.*\\.so.*
[suppress_variable]
symbol_version_regexp = .*
soname_regexp = libvirt_driver_.*\\.so.*
+13
View File
@@ -0,0 +1,13 @@
.build*.log
*.rpm
i686
x86_64
libvirt-*.tar.gz
libvirt-0.6.0.tar.gz
libvirt-0.6.1.tar.gz
libvirt-0.6.2.tar.gz
libvirt-0.6.3.tar.gz
libvirt-0.6.4.tar.gz
libvirt-0.6.5.tar.gz
libvirt-0.7.0.tar.gz
libvirt-0.7.1.tar.gz
-5
View File
@@ -1,5 +0,0 @@
.build*.log
*.rpm
i686
x86_64
libvirt-*.tar.xz
@@ -1,41 +0,0 @@
From 3499354e12a1c1832bf4030693a64e03ceb79d05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 5 Jun 2024 11:16:21 +0100
Subject: [PATCH] interface: fix udev reference leak with invalid flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The udevInterfaceGetXMLDesc method takes a reference on the udev
driver as its first action. If the virCheckFlags() condition
fails, however, this reference is never released.
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/interface/interface_backend_udev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index fdf11a8318..e1a50389c9 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -1027,12 +1027,14 @@ static char *
udevInterfaceGetXMLDesc(virInterfacePtr ifinfo,
unsigned int flags)
{
- struct udev *udev = udev_ref(driver->udev);
+ struct udev *udev = NULL;
g_autoptr(virInterfaceDef) ifacedef = NULL;
char *xmlstr = NULL;
virCheckFlags(VIR_INTERFACE_XML_INACTIVE, NULL);
+ udev = udev_ref(driver->udev);
+
/* Recursively build up the interface XML based on the requested
* interface name
*/
--
2.45.1
@@ -1,49 +0,0 @@
From 98f1cf88fa7e0f992d93f376418fbfb3996a9690 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 17 May 2024 14:55:24 +0100
Subject: [PATCH] rpc: avoid leak of GSource in use for interrupting main loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We never release the reference on the GSource created for
interrupting the main loop, nor do we remove it from the
main context if our thread is woken up prior to the wakeup
callback firing.
This can result in a leak of GSource objects, along with an
ever growing list of GSources attached to the main context,
which will gradually slow down execution of the loop, as
several operations are O(N) for the number of attached GSource
objects.
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/rpc/virnetclient.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 147b0d661a..6d424eb599 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1946,7 +1946,7 @@ static int virNetClientIO(virNetClient *client,
/* Check to see if another thread is dispatching */
if (client->haveTheBuck) {
/* Force other thread to wakeup from poll */
- GSource *wakeup = g_idle_source_new();
+ g_autoptr(GSource) wakeup = g_idle_source_new();
g_source_set_callback(wakeup, virNetClientIOWakeup, client->eventLoop, NULL);
g_source_attach(wakeup, client->eventCtx);
@@ -1968,6 +1968,7 @@ static int virNetClientIO(virNetClient *client,
return -1;
}
+ g_source_destroy(wakeup);
VIR_DEBUG("Woken up from sleep head=%p call=%p",
client->waitDispatch, thiscall);
/* Three reasons we can be woken up
--
2.45.1
@@ -1,99 +0,0 @@
From 8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Apr 2024 11:51:15 +0100
Subject: [PATCH] rpc: ensure temporary GSource is removed from client event
loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Users are seeing periodic segfaults from libvirt client apps,
especially thread heavy ones like virt-manager. A typical
stack trace would end up in the virNetClientIOEventFD method,
with illegal access to stale stack data. eg
==238721==ERROR: AddressSanitizer: stack-use-after-return on address 0x75cd18709788 at pc 0x75cd3111f907 bp 0x75cd181ff550 sp 0x75cd181ff548
WRITE of size 4 at 0x75cd18709788 thread T11
#0 0x75cd3111f906 in virNetClientIOEventFD /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1634:15
#1 0x75cd3210d198 (/usr/lib/libglib-2.0.so.0+0x5a198) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#2 0x75cd3216c3be (/usr/lib/libglib-2.0.so.0+0xb93be) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#3 0x75cd3210ddc6 in g_main_loop_run (/usr/lib/libglib-2.0.so.0+0x5adc6) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
#4 0x75cd3111a47c in virNetClientIOEventLoop /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1722:9
#5 0x75cd3111a47c in virNetClientIO /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2002:10
#6 0x75cd3111a47c in virNetClientSendInternal /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2170:11
#7 0x75cd311198a8 in virNetClientSendWithReply /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2198:11
#8 0x75cd31111653 in virNetClientProgramCall /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclientprogram.c:318:9
#9 0x75cd31241c8f in callFull /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6054:10
#10 0x75cd31241c8f in call /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6076:12
#11 0x75cd31241c8f in remoteNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/src/remote/remote_client_bodies.h:5959:9
#12 0x75cd31410ff7 in virNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/libvirt-network.c:952:15
The root cause is a bad assumption in the virNetClientIOEventLoop
method. This method is run by whichever thread currently owns the
buck, and is responsible for handling I/O. Inside a for(;;) loop,
this method creates a temporary GSource, adds it to the event loop
and runs g_main_loop_run(). When I/O is ready, the GSource callback
(virNetClientIOEventFD) will fire and call g_main_loop_quit(), and
return G_SOURCE_REMOVE which results in the temporary GSource being
destroyed. A g_autoptr() will then remove the last reference.
What was overlooked, is that a second thread can come along and
while it can't enter virNetClientIOEventLoop, it will register an
idle source that uses virNetClientIOWakeup to interrupt the
original thread's 'g_main_loop_run' call. When this happens the
virNetClientIOEventFD callback never runs, and so the temporary
GSource is not destroyed. The g_autoptr() will remove a reference,
but by virtue of still being attached to the event context, there
is an extra reference held causing GSource to be leaked. The
next time 'g_main_loop_run' is called, the original GSource will
trigger its callback, and access data that was allocated on the
stack by the previous thread, and likely SEGV.
To solve this, the thread calling 'g_main_loop_run' must call
g_source_destroy, immediately upon return, to guarantee that
the temporary GSource is removed.
CVE-2024-4418
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reported-by: Martin Shirokov <shirokovmartin@gmail.com>
Tested-by: Martin Shirokov <shirokovmartin@gmail.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
src/rpc/virnetclient.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 68098b1c8d..147b0d661a 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -1657,7 +1657,7 @@ static int virNetClientIOEventLoop(virNetClient *client,
#endif /* !WIN32 */
int timeout = -1;
virNetMessage *msg = NULL;
- g_autoptr(GSource) G_GNUC_UNUSED source = NULL;
+ g_autoptr(GSource) source = NULL;
GIOCondition ev = 0;
struct virNetClientIOEventData data = {
.client = client,
@@ -1721,6 +1721,18 @@ static int virNetClientIOEventLoop(virNetClient *client,
g_main_loop_run(client->eventLoop);
+ /*
+ * If virNetClientIOEventFD ran, this GSource will already be
+ * destroyed due to G_SOURCE_REMOVE. It is harmless to re-destroy
+ * it, since we still own a reference.
+ *
+ * If virNetClientIOWakeup ran, it will have interrupted the
+ * g_main_loop_run call, before virNetClientIOEventFD could
+ * run, and thus the GSource is still registered, and we need
+ * to destroy it since it is referencing stack memory for 'data'
+ */
+ g_source_destroy(source);
+
#ifndef WIN32
ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL));
#endif /* !WIN32 */
--
2.45.1
@@ -1,35 +0,0 @@
From adfdb79f1e01401349e1321d0f5059d7b6489f00 Mon Sep 17 00:00:00 2001
Message-ID: <adfdb79f1e01401349e1321d0f5059d7b6489f00.1724763718.git.crobinso@redhat.com>
From: Martin Kletzander <mkletzan@redhat.com>
Date: Fri, 16 Aug 2024 13:56:51 +0200
Subject: [PATCH 1/3] virarptable: Properly calculate rtattr length
Content-type: text/plain
Use convenience macro which does almost the same thing we were doing,
but also pads out the payload length to a multiple of NLMSG_ALIGNTO (4)
bytes.
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
---
src/util/virarptable.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
index 299dddd664..d8e41c5a86 100644
--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
@@ -102,8 +102,7 @@ virArpTableGet(void)
return table;
VIR_WARNINGS_NO_CAST_ALIGN
- parse_rtattr(tb, NDA_MAX, NDA_RTA(r),
- nh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
+ parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
VIR_WARNINGS_RESET
if (tb[NDA_DST] == NULL || tb[NDA_LLADDR] == NULL)
--
2.46.0
@@ -1,42 +0,0 @@
From 137779b894858bd958ea575cec260a0559b31e48 Mon Sep 17 00:00:00 2001
Message-ID: <137779b894858bd958ea575cec260a0559b31e48.1724763718.git.crobinso@redhat.com>
In-Reply-To: <adfdb79f1e01401349e1321d0f5059d7b6489f00.1724763718.git.crobinso@redhat.com>
References: <adfdb79f1e01401349e1321d0f5059d7b6489f00.1724763718.git.crobinso@redhat.com>
From: Martin Kletzander <mkletzan@redhat.com>
Date: Fri, 16 Aug 2024 13:59:15 +0200
Subject: [PATCH 2/3] virarptable: Fix check for message length
Content-type: text/plain
The previous check was all wrong since it calculated the how long would
the netlink message be if the netlink header was the payload and then
subtracted that from the whole message length, a variable that was not
used later in the code. This check can fail if there are no additional
payloads, struct rtattr in particular, which we are parsing later,
however the RTA_OK macro would've caught that anyway.
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
---
src/util/virarptable.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
index d8e41c5a86..45ee76766f 100644
--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
@@ -81,10 +81,9 @@ virArpTableGet(void)
for (; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen)) {
VIR_WARNINGS_RESET
struct ndmsg *r = NLMSG_DATA(nh);
- int len = nh->nlmsg_len;
void *addr;
- if ((len -= NLMSG_LENGTH(sizeof(*nh))) < 0) {
+ if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("wrong nlmsg len"));
goto cleanup;
--
2.46.0
@@ -1,54 +0,0 @@
From df2cefb31dab2fa56e0864fbd2b8ad468dee22c0 Mon Sep 17 00:00:00 2001
Message-ID: <df2cefb31dab2fa56e0864fbd2b8ad468dee22c0.1724763718.git.crobinso@redhat.com>
In-Reply-To: <adfdb79f1e01401349e1321d0f5059d7b6489f00.1724763718.git.crobinso@redhat.com>
References: <adfdb79f1e01401349e1321d0f5059d7b6489f00.1724763718.git.crobinso@redhat.com>
From: Martin Kletzander <mkletzan@redhat.com>
Date: Fri, 16 Aug 2024 14:02:48 +0200
Subject: [PATCH 3/3] virarptable: End parsing earlier in case of NLMSG_DONE
Content-type: text/plain
Check for the last multipart message right as the first thing. The
presumption probably was that the last message might still contain a
payload we want to parse. However that cannot be true since that would
have to be a type RTM_NEWNEIGH. This was not caught because older
kernels were note sending NLMSG_DONE and probably relied on the fact
that the parsing just stops after all the messages are walked through,
which the NLMSG_OK macro successfully did.
Resolves: https://issues.redhat.com/browse/RHEL-52449
Resolves: https://bugzilla.redhat.com/2302245
Fixes: a176d67cdfaf5b8237a7e3a80d8be0e6bdf2d8fd
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
---
src/util/virarptable.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
index 45ee76766f..20d11f97b0 100644
--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
@@ -83,6 +83,9 @@ virArpTableGet(void)
struct ndmsg *r = NLMSG_DATA(nh);
void *addr;
+ if (nh->nlmsg_type == NLMSG_DONE)
+ break;
+
if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("wrong nlmsg len"));
@@ -97,9 +100,6 @@ virArpTableGet(void)
(!(r->ndm_state == NUD_STALE || r->ndm_state == NUD_REACHABLE)))
continue;
- if (nh->nlmsg_type == NLMSG_DONE)
- return table;
-
VIR_WARNINGS_NO_CAST_ALIGN
parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
VIR_WARNINGS_RESET
--
2.46.0
+21
View File
@@ -0,0 +1,21 @@
# Makefile for source rpm: libvirt
# $Id$
NAME := libvirt
SPECFILE = $(firstword $(wildcard *.spec))
define find-makefile-common
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
endef
MAKEFILE_COMMON := $(shell $(find-makefile-common))
ifeq ($(MAKEFILE_COMMON),)
# attempt a checkout
define checkout-makefile-common
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
endef
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
endif
include $(MAKEFILE_COMMON)
+1
View File
@@ -0,0 +1 @@
F-12
-31
View File
@@ -1,31 +0,0 @@
From 4c5b2e1e0d0d0cbbf8c6ed28ce77d055d5974f7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
Date: Wed, 6 Mar 2024 17:26:40 +0100
Subject: [PATCH] qemu: virtiofs: set correct label when creating the socket
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Use svirt_t instead of virtd_t, since virtd_t is not available in the
session mode and qemu with svirt_t won't be able to talk to unconfined_t
socket.
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
---
src/qemu/qemu_virtiofs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c
index 15dea3bb57f..d80cddd3ba9 100644
--- a/src/qemu/qemu_virtiofs.c
+++ b/src/qemu/qemu_virtiofs.c
@@ -102,7 +102,7 @@ qemuVirtioFSOpenChardev(virQEMUDriver *driver,
chrdev->data.nix.listen = true;
chrdev->data.nix.path = g_strdup(socket_path);
- if (qemuSecuritySetDaemonSocketLabel(driver->securityManager, vm->def) < 0)
+ if (qemuSecuritySetSocketLabel(driver->securityManager, vm->def) < 0)
goto cleanup;
fd = qemuOpenChrChardevUNIXSocket(chrdev);
if (fd < 0) {
@@ -0,0 +1,34 @@
From bcd4180124afa20580d720912e2179b3a2f9295a Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Mon, 5 Oct 2009 17:03:14 +0200
Subject: [PATCH] 526769 change logrotate config default to weekly
* daemon/libvirtd.logrotate.in: change to weekly rotation of logs,
keep a month worth of data and also extend to cover LXC and UML
domain logs
(cherry picked from commit 529325bbdd050af89bda5a5c1a01b5553c49a57e)
Fedora-patch: libvirt-change-logrotate-config-to-weekly.patch
---
qemud/libvirtd.logrotate.in | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/qemud/libvirtd.logrotate.in b/qemud/libvirtd.logrotate.in
index 9b42630..093651c 100644
--- a/qemud/libvirtd.logrotate.in
+++ b/qemud/libvirtd.logrotate.in
@@ -1,7 +1,7 @@
-@localstatedir@/log/libvirt/qemu/*.log {
- daily
+@localstatedir@/log/libvirt/qemu/*.log @localstatedir@/log/libvirt/uml/*.log @localstatedir@/log/libvirt/lxc/*.log {
+ weekly
missingok
- rotate 7
+ rotate 4
compress
delaycompress
copytruncate
--
1.6.2.5
+77
View File
@@ -0,0 +1,77 @@
From 4721ceb9b85daabe53804627473b06ced821c695 Mon Sep 17 00:00:00 2001
From: Daniel P. Berrange <berrange@redhat.com>
Date: Mon, 14 Sep 2009 11:23:20 +0100
Subject: [PATCH] Allow control over QEMU audio backend
When using VNC for graphics + keyboard + mouse, we shouldn't
then use the host OS for audio. Audio should go back over
VNC.
When using SDL for graphics, we should use the host OS for
audio since that's where the display is. We need to allow
certain QEMU env variables to be passed through to guest
too to allow choice of QEMU audio backend.
* qemud/libvirtd.sysconf: Mention QEMU/SDL audio env vars
* src/qemu_conf.c: Passthrough QEMU/SDL audio env for SDL display,
disable host audio for VNC display
(cherry picked from commit b08e6d38ae7a0ed70300d7d82107f83fddb60f44)
Fedora-patch: libvirt-disable-audio-backend.patch
---
qemud/libvirtd.sysconf | 8 ++++++++
src/qemu_conf.c | 14 ++++++++++++++
2 files changed, 22 insertions(+), 0 deletions(-)
diff --git a/qemud/libvirtd.sysconf b/qemud/libvirtd.sysconf
index fe4596a..28080a0 100644
--- a/qemud/libvirtd.sysconf
+++ b/qemud/libvirtd.sysconf
@@ -7,3 +7,11 @@
# Override Kerberos service keytab for SASL/GSSAPI
#KRB5_KTNAME=/etc/libvirt/krb5.tab
+
+# Override the QEMU/SDL default audio driver probing when
+# starting virtual machines using SDL graphics
+#
+# NB these have no effect for VMs using VNC
+#QEMU_AUDIO_DRV=sdl
+#
+#SDL_AUDIODRIVER=pulse
diff --git a/src/qemu_conf.c b/src/qemu_conf.c
index f92bcef..0dd0624 100644
--- a/src/qemu_conf.c
+++ b/src/qemu_conf.c
@@ -2109,6 +2109,13 @@ int qemudBuildCommandLine(virConnectPtr conn,
ADD_ARG_LIT("-k");
ADD_ARG_LIT(def->graphics[0]->data.vnc.keymap);
}
+
+ /* QEMU implements a VNC extension for providing audio, so we
+ * set the audio backend to none, to prevent it opening the
+ * host OS audio devices since that causes security issues
+ * and is non-sensical when using VNC.
+ */
+ ADD_ENV_LIT("QEMU_AUDIO_DRV=none");
} else if ((def->ngraphics == 1) &&
def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) {
char *xauth = NULL;
@@ -2131,6 +2138,13 @@ int qemudBuildCommandLine(virConnectPtr conn,
ADD_ENV(display);
if (def->graphics[0]->data.sdl.fullscreen)
ADD_ARG_LIT("-full-screen");
+
+ /* If using SDL for video, then we should just let it
+ * use QEMU's host audio drivers, possibly SDL too
+ * User can set these two before starting libvirtd
+ */
+ ADD_ENV_COPY("QEMU_AUDIO_DRV");
+ ADD_ENV_COPY("SDL_AUDIODRIVER");
}
if (def->nvideos) {
--
1.6.2.5
+29
View File
@@ -0,0 +1,29 @@
From 58c38896a67c170063401d8091bae7dca8842923 Mon Sep 17 00:00:00 2001
From: Jiri Denemark <jdenemar@redhat.com>
Date: Wed, 23 Sep 2009 18:46:23 +0200
Subject: [PATCH] Fix a typo in virDiskHasValidPciAddr()
(cherry-picked from commit 3620e3cdcfe56cc4475b5ef1a0a893757240b795)
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Fedora-patch: libvirt-fix-device-detach-typo1.patch
---
src/domain_conf.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/domain_conf.h b/src/domain_conf.h
index 09368d9..d494e54 100644
--- a/src/domain_conf.h
+++ b/src/domain_conf.h
@@ -125,7 +125,7 @@ struct _virDomainDiskDef {
static inline int
virDiskHasValidPciAddr(virDomainDiskDefPtr def)
{
- return def->pci_addr.domain || def->pci_addr.domain || def->pci_addr.slot;
+ return def->pci_addr.domain || def->pci_addr.bus || def->pci_addr.slot;
}
--
1.6.2.5
+30
View File
@@ -0,0 +1,30 @@
From 81e967c716ce8c085be8baad9169f7772452d187 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Thu, 24 Sep 2009 08:55:55 +0100
Subject: [PATCH] Fix a typo in virNetHasValidPciAddr() too
* src/domain_conf.h: check domain/bus/slot, not domain/domain/slot
(cherry-picked from commit 6bfffce91635bb08de601747e94ed1182c0f47eb)
Fedora-patch: libvirt-fix-device-detach-typo2.patch
---
src/domain_conf.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/domain_conf.h b/src/domain_conf.h
index d494e54..7c918a7 100644
--- a/src/domain_conf.h
+++ b/src/domain_conf.h
@@ -207,7 +207,7 @@ struct _virDomainNetDef {
static inline int
virNetHasValidPciAddr(virDomainNetDefPtr def)
{
- return def->pci_addr.domain || def->pci_addr.domain || def->pci_addr.slot;
+ return def->pci_addr.domain || def->pci_addr.bus || def->pci_addr.slot;
}
enum virDomainChrSrcType {
--
1.6.2.5
+30
View File
@@ -0,0 +1,30 @@
From 3a64779ec5a89d38d64e07bca2b11b19e1882d7a Mon Sep 17 00:00:00 2001
From: Charles Duffy <charles@dyfis.net>
Date: Thu, 24 Sep 2009 09:00:24 +0100
Subject: [PATCH] Fix unitialized variable in qemudDomainDetachHostPciDevice()
* src/qemu_driver.c: initialize detach var
(cherry-picked from commit 580ad29288751234bee47ac9f6c04dac1dc529ea)
Fedora-patch: libvirt-fix-device-detach-typo3.patch
---
src/qemu_driver.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index 7c7b985..550a59c 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -6126,7 +6126,7 @@ static int qemudDomainDetachHostPciDevice(virConnectPtr conn,
virDomainObjPtr vm,
virDomainDeviceDefPtr dev)
{
- virDomainHostdevDefPtr detach;
+ virDomainHostdevDefPtr detach = NULL;
char *cmd, *reply;
int i, ret;
pciDevice *pci;
--
1.6.2.5
@@ -0,0 +1,32 @@
From 7692e1e19487c28454b1e5f6488d5574c70883f2 Mon Sep 17 00:00:00 2001
From: Chris Lalancette <clalance@redhat.com>
Date: Mon, 21 Sep 2009 14:53:31 +0200
Subject: [PATCH] Don't do virSetConnError when virDrvSupportsFeature is successful.
Signed-off-by: Chris Lalancette <clalance@redhat.com>
Fedora-patch: libvirt-fix-drv-supports-feature-bogus-error.patch
---
src/libvirt.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/libvirt.c b/src/libvirt.c
index 4a11688..fa59dc7 100644
--- a/src/libvirt.c
+++ b/src/libvirt.c
@@ -1349,8 +1349,11 @@ virDrvSupportsFeature (virConnectPtr conn, int feature)
}
ret = VIR_DRV_SUPPORTS_FEATURE (conn->driver, conn, feature);
- /* Copy to connection error object for back compatability */
- virSetConnError(conn);
+
+ if (ret < 0)
+ /* Copy to connection error object for back compatability */
+ virSetConnError(conn);
+
return ret;
}
--
1.6.2.5
@@ -0,0 +1,79 @@
From 71de8d92f20a9a9ee76d4d5df77ff477f1b7d441 Mon Sep 17 00:00:00 2001
From: Matthias Bolte <matthias.bolte@googlemail.com>
Date: Wed, 30 Sep 2009 02:17:27 +0200
Subject: [PATCH] Fix memory leaks in libvirtd's message processing
Commit 47cab734995fa9521b1df05d37e9978eedd8d3a2 changed the way how
qemud_client_message objects were reused. Before this commit
remoteDispatchClientRequest() reused the received message for normal responses
and to report non-fatal errors. If a fatal error occurred qemudWorker() frees
the message. After this commit non-fatal errors are reported by
remoteSerializeReplyError() using a new qemud_client_message object and the
original message leaks.
To fix this leak the original message has to be freed if
remoteSerializeReplyError() succeeds. If remoteSerializeReplyError()
fails the original message is freed in qemudWorker().
* daemon/dispatch.c: free qemud_client_message objects that will not be reused
and would leak otherwise, also free the allocated qemud_client_message object
in remoteSerializeError() if an error occurs
(cherry-picked from commit c6f1459eb998619ab21a92d9bb87341f26978181)
Fedora-patch: libvirt-fix-libvirtd-leak-in-error-reply.patch
---
qemud/dispatch.c | 15 +++++++++++++--
1 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/qemud/dispatch.c b/qemud/dispatch.c
index a60f2f4..ddb3215 100644
--- a/qemud/dispatch.c
+++ b/qemud/dispatch.c
@@ -191,6 +191,7 @@ remoteSerializeError(struct qemud_client *client,
xdr_error:
xdr_destroy(&xdr);
+ VIR_FREE(msg);
fatal_error:
xdr_free((xdrproc_t)xdr_remote_error, (char *)rerr);
return -1;
@@ -336,6 +337,7 @@ remoteDispatchClientRequest (struct qemud_server *server,
struct qemud_client *client,
struct qemud_client_message *msg)
{
+ int ret;
remote_error rerr;
memset(&rerr, 0, sizeof rerr);
@@ -364,7 +366,12 @@ remoteDispatchClientRequest (struct qemud_server *server,
}
error:
- return remoteSerializeReplyError(client, &rerr, &msg->hdr);
+ ret = remoteSerializeReplyError(client, &rerr, &msg->hdr);
+
+ if (ret >= 0)
+ VIR_FREE(msg);
+
+ return ret;
}
@@ -521,8 +528,12 @@ remoteDispatchClientCall (struct qemud_server *server,
rpc_error:
/* Semi-bad stuff happened, we can still try to send back
* an RPC error message to client */
- return remoteSerializeReplyError(client, &rerr, &msg->hdr);
+ rv = remoteSerializeReplyError(client, &rerr, &msg->hdr);
+
+ if (rv >= 0)
+ VIR_FREE(msg);
+ return rv;
xdr_error:
/* Seriously bad stuff happened, so we'll kill off this client
--
1.6.2.5
@@ -0,0 +1,46 @@
From ba585ed6cff624c6c0f1f9801382fd6846466ee0 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Thu, 17 Sep 2009 15:31:08 +0100
Subject: [PATCH] Fix net/disk hot-unplug segfault
When we hot-unplug the last device, we're currently double-freeing
the device definition.
Reported by Michal Nowak here:
https://bugzilla.redhat.com/523953
* src/qemu_driver.c: fix double free
(cherry-picked from commit 8881ae1bf8783006777429403cc543c33187175d)
Fedora-patch: libvirt-fix-net-hotunplug-double-free.patch
---
src/qemu_driver.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index a65334f..de31581 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -5998,7 +5998,7 @@ try_command:
/* ignore, harmless */
}
} else {
- VIR_FREE(vm->def->disks[0]);
+ VIR_FREE(vm->def->disks);
vm->def->ndisks = 0;
}
virDomainDiskDefFree(detach);
@@ -6100,7 +6100,7 @@ qemudDomainDetachNetDevice(virConnectPtr conn,
/* ignore, harmless */
}
} else {
- VIR_FREE(vm->def->nets[0]);
+ VIR_FREE(vm->def->nets);
vm->def->nnets = 0;
}
virDomainNetDefFree(detach);
--
1.6.2.5
@@ -0,0 +1,50 @@
From 17831d20051f8de8f1f7d661e8a23f4fe67c2153 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Thu, 17 Sep 2009 15:32:45 +0100
Subject: [PATCH] Fix leak in PCI hostdev hot-unplug
* src/qemu_driver.c: sync the hostdev hot-unplug code with the disk/net
code.
(cherry-picked from commit a70da51ff76ed860bfc0cdee2e1d556da997c557)
Fedora-patch: libvirt-fix-pci-hostdev-hotunplug-leak.patch
---
src/qemu_driver.c | 20 +++++++++++++-------
1 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index de31581..2ddcdc0 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -6206,14 +6206,20 @@ static int qemudDomainDetachHostPciDevice(virConnectPtr conn,
pciFreeDevice(conn, pci);
}
- if (i != --vm->def->nhostdevs)
- memmove(&vm->def->hostdevs[i],
- &vm->def->hostdevs[i+1],
- sizeof(*vm->def->hostdevs) * (vm->def->nhostdevs-i));
- if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) {
- virReportOOMError(conn);
- ret = -1;
+ if (vm->def->nhostdevs > 1) {
+ memmove(vm->def->hostdevs + i,
+ vm->def->hostdevs + i + 1,
+ sizeof(*vm->def->hostdevs) *
+ (vm->def->nhostdevs - (i + 1)));
+ vm->def->nhostdevs--;
+ if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) {
+ /* ignore, harmless */
+ }
+ } else {
+ VIR_FREE(vm->def->hostdevs);
+ vm->def->nhostdevs = 0;
}
+ virDomainHostdevDefFree(detach);
return ret;
}
--
1.6.2.5
+53
View File
@@ -0,0 +1,53 @@
From f1be5a4714e194a84840343e0937fe62463a18dc Mon Sep 17 00:00:00 2001
From: Charles Duffy <Charles_Duffy@dell.com>
Date: Fri, 18 Sep 2009 11:32:35 -0500
Subject: [PATCH] Prevent attempt to call cat -c during virDomainSave to raw
Fedora-patch: libvirt-fix-qemu-raw-format-save.patch
---
src/qemu_driver.c | 28 ++++++++++++++++++----------
1 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index 2ddcdc0..7c7b985 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -3905,17 +3905,25 @@ static int qemudDomainSave(virDomainPtr dom,
goto cleanup;
}
- const char *prog = qemudSaveCompressionTypeToString(header.compressed);
- if (prog == NULL) {
- qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR,
- _("Invalid compress format %d"), header.compressed);
- goto cleanup;
- }
+ {
+ const char *prog = qemudSaveCompressionTypeToString(header.compressed);
+ const char *args;
- if (STREQ (prog, "raw"))
- prog = "cat";
- internalret = virAsprintf(&command, "migrate \"exec:"
- "%s -c >> '%s' 2>/dev/null\"", prog, safe_path);
+ if (prog == NULL) {
+ qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR,
+ _("Invalid compress format %d"), header.compressed);
+ goto cleanup;
+ }
+
+ if (STREQ (prog, "raw")) {
+ prog = "cat";
+ args = "";
+ } else {
+ args = "-c";
+ }
+ internalret = virAsprintf(&command, "migrate \"exec:"
+ "%s %s >> '%s' 2>/dev/null\"", prog, args, safe_path);
+ }
if (internalret < 0) {
virReportOOMError(dom->conn);
--
1.6.2.5
+41
View File
@@ -0,0 +1,41 @@
From 6b12148864cf6a1d22a2cf4e0e9c48e9946331cb Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Wed, 30 Sep 2009 18:37:03 +0100
Subject: [PATCH] Fix USB device re-labelling
A simple misplaced break out of a switch results in:
libvir: error : Failed to open file '/sys/bus/pci/devices/0000:00:54c./vendor': No such file or directory
libvir: error : Failed to open file '/sys/bus/pci/devices/0000:00:54c./device': No such file or directory
libvir: error : this function is not supported by the hypervisor: Failed to read product/vendor ID for 0000:00:54c.
when trying to passthrough a USB host device to qemu.
* src/security_selinux.c: fix a switch/break thinko
Fedora-patch: libvirt-fix-usb-device-passthrough.patch
---
src/security_selinux.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/src/security_selinux.c b/src/security_selinux.c
index bc295b1..b4dc153 100644
--- a/src/security_selinux.c
+++ b/src/security_selinux.c
@@ -464,12 +464,11 @@ SELinuxSetSecurityHostdevLabel(virConnectPtr conn,
ret = usbDeviceFileIterate(conn, usb, SELinuxSetSecurityUSBLabel, vm);
usbFreeDevice(conn, usb);
-
- break;
} else {
/* XXX deal with product/vendor better */
ret = 0;
}
+ break;
}
case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: {
--
1.6.2.5
@@ -0,0 +1,54 @@
From b7e3ac4f23befe67518b57e34691c301820a436c Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@redhat.com>
Date: Tue, 6 Oct 2009 12:33:17 +0100
Subject: [PATCH] Create /var/log/libvirt/{lxc,uml} dirs
Otherwise logrotate barfs:
error: error accessing /var/log/libvirt/uml: No such file or directory
error: libvirtd:1 glob failed for /var/log/libvirt/uml/*.log
error: found error in /var/log/libvirt/qemu/*.log /var/log/libvirt/uml/*.log /var/log/libvirt/lxc/*.log , skipping
* qemud/Makefile.am: always create /var/log/libvirt/{lxc,uml} when
installing the logrotate conf; not ideal, but easier than making
the logrotate conf depend on which drivers are enabled
Fedora-patch: libvirt-logrotate-create-lxc-uml-dirs.patch
---
qemud/Makefile.am | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/qemud/Makefile.am b/qemud/Makefile.am
index 3d143da..a7f4bdf 100644
--- a/qemud/Makefile.am
+++ b/qemud/Makefile.am
@@ -176,7 +176,7 @@ install-data-local: install-init install-data-sasl install-data-polkit \
test -e $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml || \
ln -s ../default.xml \
$(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml
- mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt/qemu
+ mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt
mkdir -p $(DESTDIR)$(localstatedir)/run/libvirt
mkdir -p $(DESTDIR)$(localstatedir)/lib/libvirt
@@ -184,7 +184,7 @@ uninstall-local:: uninstall-init uninstall-data-sasl install-data-polkit
rm -f $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml
rm -f $(DESTDIR)$(sysconfdir)/$(default_xml_dest)
rmdir $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart || :
- rmdir $(DESTDIR)$(localstatedir)/log/libvirt/qemu || :
+ rmdir $(DESTDIR)$(localstatedir)/log/libvirt || :
rmdir $(DESTDIR)$(localstatedir)/run/libvirt || :
rmdir $(DESTDIR)$(localstatedir)/lib/libvirt || :
@@ -240,6 +240,8 @@ libvirtd.logrotate: libvirtd.logrotate.in
install-logrotate: libvirtd.logrotate
mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt/qemu/
+ mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt/lxc/
+ mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt/uml/
mkdir -p $(DESTDIR)$(sysconfdir)/logrotate.d/
$(INSTALL_DATA) $< $(DESTDIR)$(sysconfdir)/logrotate.d/libvirtd
--
1.6.2.5
File diff suppressed because it is too large Load Diff
+973 -2610
View File
File diff suppressed because it is too large Load Diff
+1 -1
View File
@@ -1 +1 @@
SHA512 (libvirt-10.1.0.tar.xz) = 08e73ae15de5681430b62db85ec9901242dca5e9a4ca9685614f4a67092c6e28f27f9187144b3ceb18ad6b40e6eb1a90b1a4b056b0888724d04a62002ee2bc48
f1cd360a5da38b847e166c6482141940 libvirt-0.7.1.tar.gz