add ARM to NUMA platform exlcludes

Fix for CVE-2011-2178, regression introduced in disk probe logic,
Bug 709775

.cvsignore

@@ -1,24 +0,0 @@
-libvirt-0.0.3.tar.gz
-libvirt-0.0.4.tar.gz
-libvirt-0.0.5.tar.gz
-libvirt-0.0.6.tar.gz
-libvirt-0.1.0.tar.gz
-libvirt-0.1.2.tar.gz
-libvirt-0.1.1.tar.gz
-libvirt-0.1.3.tar.gz
-libvirt-0.1.4.tar.gz
-libvirt-0.1.5.tar.gz
-libvirt-0.1.6.tar.gz
-libvirt-0.1.7.tar.gz
-libvirt-0.1.8.tar.gz
-libvirt-0.1.9.tar.gz
-libvirt-0.1.10.tar.gz
-libvirt-0.1.11.tar.gz
-libvirt-0.2.0.tar.gz
-libvirt-0.2.1.tar.gz
-libvirt-0.2.2.tar.gz
-libvirt-0.2.3.tar.gz
-libvirt-0.3.0.tar.gz
-libvirt-0.3.1.tar.gz
-libvirt-0.3.2.tar.gz
-libvirt-0.3.3.tar.gz

.gitignore

@@ -0,0 +1,5 @@
+.build*.log
+*.rpm
+i686
+x86_64
+libvirt-*.tar.gz

Makefile

@@ -4,7 +4,7 @@ NAME := libvirt
 SPECFILE = $(firstword $(wildcard *.spec))
 
 define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
 endef
 
 MAKEFILE_COMMON := $(shell $(find-makefile-common))

branch

@@ -1 +0,0 @@
-F-8

libvirt-0.4.1-daemon-startup.patch

@@ -1,48 +0,0 @@
-diff -rup libvirt-0.4.1.orig/qemud/qemud.c libvirt-0.4.1.new/qemud/qemud.c
---- libvirt-0.4.1.orig/qemud/qemud.c	2008-03-10 17:31:09.000000000 -0400
-+++ libvirt-0.4.1.new/qemud/qemud.c	2008-03-10 17:31:36.000000000 -0400
-@@ -393,7 +393,7 @@ static int qemudGoDaemon(void) {
-             case -1:
-                 return -1;
-             default:
--                return nextpid;
-+                _exit(0);
-             }
- 
-         cleanup:
-@@ -418,8 +418,7 @@ static int qemudGoDaemon(void) {
-                 status != 0) {
-                 return -1;
-             }
--
--            return pid;
-+            _exit(0);
-         }
-     }
- }
-@@ -2116,16 +2115,12 @@ int main(int argc, char **argv) {
-         goto error1;
- 
-     if (godaemon) {
--        int pid;
-         openlog("libvirtd", 0, 0);
--        pid = qemudGoDaemon();
--        if (pid < 0) {
-+        if (qemudGoDaemon() < 0) {
-             qemudLog(QEMUD_ERR, _("Failed to fork as daemon: %s"),
-                      strerror(errno));
-             goto error1;
-         }
--        if (pid > 0)
--            goto out;
- 
-         /* Choose the name of the PID file. */
-         if (!pid_file) {
-@@ -2172,7 +2167,6 @@ int main(int argc, char **argv) {
-     if (godaemon)
-         closelog();
- 
-- out:
-     ret = 0;
- 
-  error2:

libvirt-0.4.1-polkit.patch

@@ -1,400 +0,0 @@
-diff -rup libvirt-0.4.1.orig/configure.in libvirt-0.4.1.new/configure.in
---- libvirt-0.4.1.orig/configure.in	2008-03-03 09:14:19.000000000 -0500
-+++ libvirt-0.4.1.new/configure.in	2008-04-03 15:37:49.000000000 -0400
-@@ -450,10 +450,6 @@ if test "x$with_polkit" = "xyes" -o "x$w
-     CFLAGS="$old_CFLAGS"
-     LDFLAGS="$old_LDFLAGS"
- 
--    AC_PATH_PROG(POLKIT_GRANT, polkit-grant)
--    if test "x$POLKIT_GRANT" != "x"; then
--      AC_DEFINE_UNQUOTED([POLKIT_GRANT],["$POLKIT_GRANT"],[Location of polkit-grant program])
--    fi
-     AC_PATH_PROG(POLKIT_AUTH, polkit-auth)
-     if test "x$POLKIT_AUTH" != "x"; then
-       AC_DEFINE_UNQUOTED([POLKIT_AUTH],["$POLKIT_AUTH"],[Location of polkit-auth program])
-diff -rup libvirt-0.4.1.orig/qemud/internal.h libvirt-0.4.1.new/qemud/internal.h
---- libvirt-0.4.1.orig/qemud/internal.h	2008-01-24 12:07:43.000000000 -0500
-+++ libvirt-0.4.1.new/qemud/internal.h	2008-04-03 15:38:03.000000000 -0400
-@@ -179,6 +179,9 @@ void qemudLog(int priority, const char *
- void remoteDispatchClientRequest (struct qemud_server *server,
-                                   struct qemud_client *client);
- 
-+#if HAVE_POLKIT
-+int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid);
-+#endif
- 
- #endif
- 
-diff -rup libvirt-0.4.1.orig/qemud/qemud.c libvirt-0.4.1.new/qemud/qemud.c
---- libvirt-0.4.1.orig/qemud/qemud.c	2008-04-03 15:39:15.000000000 -0400
-+++ libvirt-0.4.1.new/qemud/qemud.c	2008-04-03 15:38:03.000000000 -0400
-@@ -1040,6 +1040,28 @@ remoteCheckAccess (struct qemud_client *
-     return 0;
- }
- 
-+#if HAVE_POLKIT
-+int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid) {
-+#ifdef SO_PEERCRED
-+    struct ucred cr;
-+    unsigned int cr_len = sizeof (cr);
-+
-+    if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cr_len) < 0) {
-+        qemudLog(QEMUD_ERR, _("Failed to verify client credentials: %s"),
-+                 strerror(errno));
-+        return -1;
-+    }
-+
-+    *pid = cr.pid;
-+    *uid = cr.uid;
-+#else
-+    /* XXX Many more OS support UNIX socket credentials we could port to. See dbus ....*/
-+#error "UNIX socket credentials not supported/implemented on this platform yet..."
-+#endif
-+    return 0;
-+}
-+#endif
-+
- static int qemudDispatchServer(struct qemud_server *server, struct qemud_socket *sock) {
-     int fd;
-     struct sockaddr_storage addr;
-@@ -1075,6 +1097,26 @@ static int qemudDispatchServer(struct qe
-     memcpy (&client->addr, &addr, sizeof addr);
-     client->addrlen = addrlen;
- 
-+#if HAVE_POLKIT
-+    /* Only do policy checks for non-root - allow root user
-+       through with no checks, as a fail-safe - root can easily
-+       change policykit policy anyway, so its pointless trying
-+       to restrict root */
-+    if (client->auth == REMOTE_AUTH_POLKIT) {
-+        uid_t uid;
-+        pid_t pid;
-+
-+        if (qemudGetSocketIdentity(client->fd, &uid, &pid) < 0)
-+            goto cleanup;
-+
-+        /* Cient is running as root, so disable auth */
-+        if (uid == 0) {
-+            qemudLog(QEMUD_INFO, _("Turn off polkit auth for privileged client %d"), pid);
-+            client->auth = REMOTE_AUTH_NONE;
-+        }
-+    }
-+#endif
-+
-     if (client->type != QEMUD_SOCK_TYPE_TLS) {
-         client->mode = QEMUD_MODE_RX_HEADER;
-         client->bufferLength = REMOTE_MESSAGE_HEADER_XDR_LEN;
-diff -rup libvirt-0.4.1.orig/qemud/remote.c libvirt-0.4.1.new/qemud/remote.c
---- libvirt-0.4.1.orig/qemud/remote.c	2008-02-29 11:23:17.000000000 -0500
-+++ libvirt-0.4.1.new/qemud/remote.c	2008-04-03 15:38:03.000000000 -0400
-@@ -2564,27 +2564,6 @@ remoteDispatchAuthSaslStep (struct qemud
- 
- 
- #if HAVE_POLKIT
--static int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid) {
--#ifdef SO_PEERCRED
--    struct ucred cr;
--    unsigned int cr_len = sizeof (cr);
--
--    if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cr_len) < 0) {
--        qemudLog(QEMUD_ERR, _("Failed to verify client credentials: %s"),
--                 strerror(errno));
--        return -1;
--    }
--
--    *pid = cr.pid;
--    *uid = cr.uid;
--#else
--    /* XXX Many more OS support UNIX socket credentials we could port to. See dbus ....*/
--#error "UNIX socket credentials not supported/implemented on this platform yet..."
--#endif
--    return 0;
--}
--
--
- static int
- remoteDispatchAuthPolkit (struct qemud_server *server ATTRIBUTE_UNUSED,
-                           struct qemud_client *client,
-@@ -2594,6 +2573,15 @@ remoteDispatchAuthPolkit (struct qemud_s
- {
-     pid_t callerPid;
-     uid_t callerUid;
-+    PolKitCaller *pkcaller = NULL;
-+    PolKitAction *pkaction = NULL;
-+    PolKitContext *pkcontext = NULL;
-+    PolKitError *pkerr = NULL;
-+    PolKitResult pkresult;
-+    DBusError err;
-+    const char *action = client->readonly ?
-+        "org.libvirt.unix.monitor" :
-+        "org.libvirt.unix.manage";
- 
-     REMOTE_DEBUG("Start PolicyKit auth %d", client->fd);
-     if (client->auth != REMOTE_AUTH_POLKIT) {
-@@ -2609,98 +2597,78 @@ remoteDispatchAuthPolkit (struct qemud_s
-         return -2;
-     }
- 
--    /* Only do policy checks for non-root - allow root user
--       through with no checks, as a fail-safe - root can easily
--       change policykit policy anyway, so its pointless trying
--       to restrict root */
--    if (callerUid == 0) {
--        qemudLog(QEMUD_INFO, _("Allowing PID %d running as root"), callerPid);
--        ret->complete = 1;
--        client->auth = REMOTE_AUTH_NONE;
--    } else {
--        PolKitCaller *pkcaller = NULL;
--        PolKitAction *pkaction = NULL;
--        PolKitContext *pkcontext = NULL;
--        PolKitError *pkerr = NULL;
--        PolKitResult pkresult;
--        DBusError err;
--        const char *action = client->readonly ?
--            "org.libvirt.unix.monitor" :
--            "org.libvirt.unix.manage";
--
--        qemudLog(QEMUD_INFO, _("Checking PID %d running as %d"),
--                 callerPid, callerUid);
--        dbus_error_init(&err);
--        if (!(pkcaller = polkit_caller_new_from_pid(server->sysbus,
--                                                    callerPid, &err))) {
--            qemudLog(QEMUD_ERR, _("Failed to lookup policy kit caller: %s"),
--                     err.message);
--            dbus_error_free(&err);
--            remoteDispatchFailAuth(client, req);
--            return -2;
--        }
--
--        if (!(pkaction = polkit_action_new())) {
--            qemudLog(QEMUD_ERR, _("Failed to create polkit action %s\n"),
--                                  strerror(errno));
--            polkit_caller_unref(pkcaller);
--            remoteDispatchFailAuth(client, req);
--            return -2;
--        }
--        polkit_action_set_action_id(pkaction, action);
--
--        if (!(pkcontext = polkit_context_new()) ||
--            !polkit_context_init(pkcontext, &pkerr)) {
--            qemudLog(QEMUD_ERR, _("Failed to create polkit context %s\n"),
--                     (pkerr ? polkit_error_get_error_message(pkerr)
--                      : strerror(errno)));
--            if (pkerr)
--                polkit_error_free(pkerr);
--            polkit_caller_unref(pkcaller);
--            polkit_action_unref(pkaction);
--            dbus_error_free(&err);
--            remoteDispatchFailAuth(client, req);
--            return -2;
--        }
-+    qemudLog(QEMUD_INFO, _("Checking PID %d running as %d"),
-+             callerPid, callerUid);
-+    dbus_error_init(&err);
-+    if (!(pkcaller = polkit_caller_new_from_pid(server->sysbus,
-+                                                callerPid, &err))) {
-+        qemudLog(QEMUD_ERR, _("Failed to lookup policy kit caller: %s"),
-+                 err.message);
-+        dbus_error_free(&err);
-+        remoteDispatchFailAuth(client, req);
-+        return -2;
-+    }
-+
-+    if (!(pkaction = polkit_action_new())) {
-+        qemudLog(QEMUD_ERR, _("Failed to create polkit action %s\n"),
-+                 strerror(errno));
-+        polkit_caller_unref(pkcaller);
-+        remoteDispatchFailAuth(client, req);
-+        return -2;
-+    }
-+    polkit_action_set_action_id(pkaction, action);
-+
-+    if (!(pkcontext = polkit_context_new()) ||
-+        !polkit_context_init(pkcontext, &pkerr)) {
-+        qemudLog(QEMUD_ERR, _("Failed to create polkit context %s\n"),
-+                 (pkerr ? polkit_error_get_error_message(pkerr)
-+                  : strerror(errno)));
-+        if (pkerr)
-+            polkit_error_free(pkerr);
-+        polkit_caller_unref(pkcaller);
-+        polkit_action_unref(pkaction);
-+        dbus_error_free(&err);
-+        remoteDispatchFailAuth(client, req);
-+        return -2;
-+    }
- 
- #if HAVE_POLKIT_CONTEXT_IS_CALLER_AUTHORIZED
--        pkresult = polkit_context_is_caller_authorized(pkcontext,
--                                                       pkaction,
--                                                       pkcaller,
--                                                       0,
--                                                       &pkerr);
--        if (pkerr && polkit_error_is_set(pkerr)) {
--            qemudLog(QEMUD_ERR,
--                     _("Policy kit failed to check authorization %d %s"),
--                     polkit_error_get_error_code(pkerr),
--                     polkit_error_get_error_message(pkerr));
--            remoteDispatchFailAuth(client, req);
--            return -2;
--        }
-+    pkresult = polkit_context_is_caller_authorized(pkcontext,
-+                                                   pkaction,
-+                                                   pkcaller,
-+                                                   0,
-+                                                   &pkerr);
-+    if (pkerr && polkit_error_is_set(pkerr)) {
-+        qemudLog(QEMUD_ERR,
-+                 _("Policy kit failed to check authorization %d %s"),
-+                 polkit_error_get_error_code(pkerr),
-+                 polkit_error_get_error_message(pkerr));
-+        remoteDispatchFailAuth(client, req);
-+        return -2;
-+    }
- #else
--        pkresult = polkit_context_can_caller_do_action(pkcontext,
--                                                       pkaction,
--                                                       pkcaller);
-+    pkresult = polkit_context_can_caller_do_action(pkcontext,
-+                                                   pkaction,
-+                                                   pkcaller);
- #endif
--        polkit_context_unref(pkcontext);
--        polkit_caller_unref(pkcaller);
--        polkit_action_unref(pkaction);
--        if (pkresult != POLKIT_RESULT_YES) {
--            qemudLog(QEMUD_ERR,
--                     _("Policy kit denied action %s from pid %d, uid %d,"
--                       " result: %s\n"),
--                     action, callerPid, callerUid,
--                     polkit_result_to_string_representation(pkresult));
--            remoteDispatchFailAuth(client, req);
--            return -2;
--        }
--        qemudLog(QEMUD_INFO,
--                 _("Policy allowed action %s from pid %d, uid %d, result %s"),
-+    polkit_context_unref(pkcontext);
-+    polkit_caller_unref(pkcaller);
-+    polkit_action_unref(pkaction);
-+    if (pkresult != POLKIT_RESULT_YES) {
-+        qemudLog(QEMUD_ERR,
-+                 _("Policy kit denied action %s from pid %d, uid %d,"
-+                   " result: %s\n"),
-                  action, callerPid, callerUid,
-                  polkit_result_to_string_representation(pkresult));
--        ret->complete = 1;
--        client->auth = REMOTE_AUTH_NONE;
-+        remoteDispatchFailAuth(client, req);
-+        return -2;
-     }
-+    qemudLog(QEMUD_INFO,
-+             _("Policy allowed action %s from pid %d, uid %d, result %s"),
-+             action, callerPid, callerUid,
-+             polkit_result_to_string_representation(pkresult));
-+    ret->complete = 1;
-+    client->auth = REMOTE_AUTH_NONE;
- 
-     return 0;
- }
-diff -rup libvirt-0.4.1.orig/src/libvirt.c libvirt-0.4.1.new/src/libvirt.c
---- libvirt-0.4.1.orig/src/libvirt.c	2008-02-26 10:37:43.000000000 -0500
-+++ libvirt-0.4.1.new/src/libvirt.c	2008-04-03 15:38:47.000000000 -0400
-@@ -19,6 +19,9 @@
- #include <sys/stat.h>
- #include <unistd.h>
- #include <assert.h>
-+#ifdef HAVE_SYS_WAIT_H
-+#include <sys/wait.h>
-+#endif
- 
- #include <libxml/parser.h>
- #include <libxml/xpath.h>
-@@ -66,6 +69,39 @@ static int initialized = 0;
- int debugFlag = 0;
- #endif
- 
-+#if defined(POLKIT_AUTH)
-+static int virConnectAuthGainPolkit(const char *privilege) {
-+    const char *const args[] = {
-+        POLKIT_AUTH, "--obtain", privilege, NULL
-+    };
-+    int childpid, status, ret;
-+
-+    /* Root has all rights */
-+    if (getuid() == 0)
-+        return 0;
-+
-+    if ((childpid = fork()) < 0)
-+        return -1;
-+
-+    if (!childpid) {
-+        execvp(args[0], (char **)args);
-+        _exit(-1);
-+    }
-+
-+    while ((ret = waitpid(childpid, &status, 0) == -1) && errno == EINTR);
-+    if (ret == -1) {
-+        return -1;
-+    }
-+
-+    if (!WIFEXITED(status) ||
-+        (WEXITSTATUS(status) != 0 && WEXITSTATUS(status) != 1)) {
-+        return -1;
-+    }
-+
-+    return 0;
-+}
-+#endif
-+
- static int virConnectAuthCallbackDefault(virConnectCredentialPtr cred,
-                                          unsigned int ncred,
-                                          void *cbdata ATTRIBUTE_UNUSED) {
-@@ -77,28 +113,25 @@ static int virConnectAuthCallbackDefault
-         size_t len;
- 
-         switch (cred[i].type) {
--#if defined(POLKIT_GRANT) || defined(POLKIT_AUTH)
-         case VIR_CRED_EXTERNAL: {
-             int ret;
--            const char *const args[] = {
--#if defined(POLKIT_GRANT)
--                POLKIT_GRANT, "--gain", cred[i].prompt, NULL
--#else
--                POLKIT_AUTH, "--obtain", cred[i].prompt, NULL
--#endif
--            };
--
-             if (STRNEQ(cred[i].challenge, "PolicyKit"))
-                 return -1;
--            if (virRun(NULL, (char **) args, &ret) < 0)
--                return -1;
- 
--            if (!WIFEXITED(ret) ||
--                (WEXITSTATUS(ret) != 0 && WEXITSTATUS(ret) != 1))
-+#if defined(POLKIT_AUTH)
-+            if (virConnectAuthGainPolkit(cred[i].prompt) < 0)
-                 return -1;
-+#else
-+            /*
-+             * Ignore & carry on. Although we can't auth
-+             * directly, the user may have authenticated
-+             * themselves already outside context of libvirt
-+             */
-+#endif
-+
-             break;
-         }
--#endif
-+
-         case VIR_CRED_USERNAME:
-         case VIR_CRED_AUTHNAME:
-         case VIR_CRED_ECHOPROMPT:
-@@ -158,9 +191,7 @@ static int virConnectCredTypeDefault[] =
-     VIR_CRED_REALM,
-     VIR_CRED_PASSPHRASE,
-     VIR_CRED_NOECHOPROMPT,
--#if defined(POLKIT_AUTH) || defined(POLKIT_GRANT)
-     VIR_CRED_EXTERNAL,
--#endif
- };
- 
- static virConnectAuth virConnectAuthDefault = {

libvirt-0.4.1-qemu-media-change.patch

@@ -1,128 +0,0 @@
-commit 570fd656d1b67e5d02f52e107946930257e811a7
-Author: Daniel Veillard <veillard@redhat.com>
-Date:   Thu Mar 13 09:17:45 2008 +0000
-
-    * src/qemu_conf.c src/qemu_driver.c: patch from Cole Robinson
-      fixing CD Rom change on live QEmu/KVM domains.
-    Daniel
-
-diff --git a/src/qemu_conf.c b/src/qemu_conf.c
-index e54da5b..ebbd251 100644
---- a/src/qemu_conf.c
-+++ b/src/qemu_conf.c
-@@ -594,9 +594,16 @@ static int qemudParseDiskXML(virConnectPtr conn,
-     }
- 
-     if (source == NULL) {
--        qemudReportError(conn, NULL, NULL, VIR_ERR_NO_SOURCE, target ? "%s" : NULL, target);
--        goto error;
-+        /* There is a case without the source
-+         * to the CD-ROM device
-+         */
-+        if (!device || STRNEQ((const char *) device, "cdrom")) {
-+            qemudReportError(conn, NULL, NULL, VIR_ERR_NO_SOURCE,
-+                             target ? "%s" : NULL, target);
-+            goto error;
-+        }
-     }
-+
-     if (target == NULL) {
-         qemudReportError(conn, NULL, NULL, VIR_ERR_NO_TARGET, source ? "%s" : NULL, source);
-         goto error;
-@@ -630,7 +637,7 @@ static int qemudParseDiskXML(virConnectPtr conn,
-         goto error;
-     }
- 
--    strncpy(disk->src, (const char *)source, NAME_MAX-1);
-+    strncpy(disk->src, (source ? (const char *) source : "\0"), NAME_MAX-1);
-     disk->src[NAME_MAX-1] = '\0';
- 
-     strncpy(disk->dst, (const char *)target, NAME_MAX-1);
-@@ -1747,9 +1754,15 @@ int qemudBuildCommandLine(virConnectPtr conn,
-         char dev[NAME_MAX];
-         char file[PATH_MAX];
-         if (!strcmp(disk->dst, "hdc") &&
--            disk->device == QEMUD_DISK_CDROM)
--            snprintf(dev, NAME_MAX, "-%s", "cdrom");
--        else
-+            disk->device == QEMUD_DISK_CDROM) {
-+            if (disk->src[0])
-+                snprintf(dev, NAME_MAX, "-%s", "cdrom");
-+            else {
-+                /* Don't put anything on the cmdline for an empty cdrom*/
-+                disk = disk->next;
-+                continue;
-+            }
-+        } else
-             snprintf(dev, NAME_MAX, "-%s", disk->dst);
-         snprintf(file, PATH_MAX, "%s", disk->src);
- 
-@@ -2906,8 +2919,10 @@ char *qemudGenerateXML(virConnectPtr conn,
-                               types[disk->type], devices[disk->device]) < 0)
-             goto no_memory;
- 
--        if (virBufferVSprintf(buf, "      <source %s='%s'/>\n", typeAttrs[disk->type], disk->src) < 0)
--            goto no_memory;
-+        if (disk->src[0])
-+            if (virBufferVSprintf(buf, "      <source %s='%s'/>\n",
-+                                  typeAttrs[disk->type], disk->src) < 0)
-+                goto no_memory;
- 
-         if (virBufferVSprintf(buf, "      <target dev='%s'/>\n", disk->dst) < 0)
-             goto no_memory;
-diff --git a/src/qemu_driver.c b/src/qemu_driver.c
-index 21f0fed..2b4c2a6 100644
---- a/src/qemu_driver.c
-+++ b/src/qemu_driver.c
-@@ -2223,23 +2223,29 @@ static int qemudDomainChangeCDROM(virDomainPtr dom,
-     struct qemud_driver *driver = (struct qemud_driver *)dom->conn->privateData;
-     char *cmd, *reply, *safe_path;
- 
--    /* Migrate to file */
--    safe_path = qemudEscapeMonitorArg(newdisk->src);
--    if (!safe_path) {
--        qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
--                         "out of memory");
--        return -1;
--    }
--    if (asprintf (&cmd, "change %s \"%s\"",
--                  /* XXX qemu may support multiple CDROM in future */
--                  /* olddisk->dst */ "cdrom",
--                  safe_path) == -1) {
-+    if (newdisk->src[0]) {
-+        safe_path = qemudEscapeMonitorArg(newdisk->src);
-+        if (!safe_path) {
-+            qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
-+                             "out of memory");
-+            return -1;
-+        }
-+        if (asprintf (&cmd, "change %s \"%s\"",
-+                      /* XXX qemu may support multiple CDROM in future */
-+                      /* olddisk->dst */ "cdrom",
-+                      safe_path) == -1) {
-+            qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
-+                             "out of memory");
-+            free(safe_path);
-+            return -1;
-+        }
-+        free(safe_path);
-+
-+    } else if (asprintf(&cmd, "eject cdrom") == -1) {
-         qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
-                          "out of memory");
--        free(safe_path);
-         return -1;
-     }
--    free(safe_path);
- 
-     if (qemudMonitorCommand(driver, vm, cmd, &reply) < 0) {
-         qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED, "cannot change cdrom media");
-@@ -2248,7 +2254,7 @@ static int qemudDomainChangeCDROM(virDomainPtr dom,
-     }
-     free(reply);
-     free(cmd);
--    strcpy(olddisk->dst, newdisk->dst);
-+    strcpy(olddisk->src, newdisk->src);
-     olddisk->type = newdisk->type;
-     return 0;
- }

libvirt-0.4.1-qemud1.patch

@@ -1,38 +0,0 @@
-
-	Avoid segfault upon early libvirtd failure.
-	* qemud/qemud.c (main): Don't call qemudCleanup on an
-	uninitialized pointer.
-
-By the way, even though this evoked a warning from gcc,
-"make distcheck" passes.  Obviously, that means the distcheck
-rule is inadequate.  I'll fix it so that it turns on -Werror
-for the final build.
-
-Signed-off-by: Jim Meyering <meyering@redhat.com>
----
- qemud/qemud.c |    5 +++--
- 1 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/qemud/qemud.c b/qemud/qemud.c
-index 96fdf32..b6b82ed 100644
---- a/qemud/qemud.c
-+++ b/qemud/qemud.c
-@@ -2025,7 +2025,7 @@ libvirt management daemon:\n\
-
- #define MAX_LISTEN 5
- int main(int argc, char **argv) {
--    struct qemud_server *server;
-+    struct qemud_server *server = NULL;
-     struct sigaction sig_action;
-     int sigpipe[2];
-     const char *pid_file = NULL;
-@@ -2180,7 +2180,8 @@ int main(int argc, char **argv) {
-         unlink (pid_file);
-
-  error1:
--    qemudCleanup(server);
-+    if (server)
-+        qemudCleanup(server);
-     return ret;
- }
-

libvirt-0.4.1-qemud2.patch

@@ -1,23 +0,0 @@
-
-	Don't use first byte of string as a pointer.
-	* src/qemu_conf.c (qemudReportError): Use the pointer, errorMessage,
-	not its first byte, errorMessage[0].
-
-Signed-off-by: Jim Meyering <meyering@redhat.com>
----
- src/qemu_conf.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/src/qemu_conf.c b/src/qemu_conf.c
-index eead0bc..e54da5b 100644
---- a/src/qemu_conf.c
-+++ b/src/qemu_conf.c
-@@ -68,7 +68,7 @@ void qemudReportError(virConnectPtr conn,
-         errorMessage[0] = '\0';
-     }
-
--    virerr = __virErrorMsg(code, (errorMessage[0] ? errorMessage[0] : NULL));
-+    virerr = __virErrorMsg(code, (errorMessage[0] ? errorMessage : NULL));
-     __virRaiseError(conn, dom, net, VIR_FROM_QEMU, code, VIR_ERR_ERROR,
-                     virerr, errorMessage, NULL, -1, -1, virerr, errorMessage);
- }

libvirt-0.4.1-tap-ifname.patch

@@ -1,63 +0,0 @@
-diff -rupN libvirt-0.4.1.orig/src/bridge.c libvirt-0.4.1.new/src/bridge.c
---- libvirt-0.4.1.orig/src/bridge.c	2008-02-28 06:16:21.000000000 -0500
-+++ libvirt-0.4.1.new/src/bridge.c	2008-03-13 11:25:12.000000000 -0400
-@@ -313,7 +313,6 @@ brDeleteInterface(brControl *ctl ATTRIBU
- int
- brAddTap(brControl *ctl,
-          const char *bridge,
--         unsigned char *macaddr,
-          char *ifname,
-          int maxlen,
-          int *tapfd)
-@@ -357,18 +356,6 @@ brAddTap(brControl *ctl,
-         }
- 
-         if (ioctl(fd, TUNSETIFF, &try) == 0) {
--            struct ifreq addr;
--            memset(&addr, 0, sizeof(addr));
--            memcpy(addr.ifr_hwaddr.sa_data, macaddr, 6);
--            addr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
--
--            /* Device actually starts in 'UP' state, but it
--             * needs to be down to set the MAC addr
--             */
--            if ((errno = brSetInterfaceUp(ctl, try.ifr_name, 0)))
--                goto error;
--            if (ioctl(fd, SIOCSIFHWADDR, &addr) != 0)
--                goto error;
-             if ((errno = brAddInterface(ctl, bridge, try.ifr_name)))
-                 goto error;
-             if ((errno = brSetInterfaceUp(ctl, try.ifr_name, 1)))
-diff -rupN libvirt-0.4.1.orig/src/bridge.h libvirt-0.4.1.new/src/bridge.h
---- libvirt-0.4.1.orig/src/bridge.h	2008-02-28 06:16:21.000000000 -0500
-+++ libvirt-0.4.1.new/src/bridge.h	2008-03-13 11:25:12.000000000 -0400
-@@ -62,7 +62,6 @@ int     brDeleteInterface       (brContr
- 
- int     brAddTap                (brControl *ctl,
-                                  const char *bridge,
--                                 unsigned char *mac,
-                                  char *ifname,
-                                  int maxlen,
-                                  int *tapfd);
-diff -rupN libvirt-0.4.1.orig/src/qemu_conf.c libvirt-0.4.1.new/src/qemu_conf.c
---- libvirt-0.4.1.orig/src/qemu_conf.c	2008-03-13 11:24:39.000000000 -0400
-+++ libvirt-0.4.1.new/src/qemu_conf.c	2008-03-13 11:25:12.000000000 -0400
-@@ -1540,7 +1540,6 @@ qemudNetworkIfaceConnect(virConnectPtr c
-     }
- 
-     if ((err = brAddTap(driver->brctl, brname,
--                        net->mac,
-                         ifname, BR_IFNAME_MAXLEN, &tapfd))) {
-         qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR,
-                          "Failed to add tap interface '%s' to bridge '%s' : %s",
-@@ -1548,7 +1547,9 @@ qemudNetworkIfaceConnect(virConnectPtr c
-         goto error;
-     }
- 
--    snprintf(tapfdstr, sizeof(tapfdstr), "tap,fd=%d,script=,vlan=%d", tapfd, vlan);
-+    snprintf(tapfdstr, sizeof(tapfdstr),
-+             "tap,fd=%d,script=,vlan=%d,ifname=%s",
-+             tapfd, vlan, ifname);
- 
-     if (!(retval = strdup(tapfdstr)))
-         goto no_memory;

libvirt-0.4.1-xen-boot-device.patch

@@ -1,21 +0,0 @@
-commit 2bcf35336cd649e58c08d7cf3452a8d4353bcf85
-Author: Daniel Veillard <veillard@redhat.com>
-Date:   Fri Mar 7 09:23:30 2008 +0000
-
-    * src/xend_internal.c: applied patch from Cole Robinson to not
-      loose the boot tag when defining a fully virtualized xen domain
-    Daniel
-
-diff --git a/src/xend_internal.c b/src/xend_internal.c
-index 8bbc28f..fef54f8 100644
---- a/src/xend_internal.c
-+++ b/src/xend_internal.c
-@@ -1323,7 +1323,7 @@ xend_parse_sexp_desc_os(virConnectPtr xend, struct sexpr *node, virBufferPtr buf
-     if (hvm)
-         virBufferVSprintf(buf, "    <loader>%s</loader>\n", loader);
- 
--    if (kernel) {
-+    if ((kernel) && ((!loader) || (STRNEQ(kernel, loader)))) {
-         virBufferVSprintf(buf, "    <kernel>%s</kernel>\n", kernel);
-         if (initrd && initrd[0])
-             virBufferVSprintf(buf, "    <initrd>%s</initrd>\n", initrd);

libvirt-0.8.3-avoid-resetting-errors.patch

@@ -0,0 +1,51 @@
+From 452bf160e5bbe0789d706fda95f5919551eb2cac Mon Sep 17 00:00:00 2001
+From: Jiri Denemark <jdenemar@redhat.com>
+Date: Fri, 25 Mar 2011 16:45:45 +0100
+Subject: [PATCH 2/2] daemon: Avoid resetting errors before they are reported
+
+https://bugzilla.redhat.com/show_bug.cgi?id=690733
+
+Commit f44bfb7 was supposed to make sure no additional libvirt API (esp.
+*Free) is called before remoteDispatchConnError() is called on error.
+However, the patch missed two instances.
+(cherry picked from commit 55cc591fc18e87b29febf78dc5b424b7c12f7349)
+---
+ daemon/remote.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/daemon/remote.c b/daemon/remote.c
+index a8258ca..7464957 100644
+--- a/daemon/remote.c
++++ b/daemon/remote.c
+@@ -4547,12 +4547,13 @@ remoteDispatchStoragePoolListVolumes (struct qemud_server *server ATTRIBUTE_UNUS
+     ret->names.names_len =
+         virStoragePoolListVolumes (pool,
+                                    ret->names.names_val, args->maxnames);
+-    virStoragePoolFree(pool);
+     if (ret->names.names_len == -1) {
+         VIR_FREE(ret->names.names_val);
+         remoteDispatchConnError(rerr, conn);
++        virStoragePoolFree(pool);
+         return -1;
+     }
++    virStoragePoolFree(pool);
+ 
+     return 0;
+ }
+@@ -4576,11 +4577,12 @@ remoteDispatchStoragePoolNumOfVolumes (struct qemud_server *server ATTRIBUTE_UNU
+     }
+ 
+     ret->num = virStoragePoolNumOfVolumes (pool);
+-    virStoragePoolFree(pool);
+     if (ret->num == -1) {
+         remoteDispatchConnError(rerr, conn);
++        virStoragePoolFree(pool);
+         return -1;
+     }
++    virStoragePoolFree(pool);
+ 
+     return 0;
+ }
+-- 
+1.7.3.4
+

libvirt-0.8.3-boot-menu.patch

@@ -0,0 +1,12 @@
+diff -rup libvirt-0.8.3.orig/src/qemu/qemu_conf.c libvirt-0.8.3.new/src/qemu/qemu_conf.c
+--- libvirt-0.8.3.orig/src/qemu/qemu_conf.c	2010-08-04 13:21:27.000000000 +0100
++++ libvirt-0.8.3.new/src/qemu/qemu_conf.c	2010-08-23 21:08:13.239794362 +0100
+@@ -3651,7 +3651,7 @@ int qemudBuildCommandLine(virConnectPtr 
+ {
+     int i;
+     char memory[50];
+-    char boot[VIR_DOMAIN_BOOT_LAST];
++    char boot[VIR_DOMAIN_BOOT_LAST+1];
+     struct utsname ut;
+     int disableKQEMU = 0;
+     int disableKVM = 0;

libvirt-0.8.3-fix-var-lib-libvirt-permissions.patch

@@ -0,0 +1,44 @@
+From f970d802ab805f1a37af384f148f34e108714034 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Wed, 3 Nov 2010 15:20:24 -0600
+Subject: [PATCH] rpm: fix /var/lib/libvirt permissions
+
+https://bugzilla.redhat.com/show_bug.cgi?id=649511
+
+Regression of forcing 0700 permissions (which breaks guest startup
+because the qemu user can't see /var/lib/libvirt/*.monitor) was
+introduced in commit 66823690e, as part of libvirt 0.8.2.
+
+* libvirt.spec.in (%files): Drop %{_localstatedir}/lib/libvirt,
+since libvirt depends on libvirt-client.
+(%files client): Guarantee 755 permissions on
+%(_localstatedir}/lib/libvirt, since the qemu user must be able to
+do pathname resolution to a subdirectory.
+---
+ libvirt.spec.in |    3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/libvirt.spec.in b/libvirt.spec.in
+index 813e0c0..f77626e 100644
+--- a/libvirt.spec.in
++++ b/libvirt.spec.in
+@@ -793,7 +793,6 @@ fi
+ 
+ %dir %{_localstatedir}/run/libvirt/
+ 
+-%dir %{_localstatedir}/lib/libvirt/
+ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/
+ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/
+ %dir %attr(0700, root, root) %{_localstatedir}/cache/libvirt/
+@@ -883,7 +882,7 @@ fi
+ 
+ %{_sysconfdir}/rc.d/init.d/libvirt-guests
+ %config(noreplace) %{_sysconfdir}/sysconfig/libvirt-guests
+-%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt
++%dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/
+ 
+ %if %{with_sasl}
+ %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf
+-- 
+1.7.3.4
+

libvirt-0.8.3-octal-addresses.patch

@@ -0,0 +1,53 @@
+From 8efebd1761700a0cc32736829aead7807cc7865d Mon Sep 17 00:00:00 2001
+From: =?utf8?q?Diego=20Elio=20Petten=C3=B2?= <flameeyes@gmail.com>
+Date: Tue, 26 Oct 2010 14:45:03 +0200
+Subject: [PATCH] qemu: don't use %.3d format for bus/addr of USB devices
+
+When using 0-prefixed numbers, QEmu will interpret them as octal numbers
+(as C convention says); this means that if you attach a device that has
+addr > 10 (decimal) you're going to attach a different device.
+---
+ src/qemu/qemu_conf.c                               |    4 ++--
+ .../qemuxml2argv-hostdev-usb-address-device.args   |    2 +-
+ .../qemuxml2argv-hostdev-usb-address.args          |    2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
+index 00e89a1..5bd3d4c 100644
+--- a/src/qemu/qemu_conf.c
++++ b/src/qemu/qemu_conf.c
+@@ -3266,7 +3266,7 @@ qemuBuildUSBHostdevDevStr(virDomainHostdevDefPtr dev)
+         return NULL;
+     }
+ 
+-    if (virAsprintf(&ret, "usb-host,hostbus=%.3d,hostaddr=%.3d,id=%s",
++    if (virAsprintf(&ret, "usb-host,hostbus=%d,hostaddr=%d,id=%s",
+                     dev->source.subsys.u.usb.bus,
+                     dev->source.subsys.u.usb.device,
+                     dev->info.alias) < 0)
+@@ -3288,7 +3288,7 @@ qemuBuildUSBHostdevUsbDevStr(virDomainHostdevDefPtr dev)
+         return NULL;
+     }
+ 
+-    if (virAsprintf(&ret, "host:%.3d.%.3d",
++    if (virAsprintf(&ret, "host:%d.%d",
+                     dev->source.subsys.u.usb.bus,
+                     dev->source.subsys.u.usb.device) < 0)
+         virReportOOMError();
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address-device.args b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address-device.args
+index 6900fd3..7e42542 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address-device.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address-device.args
+@@ -1 +1 @@
+-LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -usb -device usb-host,hostbus=014,hostaddr=006,id=hostdev0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2
++LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -usb -device usb-host,hostbus=14,hostaddr=6,id=hostdev0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address.args b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address.args
+index e57bec1..96e004d 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-usb-address.args
+@@ -1 +1 @@
+-LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -usbdevice host:014.006
++LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -usbdevice host:14.6
+-- 
+1.7.3.4
+

libvirt-0.8.3-read-only-checks.patch

@@ -0,0 +1,95 @@
+From: Guido Günther <agx@sigxcpu.org>
+Date: Mon, 14 Mar 2011 02:56:28 +0000 (+0800)
+Subject: Add missing checks for read only connections
+X-Git-Url: http://libvirt.org/git/?p=libvirt.git;a=commitdiff_plain;h=71753cb7f7a16ff800381c0b5ee4e99eea92fed3;hp=13c00dde3171b3a38d23cceb3f9151cb6cac3dad
+
+Add missing checks for read only connections
+
+As pointed on CVE-2011-1146, some API forgot to check the read-only
+status of the connection for entry point which modify the state
+of the system or may lead to a remote execution using user data.
+The entry points concerned are:
+  - virConnectDomainXMLToNative
+  - virNodeDeviceDettach
+  - virNodeDeviceReAttach
+  - virNodeDeviceReset
+  - virDomainRevertToSnapshot
+  - virDomainSnapshotDelete
+
+* src/libvirt.c: fix the above set of entry points to error on read-only
+                 connections
+
+Rebased to 0.8.2, mostly changed the call of the error routines
+---
+
+--- src/libvirt.c.orig	2011-03-14 17:03:45.000000000 +0800
++++ src/libvirt.c	2011-03-14 17:10:41.000000000 +0800
+@@ -3190,6 +3190,10 @@ char *virConnectDomainXMLToNative(virCon
+         virDispatchError(NULL);
+         return (NULL);
+     }
++    if (conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(NULL, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
+ 
+     if (nativeFormat == NULL || domainXml == NULL) {
+         virLibConnError(conn, VIR_ERR_INVALID_ARG, __FUNCTION__);
+@@ -9432,6 +9436,11 @@ virNodeDeviceDettach(virNodeDevicePtr de
+         return (-1);
+     }
+ 
++    if (dev->conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dev->conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
++
+     if (dev->conn->driver->nodeDeviceDettach) {
+         int ret;
+         ret = dev->conn->driver->nodeDeviceDettach (dev);
+@@ -9475,6 +9484,11 @@ virNodeDeviceReAttach(virNodeDevicePtr d
+         return (-1);
+     }
+ 
++    if (dev->conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dev->conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
++
+     if (dev->conn->driver->nodeDeviceReAttach) {
+         int ret;
+         ret = dev->conn->driver->nodeDeviceReAttach (dev);
+@@ -9520,6 +9534,11 @@ virNodeDeviceReset(virNodeDevicePtr dev)
+         return (-1);
+     }
+ 
++    if (dev->conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dev->conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
++
+     if (dev->conn->driver->nodeDeviceReset) {
+         int ret;
+         ret = dev->conn->driver->nodeDeviceReset (dev);
+@@ -12775,6 +12794,10 @@ virDomainRevertToSnapshot(virDomainSnaps
+     }
+ 
+     conn = snapshot->domain->conn;
++    if (conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
+ 
+     if (conn->driver->domainRevertToSnapshot) {
+         int ret = conn->driver->domainRevertToSnapshot(snapshot, flags);
+@@ -12821,6 +12844,10 @@ virDomainSnapshotDelete(virDomainSnapsho
+     }
+ 
+     conn = snapshot->domain->conn;
++    if (conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        goto error;
++    }
+ 
+     if (conn->driver->domainSnapshotDelete) {
+         int ret = conn->driver->domainSnapshotDelete(snapshot, flags);

libvirt-0.8.3-remote-protect-against-integer-overflow.patch

@@ -0,0 +1,106 @@
+From 584f9cee6926b57a19cc8bb36ea77124bdcfed94 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Fri, 24 Jun 2011 12:16:05 -0600
+Subject: [PATCH] remote: protect against integer overflow
+
+https://bugzilla.redhat.com/show_bug.cgi?id=717204
+CVE-2011-2511 - integer overflow in VirDomainGetVcpus
+
+Integer overflow and remote code are never a nice mix.
+
+This has existed since commit 56cd414.
+
+* src/libvirt.c (virDomainGetVcpus): Reject overflow up front.
+* src/remote/remote_driver.c (remoteDomainGetVcpus): Avoid overflow
+  on sending rpc.
+* daemon/remote.c (remoteDispatchDomainGetVcpus): Avoid overflow on
+  receiving rpc.
+
+(cherry picked from commit 774b21c163845170c9ffa873f5720d318812eaf6)
+
+Conflicts:
+
+	daemon/remote.c
+	src/remote/remote_driver.c
+        src/libvirt.c
+
+Change to internal.h required to avoid backporting 89d994ad.
+---
+ daemon/remote.c            |    3 ++-
+ src/internal.h             |   17 +++++++++++++++++
+ src/libvirt.c              |    4 ++--
+ src/remote/remote_driver.c |    3 ++-
+ 4 files changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/daemon/remote.c b/daemon/remote.c
+index 7464957..c6f7007 100644
+--- a/daemon/remote.c
++++ b/daemon/remote.c
+@@ -1697,7 +1697,8 @@ remoteDispatchDomainGetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED,
+         return -1;
+     }
+ 
+-    if (args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) {
++    if (INT_MULTIPLY_OVERFLOW(args->maxinfo, args->maplen) ||
++        args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) {
+         virDomainFree(dom);
+         remoteDispatchFormatError (rerr, "%s", _("maxinfo * maplen > REMOTE_CPUMAPS_MAX"));
+         return -1;
+diff --git a/src/internal.h b/src/internal.h
+index fab3e11..53447a9 100644
+--- a/src/internal.h
++++ b/src/internal.h
+@@ -226,4 +226,21 @@
+         }                                                               \
+     } while (0)
+ 
++/* branch-specific: we don't want to update gnulib on the branch, so this
++ * backports just one required macro from newer gnulib's intprops.h.
++ * This version requires that both a and b are 'int', rather than
++ * the fully type-generic version from gnulib.  */
++# define INT_MULTIPLY_OVERFLOW(a, b)            \
++    ((b) < 0                                    \
++     ? ((a) < 0                                 \
++        ? (a) < INT_MAX / (b)                   \
++        : (b) == -1                             \
++        ? 0                                     \
++        : INT_MIN / (b) < (a))                  \
++     : (b) == 0                                 \
++     ? 0                                        \
++     : ((a) < 0                                 \
++        ? (a) < INT_MIN / (b)                   \
++        : INT_MAX / (b) < (a)))
++
+ #endif                          /* __VIR_INTERNAL_H__ */
+diff --git a/src/libvirt.c b/src/libvirt.c
+index 1213ecf..6a584fb 100644
+--- a/src/libvirt.c
++++ b/src/libvirt.c
+@@ -5218,8 +5218,8 @@ virDomainGetVcpus(virDomainPtr domain, virVcpuInfoPtr info, int maxinfo,
+ 
+     /* Ensure that domainGetVcpus (aka remoteDomainGetVcpus) does not
+        try to memcpy anything into a NULL pointer.  */
+-    if ((cpumaps == NULL && maplen != 0)
+-        || (cpumaps && maplen <= 0)) {
++    if (!cpumaps ? maplen != 0
++        : (maplen <= 0 || INT_MULTIPLY_OVERFLOW(maxinfo, maplen))) {
+         virLibDomainError(domain, VIR_ERR_INVALID_ARG, __FUNCTION__);
+         goto error;
+     }
+diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
+index cb0d8e1..0d9b425 100644
+--- a/src/remote/remote_driver.c
++++ b/src/remote/remote_driver.c
+@@ -2467,7 +2467,8 @@ remoteDomainGetVcpus (virDomainPtr domain,
+                     maxinfo, REMOTE_VCPUINFO_MAX);
+         goto done;
+     }
+-    if (maxinfo * maplen > REMOTE_CPUMAPS_MAX) {
++    if (INT_MULTIPLY_OVERFLOW(maxinfo, maplen) ||
++        maxinfo * maplen > REMOTE_CPUMAPS_MAX) {
+         remoteError(VIR_ERR_RPC,
+                     _("vCPU map buffer length exceeds maximum: %d > %d"),
+                     maxinfo * maplen, REMOTE_CPUMAPS_MAX);
+-- 
+1.7.3.4
+

libvirt-iscsi-sysfs4.patch

@@ -1,146 +0,0 @@
---- a/src/storage_backend_iscsi.c	4 Mar 2008 20:02:34 -0000	1.3
-+++ b/src/storage_backend_iscsi.c	26 Mar 2008 22:07:05 -0000
-@@ -170,20 +170,91 @@
- virStorageBackendISCSIMakeLUN(virConnectPtr conn,
-                               virStoragePoolObjPtr pool,
-                               char **const groups,
--                              void *data ATTRIBUTE_UNUSED)
-+                              void *data)
- {
-     virStorageVolDefPtr vol;
-     int fd = -1;
-+    unsigned int target, channel, id, lun;
-     char lunid[100];
--    char *dev = groups[4];
-     int opentries = 0;
-     char *devpath = NULL;
-+    char *session = data;
-+    char sysfs_path[PATH_MAX];
-+    char *dev = NULL;
-+    DIR *sysdir;
-+    struct dirent *block_dirent;
-+    struct stat sbuf;
-+    int len;
-+
-+    if ((virStrToLong_ui(groups[0], NULL, 10, &target) < 0) ||
-+        (virStrToLong_ui(groups[1], NULL, 10, &channel) < 0) ||
-+        (virStrToLong_ui(groups[2], NULL, 10, &id) < 0) ||
-+        (virStrToLong_ui(groups[3], NULL, 10, &lun) < 0)) {
-+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s",
-+                              _("Failed parsing iscsiadm commands"));
-+        return -1;
-+    }
-+
-+    if (lun == 0) {
-+        /* the 0'th LUN isn't a real LUN, it's just a control LUN; skip it */
-+        return 0;
-+    }
-+
-+    snprintf(sysfs_path, PATH_MAX,
-+             "/sys/class/iscsi_session/session%s/device/"
-+             "target%d:%d:%d/%d:%d:%d:%d/block",
-+             session, target, channel, id, target, channel, id, lun);
-+
-+    if (stat(sysfs_path, &sbuf) < 0) {
-+        /* block path in subdir didn't exist; this is unexpected, so fail */
-+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR,
-+                              _("Failed to find the sysfs path for %d:%d:%d:%d: %s"),
-+                              target, channel, id, lun, strerror(errno));
-+        return -1;
-+    }
-+
-+    sysdir = opendir(sysfs_path);
-+    if (sysdir == NULL) {
-+        /* we failed for some reason; return an error */
-+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR,
-+                              _("Failed to opendir sysfs path %s: %s"),
-+                              sysfs_path, strerror(errno));
-+        return -1;
-+    }
-+
-+    while ((block_dirent = readdir(sysdir)) != NULL) {
-+        len = strlen(block_dirent->d_name);
-+        if ((len == 1 && block_dirent->d_name[0] == '.') ||
-+            (len == 2 && block_dirent->d_name[0] == '.' && block_dirent->d_name[1] == '.')) {
-+            /* the . and .. directories; just skip them */
-+            continue;
-+        }
-+
-+        /* OK, not . or ..; let's see if it is a SCSI device */
-+        if (len > 2 &&
-+            block_dirent->d_name[0] == 's' &&
-+            block_dirent->d_name[1] == 'd') {
-+            /* looks like a scsi device, smells like scsi device; it must be
-+               a scsi device */
-+            dev = strdup(block_dirent->d_name);
-+            break;
-+        }
-+    }
-+    closedir(sysdir);
-+
-+    if (dev == NULL) {
-+        /* we didn't find the sd? device we were looking for; fail */
-+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR,
-+                              _("Failed to find SCSI device for %d:%d:%d:%d: %s"),
-+                              target, channel, id, lun, strerror(errno));
-+        return -1;
-+    }
- 
-     snprintf(lunid, sizeof(lunid)-1, "lun-%s", groups[3]);
- 
-     if ((vol = calloc(1, sizeof(virStorageVolDef))) == NULL) {
-         virStorageReportError(conn, VIR_ERR_NO_MEMORY, "%s", _("volume"));
--        return -1;
-+        goto cleanup;
-     }
- 
-     if ((vol->name = strdup(lunid)) == NULL) {
-@@ -197,6 +268,8 @@
-     }
-     strcpy(devpath, "/dev/");
-     strcat(devpath, dev);
-+    free(dev);
-+    dev = NULL;
-     /* It can take a little while between logging into the ISCSI
-      * server and udev creating the /dev nodes, so if we get ENOENT
-      * we must retry a few times - they should eventually appear.
-@@ -258,6 +331,7 @@
-     if (fd != -1) close(fd);
-     free(devpath);
-     virStorageVolDefFree(vol);
-+    free(dev);
-     return -1;
- }
- 
-@@ -281,14 +355,13 @@
-      *           scsi1 Channel 00 Id 0 Lun: 5
-      *                   Attached scsi disk sdg          State: running
-      *
--     * Need 2 regex to match alternating lines
-+     * Need a regex to match the Channel:Id:Lun lines
-      */
-     const char *regexes[] = {
--        "^\\s*scsi(\\S+)\\s+Channel\\s+(\\S+)\\s+Id\\s+(\\S+)\\s+Lun:\\s+(\\S+)\\s*$",
--        "^\\s*Attached\\s+scsi\\s+disk\\s+(\\S+)\\s+State:\\s+running\\s*$"
-+        "^\\s*scsi(\\S+)\\s+Channel\\s+(\\S+)\\s+Id\\s+(\\S+)\\s+Lun:\\s+(\\S+)\\s*$"
-     };
-     int vars[] = {
--        4, 1
-+        4
-     };
-     const char *prog[] = {
-         ISCSIADM, "--mode", "session", "-r", session, "-P", "3", NULL,
-@@ -296,11 +369,11 @@
- 
-     return virStorageBackendRunProgRegex(conn, pool,
-                                          prog,
--                                         2,
-+                                         1,
-                                          regexes,
-                                          vars,
-                                          virStorageBackendISCSIMakeLUN,
--                                         NULL);
-+                                         (void *)session);
- }
- 
- 

libvirt-source-dir-fix.patch

@@ -1,17 +0,0 @@
-Index: src/storage_conf.c
-===================================================================
-RCS file: /data/cvs/libvirt/src/storage_conf.c,v
-retrieving revision 1.3
-retrieving revision 1.4
-diff -u -r1.3 -r1.4
---- a/src/storage_conf.c	27 Feb 2008 10:37:19 -0000	1.3
-+++ b/src/storage_conf.c	28 Mar 2008 17:56:44 -0000	1.4
-@@ -479,7 +479,7 @@
-     }
-     if ((options->flags & VIR_STORAGE_BACKEND_POOL_SOURCE_DIR) &&
-         def->source.dir &&
--        virBufferVSprintf(buf,"    <directory path='%s'/>\n", def->source.dir) < 0)
-+        virBufferVSprintf(buf,"    <dir path='%s'/>\n", def->source.dir) < 0)
-         goto no_memory;
-     if ((options->flags & VIR_STORAGE_BACKEND_POOL_SOURCE_ADAPTER) &&
-         def->source.adapter &&

libvirt-storage-api-iscsi-sendtarget.patch

@@ -1,17 +0,0 @@
---- /home/boston/clalance/devel/libvirt--devel/src/storage_backend_iscsi.c	2008-02-13 13:48:32.497466000 -0500
-+++ libvirt-0.4.0/src/storage_backend_iscsi.c	2008-02-11 17:19:35.000000000 -0500
-@@ -143,6 +143,14 @@ static int virStorageBackendISCSIConnect
-         "--targetname", pool->def->source.devices[0].path, action, NULL
-     };
- 
-+    const char *cmdsendtarget[] = {
-+        ISCSIADM, "--mode", "discovery", "--type", "sendtargets",
-+        "--portal", portal, NULL
-+    };
-+
-+    if (virRun(conn, (char **)cmdsendtarget, NULL) < 0)
-+        return -1;
-+
-     if (virRun(conn, (char **)cmdargv, NULL) < 0)
-         return -1;
- 

sources

@@ -1 +1 @@
-4dfe45869f082393cfd09f4690454c12  libvirt-0.4.1.tar.gz
+ae8535ce119d32a2e9fb1f46e2c8f325  libvirt-0.8.3.tar.gz