[PATCH] cpu: x86: Check for invalid CPU data from hypervisor
by Jiri Denemark
Recently a kernel bug caused QEMU to report a CPU feature as enabled
while listing it in the "unavailable-features" list of features that
were requested, but could not be enabled. The feature was actually
enabled, but we marked it as disabled when starting a domain. Later when
the domain is migrated, the destination requests the feature to be
disabled, which breaks the guest ABI or if we are lucky QEMU just fails
to load the migration stream.
Let's make similar bugs more visible in the future by refusing to even
start the domain.
Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com>
---
src/cpu/cpu_x86.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
index 6b2531b360..e8409ce616 100644
--- a/src/cpu/cpu_x86.c
+++ b/src/cpu/cpu_x86.c
@@ -3019,6 +3019,14 @@ virCPUx86UpdateLive(virCPUDef *cpu,
x86DataIsSubset(&modelDisabled->data, &feature->data))
expected = VIR_CPU_FEATURE_DISABLE;
+ if (x86DataIsSubset(&enabled, &feature->data) &&
+ x86DataIsSubset(&disabled, &feature->data)) {
+ virReportError(VIR_ERR_OPERATION_FAILED,
+ _("hypervisor provided conflicting CPU data: feature '%1$s' is both enabled and disabled at the same time"),
+ feature->name);
+ return -1;
+ }
+
if (expected == VIR_CPU_FEATURE_DISABLE &&
x86DataIsSubset(&enabled, &feature->data)) {
VIR_DEBUG("Feature '%s' enabled by the hypervisor", feature->name);
--
2.44.0
1 year, 1 month
RE: join running core dump job
by Thanos Makatos
> -----Original Message-----
> From: Thanos Makatos <thanos.makatos(a)nutanix.com>
> Sent: Monday, March 4, 2024 5:24 PM
> To: devel(a)lists.libvirt.org
> Subject: join running core dump job
>
> Is there a way to programmatically wait for a previously initiated
> virDomainCoreDumpWithFormat() where the process that started it died? I'm
> looking at the API and don't seem to find anything relevant. I suppose I could
> poll via virDomainGetJobStats(), but, ideally, I'd like a function that would join
> the dump job and return when the dump job finishes.
> _______________________________________________
> Devel mailing list -- devel(a)lists.libvirt.org
> To unsubscribe send an email to devel-leave(a)lists.libvirt.org
I see there's qemuDumpWaitForCompletion(), looks promising.
1 year, 1 month
[PATCH] ci: refresh with lcitool manifest
by Daniel P. Berrangé
Picks up the switch from FreeBSD 13.2 to 13.3
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
ci/gitlab/builds.yml | 2 +-
ci/lcitool/targets/freebsd-13.yml | 2 --
2 files changed, 1 insertion(+), 3 deletions(-)
delete mode 100644 ci/lcitool/targets/freebsd-13.yml
diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml
index 49a0b27029..b23a3989b9 100644
--- a/ci/gitlab/builds.yml
+++ b/ci/gitlab/builds.yml
@@ -619,7 +619,7 @@ x86_64-freebsd-13:
needs: []
allow_failure: false
variables:
- CIRRUS_VM_IMAGE_NAME: freebsd-13-2
+ CIRRUS_VM_IMAGE_NAME: freebsd-13-3
CIRRUS_VM_IMAGE_SELECTOR: image_family
CIRRUS_VM_INSTANCE_TYPE: freebsd_instance
INSTALL_COMMAND: pkg install -y
diff --git a/ci/lcitool/targets/freebsd-13.yml b/ci/lcitool/targets/freebsd-13.yml
deleted file mode 100644
index 0337926479..0000000000
--- a/ci/lcitool/targets/freebsd-13.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-cirrus:
- image_name: freebsd-13-2
--
2.43.0
1 year, 1 month
join running core dump job
by Thanos Makatos
Is there a way to programmatically wait for a previously initiated virDomainCoreDumpWithFormat() where the process that started it died? I'm looking at the API and don't seem to find anything relevant. I suppose I could poll via virDomainGetJobStats(), but, ideally, I'd like a function that would join the dump job and return when the dump job finishes.
1 year, 1 month
[PATCH 0/5] qemu: Make firmware parsing failures non-fatal
by Andrea Bolognani
See 3/5 for information.
Andrea Bolognani (5):
qemu: Add missing early returns
qemu: Rewrite qemuFirmwareFetchParsedConfigs()
qemu: Make firmware parsing failures non-fatal
tests: Add firmware descriptor for edk2 on loongarch64
tests: Add invalid firmware descriptor
src/qemu/qemu_firmware.c | 120 +++++++-----------
.../qemu/firmware/50-edk2-loongarch64.json | 29 +++++
.../usr/share/qemu/firmware/93-invalid.json | 5 +
tests/qemufirmwaretest.c | 28 ++++
4 files changed, 107 insertions(+), 75 deletions(-)
create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/50-edk2-loongarch64.json
create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/93-invalid.json
--
2.43.2
1 year, 1 month
[PATCH PUSHED] Fix off-by-one error in udevListInterfacesByStatus
by Martin Kletzander
Ever since this function was introduced in 2012 it could've tried
filling in an extra interface name. That was made worse in 2019 when
the caller functions started accepting NULL arrays of size 0.
This is assigned CVE-2024-1441.
Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com>
Reported-by: Alexander Kuznetsov <kuznetsovam(a)altlinux.org>
Fixes: 5a33366f5c0b18c93d161bd144f9f079de4ac8ca
Fixes: d6064e2759a24e0802f363e3a810dc5a7d7ebb15
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
---
Pushed after review in libvirt-security since this has a CVE. Unfortunately I
forgot to split the NEWS update and the actual fix, so sorry to all
back-porters.
NEWS.rst | 15 +++++++++++++++
src/interface/interface_backend_udev.c | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/NEWS.rst b/NEWS.rst
index ac64cf697435..69258880d2d3 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -13,6 +13,21 @@ v10.1.0 (unreleased)
* **Security**
+ * ``CVE-2024-1441``: Fix off-by-one error leading to a crash
+
+ In **libvirt-1.0.0** there were couple of interface listing APIs
+ introduced which had an off-by-one error. That error could lead to a
+ very rare crash if an array was passed to those functions which did
+ not fit all the interfaces.
+
+ In **libvirt-5.10** a check for non-NULL arrays has been adjusted to
+ allow for NULL arrays with size 0 instead of rejecting all NULL
+ arrays. However that made the above issue significantly worse since
+ that off-by-one error now did not write beyond an array, but
+ dereferenced said NULL pointer making the crash certain in a
+ specific scenario in which a NULL array of size 0 was passed to the
+ aforementioned functions.
+
* **Removed features**
* **New features**
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index fb6799ed9406..40914830604e 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -222,7 +222,7 @@ udevListInterfacesByStatus(virConnectPtr conn,
g_autoptr(virInterfaceDef) def = NULL;
/* Ensure we won't exceed the size of our array */
- if (count > names_len)
+ if (count >= names_len)
break;
path = udev_list_entry_get_name(dev_entry);
--
2.44.0
1 year, 1 month
Release of libvirt-10.1.0
by Jiri Denemark
The 10.1.0 release of both libvirt and libvirt-python is tagged and
signed tarballs are available at
https://download.libvirt.org/
https://download.libvirt.org/python/
Thanks everybody who helped with this release by sending patches,
reviewing, testing, or providing feedback. Your work is greatly
appreciated.
* Security
* ``CVE-2024-1441``: Fix off-by-one error leading to a crash
In libvirt-1.0.0 there were couple of interface listing APIs
introduced which had an off-by-one error. That error could lead to a
very rare crash if an array was passed to those functions which did
not fit all the interfaces.
In libvirt-5.10 a check for non-NULL arrays has been adjusted to
allow for NULL arrays with size 0 instead of rejecting all NULL
arrays. However that made the above issue significantly worse since
that off-by-one error now did not write beyond an array, but
dereferenced said NULL pointer making the crash certain in a
specific scenario in which a NULL array of size 0 was passed to the
aforementioned functions.
* New features
* nodedev: Support updating mdevs
The node device driver has been extended to allow updating mediated node
devices. Options are available to target the update against the persistent,
active or both configurations of a mediated device.
Note: The support is only available with at least mdevctl v1.3.0 installed.
* qemu: Add support for /dev/userfaultfd
On hosts with new enough kernel which supports /dev/userfaultfd libvirt will
now automatically grant QEMU access to this device. It's no longer needed to
set vm.unprivileged_userfaultfd sysctl.
* qemu: Support clusters in CPU topology
It is now possible to configure the guest CPU topology to use clusters.
Additionally, if CPU clusters are present in the host topology, they will
be reported as part of the capabilities XML.
* network: Make virtual domains resolvable from the host
When starting a virtual network with a new ``register='yes'`` attribute
in the ``<domain>`` element, libvirt will configure ``systemd-resolved``
to resolve names of the connected guests using the name server started
for this network.
* qemu: Introduce dynamicMemslots attribute for virtio-mem
QEMU now allows setting ``.dynamic-memslots`` attribute for virtio-mem-pci
devices. When turned on, it allows memory exposed to guest to be split into
multiple memory slots and thus smaller memory footprint (see the original
commit for detailed explanation).
* Improvements
* nodedev: Add ability to update persistent mediated devices by defining them
Existing persistent mediated devices can now also be updated by
``virNodeDeviceDefineXML()`` as long as parent and UUID remain unchanged.
* ch: Enable ``ethernet`` interface mode support
``<interface type='ethernet'/>`` can now be used for CH domains.
* viraccessdriverpolkit: Add missing vtpm case
Secrets with ``<usage type='vtpm'>`` were left unable to be checked for in
the access driver, i.e. in ACL rules. Missing code was provided.
* virt-admin: Notify users to use explicit URI if connection fails
``virt-admin`` doesn't try to guess the URI of the daemon to manage so a
failure to connect may be confusing for users if modular daemons are used.
Add a hint to use the URI of the dameon to manage.
* Bug fixes
* qemu_process: Skip over non-virtio non-TAP NIC models when refreshing rx-filter
If ``trustGuestRxFilters`` is enabled for a vNIC that doesn't support it,
libvirt may throw an error when such domain is being started, loaded from a
saved state, migrated, etc. These errors are now silenced, but make sure to
fix such configurations (after previous release it is even possible to
change ``trustGuestRxFilters`` value on live domains via
``virDomainUpdateDeviceFlags()`` or ``virsh device-update``).
* domain: Fix check for overlapping ``<memory/>`` devices
A bug was identified which caused libvirt to report two NVDIMMs as
overlapping even though they weren't. This now fixed.
* vmx: Accept empty fileName for cdrom-image
Turns out, ``fileName`` attribute (which contains path to CDROM image) can
be set to an empty string (``""``) to denote a state in which the CDROM has
no medium in it. Libvirt used to reject such configuration file, but not
anymore.
* qemu_hotplug: Don't lose 'created' flag in qemuDomainChangeNet()
When starting a domain, libvirt tracks what resources it created for it and
which were pre-existing and uses this information to preserve pre-existing
resources when cleaning up after said domain is shut off. But for macvtaps
this information was lost after the macvtap device was changed (e.g. via
``virsh update-device``).
* Fix virStream hole handling
When a client sent multiple holes into a virStream it may have caused
daemon hangup as the daemon stopped processing RPC from the client
temporarily. This is now fixed.
* nodedev: Don't generate broken XML with certain hardware
A broken node device XML would be generated in a rare case when a hardware
device had certain characters in the VPD fields.
* qemu: Fix reservation of manually specified port for disk migration
A manually specified port would not be relased after disk migration making
it impossible to use it again.
Enjoy.
Jirka
1 year, 1 month
[PATCH] NEWS: Update for release
by Peter Krempa
Mention improvement of virt-admin, and fixes for the VPD xml and disk
migration port bug.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
NEWS.rst | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/NEWS.rst b/NEWS.rst
index d270b2397d..4a71c7d3f0 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -52,7 +52,7 @@ v10.1.0 (unreleased)
* **Improvements**
-* nodedev: Add ability to update persistent mediated devices by defining them
+ * nodedev: Add ability to update persistent mediated devices by defining them
Existing persistent mediated devices can now also be updated by
``virNodeDeviceDefineXML()`` as long as parent and UUID remain unchanged.
@@ -66,6 +66,12 @@ v10.1.0 (unreleased)
Secrets with ``<usage type='vtpm'>`` were left unable to be checked for in
the access driver, i.e. in ACL rules. Missing code was provided.
+ * virt-admin: Notify users to use explicit URI if connection fails
+
+ ``virt-admin`` doesn't try to guess the URI of the daemon to manage so a
+ failure to connect may be confusing for users if modular daemons are used.
+ Add a hint to use the URI of te dameon to manage.
+
* **Bug fixes**
* qemu_process: Skip over non-virtio non-TAP NIC models when refreshing rx-filter
@@ -103,6 +109,16 @@ v10.1.0 (unreleased)
daemon hangup as the daemon stopped processing RPC from the client
temporarily. This is now fixed.
+ * nodedev: Don't generate broken XML with certain hardware
+
+ A broken node device XML would be generated in a rare case when a hardware
+ device had certain characters in the VPD fields.
+
+ * qemu: Fix reservation of manually specified port for disk migration
+
+ A manually specified port would not be relased after disk migration making
+ it impossible to use it again.
+
v10.0.0 (2024-01-15)
====================
--
2.43.0
1 year, 1 month
