October 2026 - Devel - libvirt List Archives

[PATCH] rpc: Deny REMOTE_PROC_AUTH_SASL_STEP without REMOTE_PROC_AUTH_SASL_START
by Michal Privoznik 30 Oct '26

30 Oct '26

From: Michal Privoznik <mprivozn(a)redhat.com> The usual flow of SASL is REMOTE_PROC_AUTH_SASL_INIT followed by REMOTE_PROC_AUTH_SASL_START which can either complete authentication or require further steps which are then done by calling REMOTE_PROC_AUTH_SASL_STEP (multiple times even). But if a malicious client skips the SASL_START step and calls SASL_INIT followed by SASL_STEP then the 'sasl->conn' structure inside of virNetSASLSessionServerStep() is not fully allocated (most notably the list of auth mechanisms 'mech' is NULL). But then sasl_server_step() dereferences that pointer leading to a crash. Fix this by disallowing SASL_STEP until SASL_START completed successfully. Fixes: CVE-2026-119151 Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/940 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/libvirt_sasl.syms | 1 + src/remote/remote_daemon_dispatch.c | 8 +++++--- src/rpc/virnetsaslcontext.c | 25 +++++++++++++++++++++++++ src/rpc/virnetsaslcontext.h | 2 ++ 4 files changed, 33 insertions(+), 3 deletions(-) diff --git a/src/libvirt_sasl.syms b/src/libvirt_sasl.syms index 405ba1813e..c2a9144f0e 100644 --- a/src/libvirt_sasl.syms +++ b/src/libvirt_sasl.syms @@ -18,6 +18,7 @@ virNetSASLSessionExtKeySize; virNetSASLSessionGetIdentity; virNetSASLSessionGetKeySize; virNetSASLSessionGetMaxBufSize; +virNetSASLSessionIsStarted; virNetSASLSessionListMechanisms; virNetSASLSessionNewClient; virNetSASLSessionNewServer; diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index e548438250..a813111c8d 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -3942,7 +3942,8 @@ remoteDispatchAuthSaslStart(virNetServer *server, VIR_DEBUG("Start SASL auth %d", virNetServerClientGetFD(client)); if (virNetServerClientGetAuth(client) != VIR_NET_SERVER_SERVICE_AUTH_SASL || - priv->sasl == NULL) { + priv->sasl == NULL || + virNetSASLSessionIsStarted(priv->sasl)) { VIR_ERROR(_("client tried invalid SASL start request")); goto authfail; } @@ -4033,8 +4034,9 @@ remoteDispatchAuthSaslStep(virNetServer *server, VIR_DEBUG("Step SASL auth %d", virNetServerClientGetFD(client)); if (virNetServerClientGetAuth(client) != VIR_NET_SERVER_SERVICE_AUTH_SASL || - priv->sasl == NULL) { - VIR_ERROR(_("client tried invalid SASL start request")); + priv->sasl == NULL || + !virNetSASLSessionIsStarted(priv->sasl)) { + VIR_ERROR(_("client tried invalid SASL step request")); goto authfail; } diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index 8692703117..e6b57b7b95 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -43,6 +43,7 @@ struct _virNetSASLSession { sasl_conn_t *conn; size_t maxbufsize; sasl_callback_t *callbacks; + bool started; }; @@ -529,6 +530,13 @@ int virNetSASLSessionServerStart(virNetSASLSession *sasl, int ret = -1; virObjectLock(sasl); + + if (sasl->started) { + virReportError(VIR_ERR_AUTH_FAILED, "%s", + _("unexpected state of SASL session")); + goto cleanup; + } + err = sasl_server_start(sasl->conn, mechname, clientin, @@ -542,13 +550,16 @@ int virNetSASLSessionServerStart(virNetSASLSession *sasl, case SASL_OK: if (virNetSASLSessionUpdateBufSize(sasl) < 0) goto cleanup; + sasl->started = true; ret = VIR_NET_SASL_COMPLETE; break; case SASL_CONTINUE: ret = VIR_NET_SASL_CONTINUE; + sasl->started = true; break; case SASL_INTERACT: ret = VIR_NET_SASL_INTERACT; + sasl->started = true; break; default: virReportError(VIR_ERR_AUTH_FAILED, @@ -575,6 +586,13 @@ int virNetSASLSessionServerStep(virNetSASLSession *sasl, int ret = -1; virObjectLock(sasl); + + if (sasl->started == false) { + virReportError(VIR_ERR_AUTH_FAILED, "%s", + _("unexpected state of SASL session")); + goto cleanup; + } + err = sasl_server_step(sasl->conn, clientin, inlen, @@ -707,6 +725,13 @@ void virNetSASLSessionDispose(void *obj) g_free(sasl->callbacks); } +bool virNetSASLSessionIsStarted(virNetSASLSession *sasl) +{ + VIR_LOCK_GUARD lock = virObjectLockGuard(sasl); + + return sasl->started; +} + #ifdef __APPLE__ VIR_WARNINGS_RESET #endif diff --git a/src/rpc/virnetsaslcontext.h b/src/rpc/virnetsaslcontext.h index 7202822e5b..5bfb273e67 100644 --- a/src/rpc/virnetsaslcontext.h +++ b/src/rpc/virnetsaslcontext.h @@ -109,3 +109,5 @@ ssize_t virNetSASLSessionDecode(virNetSASLSession *sasl, size_t inputLen, const char **output, size_t *outputlen); + +bool virNetSASLSessionIsStarted(virNetSASLSession *sasl); -- 2.56.0

4 6

[PATCH v2] rpc: Deny REMOTE_PROC_AUTH_SASL_STEP without REMOTE_PROC_AUTH_SASL_START
by Michal Privoznik 30 Oct '26

30 Oct '26

From: Michal Privoznik <mprivozn(a)redhat.com> The usual flow of SASL is REMOTE_PROC_AUTH_SASL_INIT followed by REMOTE_PROC_AUTH_SASL_START which can either complete authentication or require further steps which are then done by calling REMOTE_PROC_AUTH_SASL_STEP (multiple times even). But if a malicious client skips the SASL_START step and calls SASL_INIT followed by SASL_STEP then the 'sasl->conn' structure inside of virNetSASLSessionServerStep() is not fully allocated (most notably the list of auth mechanisms 'mech' is NULL). But then sasl_server_step() dereferences that pointer leading to a crash. Fix this by disallowing SASL_STEP until SASL_START completed successfully. Fixes: CVE-2026-119151 Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/940 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3R2J… diff to v1: - Implement a state machine to allow just INIT -> START [-> STEP [-> STEP ...]] and nothing else, - Drop checks additional from remote_daemon_dispatch.c (they were only there to report a nicer error message anyways). src/remote/remote_daemon_dispatch.c | 2 +- src/rpc/virnetsaslcontext.c | 31 +++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index e548438250..2f1861f5bb 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -4034,7 +4034,7 @@ remoteDispatchAuthSaslStep(virNetServer *server, VIR_DEBUG("Step SASL auth %d", virNetServerClientGetFD(client)); if (virNetServerClientGetAuth(client) != VIR_NET_SERVER_SERVICE_AUTH_SASL || priv->sasl == NULL) { - VIR_ERROR(_("client tried invalid SASL start request")); + VIR_ERROR(_("client tried invalid SASL step request")); goto authfail; } diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index 8692703117..325ebd915e 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -37,12 +37,20 @@ struct _virNetSASLContext { unsigned int tcpMinSSF; }; +typedef enum virNetSASLSessionState virNetSASLSessionState; +enum virNetSASLSessionState { + VIR_NET_SASL_SESSION_STATE_INIT, + VIR_NET_SASL_SESSION_STATE_START, + VIR_NET_SASL_SESSION_STATE_STEP +}; + struct _virNetSASLSession { virObjectLockable parent; sasl_conn_t *conn; size_t maxbufsize; sasl_callback_t *callbacks; + virNetSASLSessionState state; }; @@ -248,6 +256,8 @@ virNetSASLSession *virNetSASLSessionNewServer(virNetSASLContext *ctxt G_GNUC_UNU goto cleanup; } + sasl->state = VIR_NET_SASL_SESSION_STATE_INIT; + return sasl; cleanup: @@ -529,6 +539,13 @@ int virNetSASLSessionServerStart(virNetSASLSession *sasl, int ret = -1; virObjectLock(sasl); + + if (sasl->state != VIR_NET_SASL_SESSION_STATE_INIT) { + virReportError(VIR_ERR_AUTH_FAILED, "%s", + _("unexpected state of SASL session")); + goto cleanup; + } + err = sasl_server_start(sasl->conn, mechname, clientin, @@ -542,12 +559,15 @@ int virNetSASLSessionServerStart(virNetSASLSession *sasl, case SASL_OK: if (virNetSASLSessionUpdateBufSize(sasl) < 0) goto cleanup; + sasl->state = VIR_NET_SASL_SESSION_STATE_START; ret = VIR_NET_SASL_COMPLETE; break; case SASL_CONTINUE: + sasl->state = VIR_NET_SASL_SESSION_STATE_START; ret = VIR_NET_SASL_CONTINUE; break; case SASL_INTERACT: + sasl->state = VIR_NET_SASL_SESSION_STATE_START; ret = VIR_NET_SASL_INTERACT; break; default: @@ -575,6 +595,14 @@ int virNetSASLSessionServerStep(virNetSASLSession *sasl, int ret = -1; virObjectLock(sasl); + + if (sasl->state != VIR_NET_SASL_SESSION_STATE_START && + sasl->state != VIR_NET_SASL_SESSION_STATE_STEP) { + virReportError(VIR_ERR_AUTH_FAILED, "%s", + _("unexpected state of SASL session")); + goto cleanup; + } + err = sasl_server_step(sasl->conn, clientin, inlen, @@ -587,12 +615,15 @@ int virNetSASLSessionServerStep(virNetSASLSession *sasl, case SASL_OK: if (virNetSASLSessionUpdateBufSize(sasl) < 0) goto cleanup; + sasl->state = VIR_NET_SASL_SESSION_STATE_STEP; ret = VIR_NET_SASL_COMPLETE; break; case SASL_CONTINUE: + sasl->state = VIR_NET_SASL_SESSION_STATE_STEP; ret = VIR_NET_SASL_CONTINUE; break; case SASL_INTERACT: + sasl->state = VIR_NET_SASL_SESSION_STATE_STEP; ret = VIR_NET_SASL_INTERACT; break; default: -- 2.56.0

1 0

[PATCH] bhyve: respect network MTU
by Roman Bogorodskiy 30 Oct '26

30 Oct '26

Update the bhyve driver to propagate the network interface's MTU: - Configure the SLIRP backend MTU for user networking. - Configure the TAP interface MTU for bridge networking. - Advertise the MTU to the guest for virtio-net devices. The e1000 device does not support advertising an MTU to the guest. Its backend MTU is still configured, but the guest interface must be configured separately. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 19 ++++++++---- .../x86_64/bhyvexml2argv-net-mtu-bridge.args | 11 +++++++ .../bhyvexml2argv-net-mtu-bridge.ldargs | 4 +++ .../x86_64/bhyvexml2argv-net-mtu-bridge.xml | 31 +++++++++++++++++++ .../x86_64/bhyvexml2argv-net-mtu-slirp.args | 11 +++++++ .../x86_64/bhyvexml2argv-net-mtu-slirp.ldargs | 4 +++ .../x86_64/bhyvexml2argv-net-mtu-slirp.xml | 29 +++++++++++++++++ tests/bhyvexml2argvmock.c | 8 +++-- tests/bhyvexml2argvtest.c | 2 ++ 9 files changed, 111 insertions(+), 8 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.xml diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 09ef61e798..7e3d3d4553 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -49,6 +49,7 @@ bhyveBuildNetArgStr(const virDomainDef *def, virCommand *cmd, bool dryRun) { + g_auto(virBuffer) netarg = VIR_BUFFER_INITIALIZER; char macaddr[VIR_MAC_STRING_BUFLEN]; char *realifname = NULL; const char *brname = NULL; @@ -97,8 +98,11 @@ bhyveBuildNetArgStr(const virDomainDef *def, break; case VIR_DOMAIN_NET_TYPE_USER: virCommandAddArg(cmd, "-s"); - virCommandAddArgFormat(cmd, "%d:0,%s,slirp,mac=%s,open", - net->info.addr.pci.slot, nic_model, macaddr); + virBufferAsprintf(&netarg, "%d:0,%s,slirp,mac=%s,open", + net->info.addr.pci.slot, nic_model, macaddr); + if (net->mtu) + virBufferAsprintf(&netarg, ",mtu=%u", net->mtu); + virCommandAddArgBuffer(cmd, &netarg); return 0; case VIR_DOMAIN_NET_TYPE_ETHERNET: case VIR_DOMAIN_NET_TYPE_DIRECT: @@ -125,7 +129,7 @@ bhyveBuildNetArgStr(const virDomainDef *def, virDomainNetGetActualVirtPortProfile(net), virDomainNetGetActualVlan(net), virDomainNetGetActualPortOptionsIsolated(net), - NULL, 0, NULL, + NULL, net->mtu, NULL, VIR_NETDEV_TAP_CREATE_IFUP | VIR_NETDEV_TAP_CREATE_PERSIST) < 0) { goto cleanup; } @@ -148,9 +152,12 @@ bhyveBuildNetArgStr(const virDomainDef *def, virCommandAddArg(cmd, "-s"); - virCommandAddArgFormat(cmd, "%d:0,%s,%s,mac=%s", - net->info.addr.pci.slot, nic_model, - realifname, macaddr); + virBufferAsprintf(&netarg, "%d:0,%s,%s,mac=%s", + net->info.addr.pci.slot, nic_model, + realifname, macaddr); + if (net->mtu && net->model == VIR_DOMAIN_NET_MODEL_VIRTIO) + virBufferAsprintf(&netarg, ",mtu=%u", net->mtu); + virCommandAddArgBuffer(cmd, &netarg); ret = 0; cleanup: diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.args new file mode 100644 index 0000000000..6eb2da65ed --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.args @@ -0,0 +1,11 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:00:00:01,mtu=9000 \ +-s 4:0,e1000,faketapdev,mac=52:54:00:00:00:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.xml new file mode 100644 index 0000000000..6ed278b0d7 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-bridge.xml @@ -0,0 +1,31 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:00:00:01'/> + <source bridge='mtu-br0'/> + <model type='virtio'/> + <mtu size='9000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='bridge'> + <mac address='52:54:00:00:00:02'/> + <source bridge='mtu-br0'/> + <model type='e1000'/> + <mtu size='9000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.args new file mode 100644 index 0000000000..0f67b4aa43 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.args @@ -0,0 +1,11 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,slirp,mac=52:54:00:00:00:01,open,mtu=9000 \ +-s 4:0,e1000,slirp,mac=52:54:00:00:00:02,open,mtu=9000 \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.xml new file mode 100644 index 0000000000..ff2467fda4 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-net-mtu-slirp.xml @@ -0,0 +1,29 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='user'> + <mac address='52:54:00:00:00:01'/> + <model type='virtio'/> + <mtu size='9000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <interface type='user'> + <mac address='52:54:00:00:00:02'/> + <model type='e1000'/> + <mtu size='9000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvmock.c b/tests/bhyvexml2argvmock.c index 2248b721d0..93289ba572 100644 --- a/tests/bhyvexml2argvmock.c +++ b/tests/bhyvexml2argvmock.c @@ -61,7 +61,7 @@ void virMacAddrGenerate(const unsigned char prefix[VIR_MAC_PREFIX_BUFLEN], addr->addr[5] = 0; } -int virNetDevTapCreateInBridgePort(const char *brname G_GNUC_UNUSED, +int virNetDevTapCreateInBridgePort(const char *brname, char **ifname, const virMacAddr *macaddr G_GNUC_UNUSED, const unsigned char *vmuuid G_GNUC_UNUSED, @@ -72,10 +72,14 @@ int virNetDevTapCreateInBridgePort(const char *brname G_GNUC_UNUSED, const virNetDevVlan *virtVlan G_GNUC_UNUSED, virTristateBool isolatedPort G_GNUC_UNUSED, virNetDevCoalesce *coalesce G_GNUC_UNUSED, - unsigned int mtu G_GNUC_UNUSED, + unsigned int mtu, unsigned int *actualMTU G_GNUC_UNUSED, unsigned int fakeflags G_GNUC_UNUSED) { + /* Validate MTU passed by the net-mtu-bridge test */ + if (STREQ(brname, "mtu-br0") && mtu != 9000) + return -1; + VIR_FREE(*ifname); *ifname = g_strdup("vnet0"); return 0; diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 650563821b..0b700cc5b0 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -260,6 +260,8 @@ mymain(void) DO_TEST("serial-grub"); DO_TEST("localtime"); DO_TEST("net-e1000"); + DO_TEST("net-mtu-bridge"); + DO_TEST("net-mtu-slirp"); DO_TEST("passthru"); DO_TEST("passthru-multiple-devs"); DO_TEST("uefi"); -- 2.55.0

2 1

[PATCH] Ignore .wraplock file generated by meson
by Jiri Denemark 30 Oct '26

30 Oct '26

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 4695391342..c0ba8d79dd 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,6 @@ tags # clangd related ignores .clangd compile_commands.json + +# meson related ignores +/subprojects/.wraplock -- 2.56.0

2 1

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 29 Oct '26

29 Oct '26

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index bba5c66dac..f1353ac698 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -57,6 +57,14 @@ v12.9.0 (unreleased) event on the source host. The event includes the newly added VIR_DOMAIN_EVENT_UNDEFINED_MIGRATED detail. + * qemu: report guest reboot as shutdown detail for on_reboot=destroy + + Libvirt now reports the reason of shutdown event properly. + + * qemu: Consider vhost net for MSHV accelerator + + This release enables vhost networking for both KVM and MSHV accelerators. + * **Bug fixes** * bhyve: fix shutdown handling on arm64 @@ -64,6 +72,34 @@ v12.9.0 (unreleased) Signal-based shutdown now correctly handles bhyve terminating directly on arm64, preventing stopped domains from remaining reported as running. + * virpci: fix handling newline in PCI device class + + This releases fixes a regression introduced in ``v12.2.0`` release which + kept libvirt unable to parse PCI related files from a sysfs mount, if they + contained a newline character. + + * security: Check if R/O or shared disk is not directory + + Starting a domain with a read only disk (e.g. cdrom), or attaching one to + an already running domain might have resulted in mangled permissions, if a + directory was given as the disk source. + + * esx: Avoid integer overflow in esxDomainGetInfo() + + The ESX driver implementation for ``virDomainGetInfo()`` API fetches domain + memory size and domain max memory size in MiB and then multiplies both + values by factor of 1024, since the API reports those sizes in KiB. But + these multiplications can overflow and thus report invalid values. An error + is reported instead. + + * conf: Deny negative vcpu count + + If a negative value was specified for the number of vCPUs in domain XML, + libvirt would try to allocate absurdly large amounts of memory which would + trigger OOM killer and kill the daemon. Non-positive values are forbidden + now. + + v12.8.0 (2026-10-01) ==================== -- 2.56.0

2 1

[PATCH 0/5] virtio-blk: Deprecate silent truncation of serial
by Kevin Wolf 29 Oct '26

29 Oct '26

QEMU has allowed the user to specify serials of arbitrary length for virtio-blk devices, even though the virtio-blk protocol can only communicate 20 characters of the serial to the guest. This means that a longer serial number on the command line is silently truncated to 20 characters from the guest perspective. As a first step to fix this, deprecate the silent truncation and turn it into a warning; we can later make this a hard error. While touching GET_ID, let's make it more spec compliant and clean up the internal state. Another part is planned that will actually enable users to use longer serials and additional device identifiers. This will need spec changes and would take more time than we have until the QEMU 11.2 freeze anyway, so I'll address this later. For now, the important thing is to get the deprecation period started. Kevin Wolf (5): virtio-blk: Implement full NUL padding for GET_ID virtio-blk-test: Add a basic GET_ID test case virtio-blk: Deprecate silent truncation of serial virtio-blk: Represent truncated serial in qdev property virtio-blk-test: Test truncated serial docs/about/deprecated.rst | 13 +++++ hw/block/virtio-blk.c | 24 +++++++-- tests/qtest/virtio-blk-test.c | 92 +++++++++++++++++++++++++++++++++++ 3 files changed, 125 insertions(+), 4 deletions(-) -- 2.56.0

2 16

Plans for 12.9.0 release (freeze on 2026-10-26)
by Jiri Denemark 29 Oct '26

29 Oct '26

We are getting close to 12.9.0 release of libvirt. To aim for the release on Monday 02 Nov I suggest entering the freeze on Monday 26 Oct and tagging RC2 on Thursday 29 Oct. I hope this works for everyone. Jirka

1 1

[PATCH 0/2] A couple of memleak fixes
by Michal Privoznik 29 Oct '26

29 Oct '26

for upcoming release. Michal Prívozník (2): virnwfilterobj: Don't leak @objs in virNWFilterObjListExport() nwfilter: Release driver config in nwfilterStateCleanupLocked() src/conf/virnwfilterobj.c | 1 + src/nwfilter/nwfilter_driver.c | 1 + 2 files changed, 2 insertions(+) -- 2.56.0

2 3

Plans for 12.7.0 release (freeze on 2026-08-24)
by Jiri Denemark 29 Oct '26

29 Oct '26

We are getting close to 12.7.0 release of libvirt. To aim for the release on Tuesday 01 Sep I suggest entering the freeze on Monday 24 Aug and tagging RC2 on Thursday 27 Aug. I hope this works for everyone. Jirka

2 1

Re: [PULL 51/59] system: Remove deprecated 'debug-threads' option for -name
by Philippe Mathieu-Daudé 28 Oct '26

28 Oct '26

(Cc'ing migration compat and libvirt teams) On 28/10/26 02:01, Richard Henderson wrote: > On 10/27/26 14:23, Philippe Mathieu-Daudé wrote: >> 'debug-threads' option for -name was deprecated in v11.0 >> (commit 1b65aeed2a0 "system: unconditionally enable thread >> naming") thus can now be removed. >> >> Signed-off-by: Philippe Mathieu-Daudé<philmd(a)oss.qualcomm.com> >> Reviewed-by: Pierrick Bouvier<pierrick.bouvier(a)oss.qualcomm.com> >> Reviewed-by: Ján Tomko<jtomko(a)redhat.com> >> Reviewed-by: Dr. David Alan Gilbert<dave(a)treblig.org> >> Message-Id:<20261018232917.7716-1-philmd(a)oss.qualcomm.com> >> --- >> docs/about/deprecated.rst | 7 ------- >> docs/about/removed-features.rst | 9 +++++++-- >> system/vl.c | 11 ----------- >> tests/qtest/migration/framework.c | 4 ++-- >> tests/qtest/migration/precopy-tests.c | 2 +- >> qemu-options.hx | 7 +++---- >> 6 files changed, 13 insertions(+), 27 deletions(-) > > You need to remove this from the testsuite as well: > > https://gitlab.com/qemu-project/qemu/-/jobs/17523155796#L58 Hmm I was surprised because the pipeline in my fork passed, but then looking clearer this job is marked as "allow_failure: true" for me, why is it blocking on the mainstream repo? Back to the test, this is the migration-compat-x86_64 job running previous release binary vs latest one, so I'd think this is the expected behavior, v11.0 and v11.1 have that deprecated option, and we can not test vs v11.2 which removed it. If we want to change that workflow, then when deprecating on v11.0 we also need to remove the tests coverage, so when we remove the feature at $deprecation_release+2 the migration-compat test does not break. Here the question is, do we want to keep testing deprecated features? Maybe yes in the case of unmaintained area when the deprecation process triggers new maintainers stepping in and the deprecation to be cancelled. We could also mark the feature removed but keep it ignored and undocumented until the next release but we'll likely forget and miss that in workflow so I don't recommend that way. Maybe there are another ways to resolve that but I'm not seeing them. Ideas?

4 4