July 2026 - Devel - libvirt List Archives

[PATCH] NEWS: document bhyve changes for 12.6.0
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..c874a5443e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,11 @@ v12.6.0 (unreleased) * **New features** + * bhyve: implement ``virDomainRename()`` + + The bhyve driver now implements the ``virDomainRename()`` API + for renaming of a domain (``virsh domrename``). + * **Improvements** * **Bug fixes** -- 2.52.0

1 0

[PATCH] bhyve: clean up event thread
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Currently, eventThread cleanup is missing. Fix that by calling virBhyveDomainObjStopWorker() in virBhyveProcessStop() and un-referring the eventThread in bhyveDomainObjPrivateFree(). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- I think it would be nice to get this in before 12.6.0. src/bhyve/bhyve_domain.c | 5 +++++ src/bhyve/bhyve_process.c | 2 ++ 2 files changed, 7 insertions(+) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index d5bb22501c..b6344185b7 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -54,6 +54,11 @@ bhyveDomainObjPrivateFree(void *data) virDomainPCIAddressSetFree(priv->pciaddrs); + if (priv->eventThread) { + VIR_ERROR(_("Unexpected event thread still active during domain deletion")); + g_object_unref(priv->eventThread); + } + g_free(priv); } diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 636d74afcc..81f00954c2 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -675,6 +675,8 @@ virBhyveProcessStop(struct _bhyveConn *driver, if ((priv != NULL) && (priv->mon != NULL)) g_clear_pointer(&priv->mon, bhyveMonitorClose); + virBhyveDomainObjStopWorker(vm); + cmd = virBhyveProcessBuildDestroyCmd(driver, vm->def); if (virCommandRun(cmd, NULL) < 0) { /* Only failure of the actual destroy command warrants unsuccessful return code, -- 2.52.0

1 0

[PATCH 0/3] bhyve: fix a few memory leaks
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Roman Bogorodskiy (3): bhyve: fix memory leak in bhyveBuildVirtioSerialControllerArgStr() network: pf: fix memory leaks bhyve: fix memory leak in bhyveStateCleanup() src/bhyve/bhyve_command.c | 4 +++- src/bhyve/bhyve_driver.c | 1 + src/network/network_pf.c | 20 +++++++++++++------- 3 files changed, 17 insertions(+), 8 deletions(-) -- 2.52.0

2 4

[PATCH] NEWS: Update with recent feature additions
by Jim Fehlig 25 Jul '26

25 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> Add NEWS entries for the new libvirtd build option and new sanlock plugin setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..e986cf8c9a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,17 @@ v12.6.0 (unreleased) * **New features** + * build: Add option to control building libvirtd + + Meson option ``libvirtd`` has been added to control building the monolithic + libvirtd, independent from the stateful, daemon-based drivers. + + * sanlock: Add option to check ownership of disk leases + + The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` + setting in sanlock.conf. When enabled, the sanlock plugin will check that + leases are owned by the domain attempting to acquire them. + * **Improvements** * **Bug fixes** -- 2.51.0

2 2

Incorrent lookup function argument types in libvirt-python API binding
by Krzysztoff 24 Jul '26

24 Jul '26

For some time now I've been developing an app using the libvirt-python package. I think I might have spotted an issue with *lookupByUUID* and *lookupByUUIDString* functions. First of all, when these functions are passed an argument (machine UUID) they require it to be in a specific format (16 byte string), however, *there is virtually no information about this in the documentation* about this - I managed to find out about this by testing it manually. Hypothetically - let's take *machine_uuid* of type UUID. 1. This will throw an error: [...].lookupByUUID(machine_uuid) 2. This will work properly: [...].lookupByUUID(machine_uuid.*bytes*) Secondly, in the newest version of libvirt-python (12.5.0) the expected argument type of function *lookupByUUID* has been changed to *str*. This causes Python interpreter to highlight all occurrences of lookupByUUID and show errors: Argument of type "bytes" cannot be assigned to parameter "uuid" of type > "str" in function "lookupByUUID" > "bytes" is not assignable to "str" Weirdly enough, no actual runtime error is thrown and the lookups work perfectly fine. However if the argument is actually casted to str the lookup fails with virDomainLookupByUUIDString() failed error. More importantly - this change in the argument type makes absolutely no sense, since now the function lookupByUUID requires exactly the same argument as lookupByUUIDString - I suppose these functions were supposed to do different things but now they work exactly the same. def lookupByUUID(self, uuid: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its > UUID. """ > ret = libvirtmod.virDomainLookupByUUID(self._o, uuid) > if ret is None: > raise libvirtError('virDomainLookupByUUID() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp > > def lookupByUUIDString(self, uuidstr: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its UUID > virDomainFree should be used to free the resources after the > domain object is no longer needed. """ > ret = libvirtmod.virDomainLookupByUUIDString(self._o, uuidstr) > if ret is None: > raise libvirtError('virDomainLookupByUUIDString() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp Best regards, Krzysztoff

1 0

[PATCH 1/2] util: Guard against integer overflow in nexttimer
by Yong Chen 24 Jul '26

24 Jul '26

The 'nexttimer' variable is a static int that starts at 1 and is incremented every time a new timeout is registered via virEventGLibTimeoutAdd. After running for a long period of time (many months/years with frequent client connections), nexttimer can overflow past INT_MAX and become negative. A negative timer ID causes multiple problems: 1. virKeepAliveStart: 'if (ka->timer < 0)' returns true, skipping virObjectRef() which is needed to hold the timer's reference to the keepalive object. This leads to premature object freeing. 2. virKeepAliveStop: 'if (ka->timer > 0)' returns false, skipping virEventRemoveTimeout(). The GSource is never destroyed, causing a use-after-free when the timer fires on the freed object. 3. virNetServerClientNew: 'if (client->sockTimer < 0)' returns true, causing client creation to fail with 'Connection reset by peer'. In a production environment running for 1 year and 8 months, nexttimer overflowed and accumulated 282 million leaked timer entries, consuming 19.6GB of memory. Fix by resetting nexttimer to 1 when it overflows below 1, ensuring timer IDs are always positive. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/util/vireventglib.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/util/vireventglib.c b/src/util/vireventglib.c index 6c54f62123..6fe23b3b7d 100644 --- a/src/util/vireventglib.c +++ b/src/util/vireventglib.c @@ -341,6 +341,9 @@ virEventGLibTimeoutAdd(int interval, data = g_new0(struct virEventGLibTimeout, 1); data->timer = nexttimer++; + /* Guard against integer overflow: timer IDs must be positive */ + if (nexttimer < 1) + nexttimer = 1; data->interval = interval; data->cb = cb; data->opaque = opaque; -- 2.55.0.windows.3

2 1

[libvirt PATCH] build: Check for directory in the git_werror check
by Ján Tomko 23 Jul '26

23 Jul '26

From: Jordan Petridis <jpetridis(a)gnome.org> test -e will only check if something exists, but -d is more appropriate as it will check that it exists and is also a directory. Signed-off-by: Jordan Petridis <jpetridis(a)gnome.org> Reviewed-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index ad1a5da1a5..6d5085042c 100644 --- a/meson.build +++ b/meson.build @@ -21,7 +21,7 @@ po_dir = meson.project_source_root() / 'po' # figure out if we are building from git -git = run_command('test', '-e', '.git', check: false).returncode() == 0 +git = run_command('test', '-d', '.git', check: false).returncode() == 0 if git and not get_option('no_git') run_command('git', 'submodule', 'update', '--init', check: true) -- 2.55.0

1 0

[PATCH 2/2] rpc: Use != -1 instead of > 0 for timer ID checks
by Yong Chen 23 Jul '26

23 Jul '26

The timer ID stored in ka->timer uses -1 as the sentinel value meaning 'not initialized' (set in virKeepAliveNew). The checks in virKeepAliveStop and virKeepAliveDispose used '> 0' or '>= 0' to determine whether a timer is active. However, if nexttimer overflows (see previous fix in vireventglib.c), ka->timer can be a negative value other than -1 (e.g., -2147483648). In that case: - 'if (ka->timer > 0)' returns false -> virEventRemoveTimeout skipped - 'if (ka->timer >= 0)' returns false -> virEventRemoveTimeout skipped This leaves the GSource active after the keepalive object is freed, causing a use-after-free with 'bad magic number' warnings in the log. Fix by changing the checks to 'if (ka->timer != -1)', which correctly handles both positive and negative timer IDs while still skipping the sentinel value -1. Additionally, add the same check in virKeepAliveDispose as a safety net: if the object's refcount reaches 0 due to a race condition or reference counting bug, the timer must be stopped before the object is freed. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/rpc/virkeepalive.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/rpc/virkeepalive.c b/src/rpc/virkeepalive.c index 690bc08b2e..4e7dd25d3c 100644 --- a/src/rpc/virkeepalive.c +++ b/src/rpc/virkeepalive.c @@ -218,6 +218,18 @@ virKeepAliveDispose(void *obj) PROBE(RPC_KEEPALIVE_DISPOSE, "ka=%p", ka); + /* Ensure the timer is stopped before freeing the object. + * This is a safety net: normally virKeepAliveStop is called + * before the object's refcount reaches 0, but in case of + * race conditions or reference counting bugs, we must not + * leave a dangling timer that would trigger use-after-free. + * Use != -1 (not >= 0) to also handle negative timer IDs + * caused by nexttimer integer overflow. */ + if (ka->timer != -1) { + virEventRemoveTimeout(ka->timer); + ka->timer = -1; + } + ka->freeCB(ka->client); } @@ -301,7 +313,7 @@ virKeepAliveStop(virKeepAlive *ka) "ka=%p client=%p", ka, ka->client); - if (ka->timer > 0) { + if (ka->timer ！= -1) { virEventRemoveTimeout(ka->timer); ka->timer = -1; } -- 2.55.0.windows.3

1 0

[PATCH 0/2] Fix use-after-free caused by timer ID integer overflow
by Yong Chen 23 Jul '26

23 Jul '26

The 'nexttimer' counter in vireventglib.c is a static int starting at 1, incremented for every new timeout registration. After running for a long period (1+ years with frequent client connections), it overflows past INT_MAX and becomes negative. A negative timer ID causes multiple issues: 1. virKeepAliveStart: skips virObjectRef(), leaving the keepalive object with only 1 reference (should be 2). When the connection closes, virObjectUnref() drops refcount to 0, freeing the object while the GSource is still active -> use-after-free with 'bad magic number' logs. 2. virKeepAliveStop: skips virEventRemoveTimeout(), the GSource is never destroyed, continuing to fire on freed memory. 3. virNetServerClientNew: sockTimer creation fails, all new connections rejected with 'Connection reset by peer'. In production (libvirtd running 1 year 8 months), this caused: - 1 leaked keepalive GSource (use-after-free, continuous 'bad magic' logs) - 282 million leaked sockTimer structures (19.6GB RSS) - All virsh commands failing with 'Connection reset by peer' Patch 1: Prevent nexttimer overflow in vireventglib.c (root cause fix) Patch 2: Fix timer ID checks in virkeepalive.c (defensive fix, use != -1 instead of > 0 to handle negative IDs) Yong Chen (2): util: Guard against integer overflow in nexttimer rpc: Use != -1 instead of > 0 for timer ID checks src/rpc/virkeepalive.c | 14 +++++++++++++- src/util/vireventglib.c | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-) -- 2.55.0.windows.3

1 0

[PATCH 00/13] qemu: Refactor panic action handling and introduce 'preserve-running' action for <on_crash>
by Peter Krempa 23 Jul '26

23 Jul '26

See last patch for justification of the new feature, the rest of the patches cleans up existing code. Peter Krempa (13): qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' qemu: Remove unused 'qemuProcessRebootAllowed' qemu: monitor: Remove support for 'watchdog-set-action' qemu: Remove 'allowReboot' field qemu: capabilities: Retire QEMU_CAPS_SET_ACTION qemuProcessSetupLifecycleActions: Prepare to handle other actions qemuDomainModifyLifecycleActionLive: Prepare to handle other actions processGuestPanicEvent: Don't pass panic action via parameter conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message qemuProcessGuestPanicEventInfo: Fold into only caller qemu: processGuestPanicEvent: Split individual steps under separate conditions Add support for keeping VM running when panic notifier is used docs/formatdomain.rst | 3 + include/libvirt/libvirt-domain.h | 1 + src/conf/domain_conf.c | 12 +- src/conf/domain_conf.h | 9 +- src/conf/schemas/domaincommon.rng | 2 + src/libxl/libxl_conf.c | 1 + src/libxl/libxl_domain.c | 3 + src/libxl/xen_common.c | 10 +- src/qemu/qemu_capabilities.c | 3 +- src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 13 +- src/qemu/qemu_domain.c | 33 --- src/qemu/qemu_domain.h | 17 -- src/qemu/qemu_driver.c | 189 +++++++++++------- src/qemu/qemu_hotplug.c | 10 +- src/qemu/qemu_monitor.c | 52 ++--- src/qemu/qemu_monitor.h | 4 - src/qemu/qemu_monitor_json.c | 22 -- src/qemu/qemu_monitor_json.h | 5 - src/qemu/qemu_process.c | 88 +++----- src/qemu/qemu_process.h | 2 - src/qemu/qemu_validate.c | 14 +- .../caps_10.0.0_aarch64.xml | 1 - .../caps_10.0.0_ppc64.xml | 1 - .../caps_10.0.0_s390x.xml | 1 - .../caps_10.0.0_x86_64+amdsev.xml | 1 - .../caps_10.0.0_x86_64.xml | 1 - .../caps_10.1.0_s390x.xml | 1 - .../caps_10.1.0_x86_64+inteltdx.xml | 1 - .../caps_10.1.0_x86_64.xml | 1 - .../caps_10.2.0_aarch64.xml | 1 - .../caps_10.2.0_x86_64+mshv.xml | 1 - .../caps_10.2.0_x86_64.xml | 1 - .../caps_11.0.0_aarch64.xml | 1 - .../caps_11.0.0_s390x.xml | 1 - .../caps_11.0.0_x86_64+sgx.xml | 1 - .../caps_11.0.0_x86_64.xml | 1 - .../caps_11.1.0_aarch64.xml | 1 - .../caps_11.1.0_x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 1 - .../caps_7.2.0_x86_64+hvf.xml | 1 - .../caps_7.2.0_x86_64.xml | 1 - .../caps_8.0.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_8.1.0_s390x.xml | 1 - .../caps_8.1.0_x86_64.xml | 1 - .../caps_8.2.0_aarch64.xml | 1 - .../caps_8.2.0_armv7l.xml | 1 - .../caps_8.2.0_loongarch64.xml | 1 - .../qemucapabilitiesdata/caps_8.2.0_s390x.xml | 1 - .../caps_8.2.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_9.0.0_sparc.xml | 1 - .../caps_9.0.0_x86_64.xml | 1 - .../caps_9.1.0_riscv64.xml | 1 - .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 - .../caps_9.1.0_x86_64.xml | 1 - .../caps_9.2.0_aarch64+hvf.xml | 1 - .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 - .../caps_9.2.0_x86_64+amdsev.xml | 1 - .../caps_9.2.0_x86_64.xml | 1 - .../qemustatusxml2xmldata/backup-pull-in.xml | 1 - .../blockjob-blockdev-in.xml | 1 - .../blockjob-mirror-in.xml | 1 - .../memory-backing-dir-in.xml | 1 - .../migration-in-params-in.xml | 1 - .../migration-out-nbd-bitmaps-in.xml | 1 - .../migration-out-nbd-out.xml | 1 - .../migration-out-nbd-tls-out.xml | 1 - .../migration-out-params-in.xml | 1 - tests/qemustatusxml2xmldata/modern-in.xml | 1 - .../qcow2-data-file-in.xml | 1 - .../throttlefilter-out.xml | 1 - tests/qemustatusxml2xmldata/upgrade-out.xml | 1 - .../qemustatusxml2xmldata/vcpus-multi-in.xml | 1 - .../async-teardown.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/async-teardown.xml | 2 +- tests/qemuxmlconftest.c | 1 + tools/virsh-domain.c | 3 +- 77 files changed, 209 insertions(+), 345 deletions(-) -- 2.55.0

2 19