July 2026 - Devel - libvirt List Archives

[PATCH] NEWS: document bhyve changes for 12.6.0
by Roman Bogorodskiy 27 Jul '26

27 Jul '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..c874a5443e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,11 @@ v12.6.0 (unreleased) * **New features** + * bhyve: implement ``virDomainRename()`` + + The bhyve driver now implements the ``virDomainRename()`` API + for renaming of a domain (``virsh domrename``). + * **Improvements** * **Bug fixes** -- 2.52.0

2 1

[PATCH 0/3] bhyve: fix a few memory leaks
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Roman Bogorodskiy (3): bhyve: fix memory leak in bhyveBuildVirtioSerialControllerArgStr() network: pf: fix memory leaks bhyve: fix memory leak in bhyveStateCleanup() src/bhyve/bhyve_command.c | 4 +++- src/bhyve/bhyve_driver.c | 1 + src/network/network_pf.c | 20 +++++++++++++------- 3 files changed, 17 insertions(+), 8 deletions(-) -- 2.52.0

2 4

[PATCH] NEWS: Update with recent feature additions
by Jim Fehlig 25 Jul '26

25 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> Add NEWS entries for the new libvirtd build option and new sanlock plugin setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..e986cf8c9a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,17 @@ v12.6.0 (unreleased) * **New features** + * build: Add option to control building libvirtd + + Meson option ``libvirtd`` has been added to control building the monolithic + libvirtd, independent from the stateful, daemon-based drivers. + + * sanlock: Add option to check ownership of disk leases + + The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` + setting in sanlock.conf. When enabled, the sanlock plugin will check that + leases are owned by the domain attempting to acquire them. + * **Improvements** * **Bug fixes** -- 2.51.0

2 2

[libvirt PATCH] build: Check for directory in the git_werror check
by Ján Tomko 23 Jul '26

23 Jul '26

From: Jordan Petridis <jpetridis(a)gnome.org> test -e will only check if something exists, but -d is more appropriate as it will check that it exists and is also a directory. Signed-off-by: Jordan Petridis <jpetridis(a)gnome.org> Reviewed-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index ad1a5da1a5..6d5085042c 100644 --- a/meson.build +++ b/meson.build @@ -21,7 +21,7 @@ po_dir = meson.project_source_root() / 'po' # figure out if we are building from git -git = run_command('test', '-e', '.git', check: false).returncode() == 0 +git = run_command('test', '-d', '.git', check: false).returncode() == 0 if git and not get_option('no_git') run_command('git', 'submodule', 'update', '--init', check: true) -- 2.55.0

1 0

[PATCH 2/2] rpc: Use != -1 instead of > 0 for timer ID checks
by Yong Chen 23 Jul '26

23 Jul '26

The timer ID stored in ka->timer uses -1 as the sentinel value meaning 'not initialized' (set in virKeepAliveNew). The checks in virKeepAliveStop and virKeepAliveDispose used '> 0' or '>= 0' to determine whether a timer is active. However, if nexttimer overflows (see previous fix in vireventglib.c), ka->timer can be a negative value other than -1 (e.g., -2147483648). In that case: - 'if (ka->timer > 0)' returns false -> virEventRemoveTimeout skipped - 'if (ka->timer >= 0)' returns false -> virEventRemoveTimeout skipped This leaves the GSource active after the keepalive object is freed, causing a use-after-free with 'bad magic number' warnings in the log. Fix by changing the checks to 'if (ka->timer != -1)', which correctly handles both positive and negative timer IDs while still skipping the sentinel value -1. Additionally, add the same check in virKeepAliveDispose as a safety net: if the object's refcount reaches 0 due to a race condition or reference counting bug, the timer must be stopped before the object is freed. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/rpc/virkeepalive.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/rpc/virkeepalive.c b/src/rpc/virkeepalive.c index 690bc08b2e..4e7dd25d3c 100644 --- a/src/rpc/virkeepalive.c +++ b/src/rpc/virkeepalive.c @@ -218,6 +218,18 @@ virKeepAliveDispose(void *obj) PROBE(RPC_KEEPALIVE_DISPOSE, "ka=%p", ka); + /* Ensure the timer is stopped before freeing the object. + * This is a safety net: normally virKeepAliveStop is called + * before the object's refcount reaches 0, but in case of + * race conditions or reference counting bugs, we must not + * leave a dangling timer that would trigger use-after-free. + * Use != -1 (not >= 0) to also handle negative timer IDs + * caused by nexttimer integer overflow. */ + if (ka->timer != -1) { + virEventRemoveTimeout(ka->timer); + ka->timer = -1; + } + ka->freeCB(ka->client); } @@ -301,7 +313,7 @@ virKeepAliveStop(virKeepAlive *ka) "ka=%p client=%p", ka, ka->client); - if (ka->timer > 0) { + if (ka->timer ！= -1) { virEventRemoveTimeout(ka->timer); ka->timer = -1; } -- 2.55.0.windows.3

1 0

[PATCH 0/2] Fix use-after-free caused by timer ID integer overflow
by Yong Chen 23 Jul '26

23 Jul '26

The 'nexttimer' counter in vireventglib.c is a static int starting at 1, incremented for every new timeout registration. After running for a long period (1+ years with frequent client connections), it overflows past INT_MAX and becomes negative. A negative timer ID causes multiple issues: 1. virKeepAliveStart: skips virObjectRef(), leaving the keepalive object with only 1 reference (should be 2). When the connection closes, virObjectUnref() drops refcount to 0, freeing the object while the GSource is still active -> use-after-free with 'bad magic number' logs. 2. virKeepAliveStop: skips virEventRemoveTimeout(), the GSource is never destroyed, continuing to fire on freed memory. 3. virNetServerClientNew: sockTimer creation fails, all new connections rejected with 'Connection reset by peer'. In production (libvirtd running 1 year 8 months), this caused: - 1 leaked keepalive GSource (use-after-free, continuous 'bad magic' logs) - 282 million leaked sockTimer structures (19.6GB RSS) - All virsh commands failing with 'Connection reset by peer' Patch 1: Prevent nexttimer overflow in vireventglib.c (root cause fix) Patch 2: Fix timer ID checks in virkeepalive.c (defensive fix, use != -1 instead of > 0 to handle negative IDs) Yong Chen (2): util: Guard against integer overflow in nexttimer rpc: Use != -1 instead of > 0 for timer ID checks src/rpc/virkeepalive.c | 14 +++++++++++++- src/util/vireventglib.c | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-) -- 2.55.0.windows.3

1 0

[PATCH 00/13] qemu: Refactor panic action handling and introduce 'preserve-running' action for <on_crash>
by Peter Krempa 23 Jul '26

23 Jul '26

See last patch for justification of the new feature, the rest of the patches cleans up existing code. Peter Krempa (13): qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' qemu: Remove unused 'qemuProcessRebootAllowed' qemu: monitor: Remove support for 'watchdog-set-action' qemu: Remove 'allowReboot' field qemu: capabilities: Retire QEMU_CAPS_SET_ACTION qemuProcessSetupLifecycleActions: Prepare to handle other actions qemuDomainModifyLifecycleActionLive: Prepare to handle other actions processGuestPanicEvent: Don't pass panic action via parameter conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message qemuProcessGuestPanicEventInfo: Fold into only caller qemu: processGuestPanicEvent: Split individual steps under separate conditions Add support for keeping VM running when panic notifier is used docs/formatdomain.rst | 3 + include/libvirt/libvirt-domain.h | 1 + src/conf/domain_conf.c | 12 +- src/conf/domain_conf.h | 9 +- src/conf/schemas/domaincommon.rng | 2 + src/libxl/libxl_conf.c | 1 + src/libxl/libxl_domain.c | 3 + src/libxl/xen_common.c | 10 +- src/qemu/qemu_capabilities.c | 3 +- src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 13 +- src/qemu/qemu_domain.c | 33 --- src/qemu/qemu_domain.h | 17 -- src/qemu/qemu_driver.c | 189 +++++++++++------- src/qemu/qemu_hotplug.c | 10 +- src/qemu/qemu_monitor.c | 52 ++--- src/qemu/qemu_monitor.h | 4 - src/qemu/qemu_monitor_json.c | 22 -- src/qemu/qemu_monitor_json.h | 5 - src/qemu/qemu_process.c | 88 +++----- src/qemu/qemu_process.h | 2 - src/qemu/qemu_validate.c | 14 +- .../caps_10.0.0_aarch64.xml | 1 - .../caps_10.0.0_ppc64.xml | 1 - .../caps_10.0.0_s390x.xml | 1 - .../caps_10.0.0_x86_64+amdsev.xml | 1 - .../caps_10.0.0_x86_64.xml | 1 - .../caps_10.1.0_s390x.xml | 1 - .../caps_10.1.0_x86_64+inteltdx.xml | 1 - .../caps_10.1.0_x86_64.xml | 1 - .../caps_10.2.0_aarch64.xml | 1 - .../caps_10.2.0_x86_64+mshv.xml | 1 - .../caps_10.2.0_x86_64.xml | 1 - .../caps_11.0.0_aarch64.xml | 1 - .../caps_11.0.0_s390x.xml | 1 - .../caps_11.0.0_x86_64+sgx.xml | 1 - .../caps_11.0.0_x86_64.xml | 1 - .../caps_11.1.0_aarch64.xml | 1 - .../caps_11.1.0_x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 1 - .../caps_7.2.0_x86_64+hvf.xml | 1 - .../caps_7.2.0_x86_64.xml | 1 - .../caps_8.0.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_8.1.0_s390x.xml | 1 - .../caps_8.1.0_x86_64.xml | 1 - .../caps_8.2.0_aarch64.xml | 1 - .../caps_8.2.0_armv7l.xml | 1 - .../caps_8.2.0_loongarch64.xml | 1 - .../qemucapabilitiesdata/caps_8.2.0_s390x.xml | 1 - .../caps_8.2.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_9.0.0_sparc.xml | 1 - .../caps_9.0.0_x86_64.xml | 1 - .../caps_9.1.0_riscv64.xml | 1 - .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 - .../caps_9.1.0_x86_64.xml | 1 - .../caps_9.2.0_aarch64+hvf.xml | 1 - .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 - .../caps_9.2.0_x86_64+amdsev.xml | 1 - .../caps_9.2.0_x86_64.xml | 1 - .../qemustatusxml2xmldata/backup-pull-in.xml | 1 - .../blockjob-blockdev-in.xml | 1 - .../blockjob-mirror-in.xml | 1 - .../memory-backing-dir-in.xml | 1 - .../migration-in-params-in.xml | 1 - .../migration-out-nbd-bitmaps-in.xml | 1 - .../migration-out-nbd-out.xml | 1 - .../migration-out-nbd-tls-out.xml | 1 - .../migration-out-params-in.xml | 1 - tests/qemustatusxml2xmldata/modern-in.xml | 1 - .../qcow2-data-file-in.xml | 1 - .../throttlefilter-out.xml | 1 - tests/qemustatusxml2xmldata/upgrade-out.xml | 1 - .../qemustatusxml2xmldata/vcpus-multi-in.xml | 1 - .../async-teardown.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/async-teardown.xml | 2 +- tests/qemuxmlconftest.c | 1 + tools/virsh-domain.c | 3 +- 77 files changed, 209 insertions(+), 345 deletions(-) -- 2.55.0

2 19

[PATCH] vbox: fix memory leak in vboxStartMachine()
by Elizaveta Tereshkina 22 Jul '26

22 Jul '26

vboxStartMachine() allocates sdlDisplay via g_strdup() and doesn't free it. Add VIR_FREE. Fixes: 3f4f0ef47d (vbox: Fix starting domains) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/vbox/vbox_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c index 65ae9cc651..a47183927d 100644 --- a/src/vbox/vbox_common.c +++ b/src/vbox/vbox_common.c @@ -2252,6 +2252,7 @@ vboxStartMachine(virDomainPtr dom, int maxDomID, IMachine *machine) VBOX_UTF8_TO_UTF16(displayutf8, &env); VIR_FREE(displayutf8); VIR_FREE(guiDisplay); + VIR_FREE(sdlDisplay); VBOX_UTF8_TO_UTF16(sessType, &sessionType); } else if (vrdpPresent) { -- 2.39.2

2 2

[PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend
by Daniel P. Berrangé 22 Jul '26

22 Jul '26

Linux 7.1 has deprecated the AF_ALG crypto backend: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… And has documented it to be always slower than userspace crypto: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… as a result of dropping support for zero-copy and hardware accelerators: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… The main use case for the AF_ALG impl was to improve the performance of virtio-crypto with the cryptodev-backend-builtin driver. In practice this did not matter since 'cryptodev-backend-lkcf' can do offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user' can offload to an external process which can optionally integrate with hardware accelerators without kernel assistance. The AF_ALG backend has no user visible configuration options at runtime, it is unconditionally tried with any use of the cipher APIs. So it does not strictly have to go through the deprecation process, however, it is left available initially in case there was an unexpected use case that relies on it which may be faster with old kernels before the above Linux commits. Suggested-by: Thomas Huth <thuth(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/about/deprecated.rst | 21 +++++++++++++++++++++ meson.build | 6 ++++++ 2 files changed, 27 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968f..54b2662752 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support and NWFPE emulation, and they will be removed in a future QEMU release. +Build features +-------------- + +Crypto AF_ALG backend +--------------------- + +The use of the AF_ALG backend for cryptography has been deprecated +with no replacement. + +The AF_ALG interface is deprecated by Linux 7.1 and all support +for hardware accelerators has been removed. It will thus always be +slower than userspace crypto due to the overhead of copying data +to kernel space. The GNUTLS, Nettle and GCrypt libraries supported +by QEMU all include a variety of hardware optimized crypto +implementations which should suffice for typical needs. + +For the virtio-crypto device, the 'cryptodev-backend-lkcf' backend +can offload some operations to the kernel via the keyctl syscall, +and the 'cryptodev-vhost-user' backend can offload the device +backend to an external process which can integrate with crypto +accelerators. Backwards compatibility ----------------------- diff --git a/meson.build b/meson.build index 164328ded8..02cbe6445a 100644 --- a/meson.build +++ b/meson.build @@ -5053,3 +5053,9 @@ if not actually_reloc and (host_os == 'windows' or get_option('relocatable')) message('QEMU will have to be installed under ' + get_option('prefix') + '.') message('Use --disable-relocatable to remove this warning.') endif + +if get_option('crypto_afalg').enabled() + warning('Use of the AF_ALG crypto backend is deprecated, ' + + 'since Linux 7.1 has deprecated the AF_ALG interface ' + + 'and removed its ability to use hardware accelerators.') +endif -- 2.55.0

3 4

[PATCH 0/4] API docs fixes
by Peter Krempa 21 Jul '26

21 Jul '26

Peter Krempa (4): libvirt-domain: Use consistent flag names for APIs declaring use of 'virDomainDeviceModifyFlags' libvirt-qemu: Add reference to QMP protocol documentation libvirt-qemu: Document that 'virDomainQemuAttach' no longer works libvirt-qemu: Add reference to QEMU agent protocol syntax src/libvirt-domain.c | 24 ++++++++++++------------ src/libvirt-qemu.c | 17 ++++++++++++++++- 2 files changed, 28 insertions(+), 13 deletions(-) -- 2.55.0

2 5