August 2026 - Devel - libvirt List Archives

[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks
by Ján Tomko 24 Aug '26

24 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> CVE-2026-77158 In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free. Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; } -- 2.55.0

2 1

[PATCH 0/6] various fixes for 11.2 (gitlab, tests, char-fe, fdc, deprecations)
by Alex Bennée 21 Aug '26

21 Aug '26

This is a rather random selection of fixes that didn't quite make it to 11.1 although we have some qemu-stable material in here. The CFLAGS tweak allow another target to be built and tested on MacOS. There are also riscv64 compilers which could be enabled via brew but I don't have time to look at those. The CFLAGS changes are also subsumed into Pierrick's check-tcg meson updates which might hit first. The char-fe clean-up removes a code smell of device models reaching into qemu_chr_fe_get_driver which is poor practice. The fdc fix resolves one of the many security reports for those that still care about floppy controllers in VMs. In my brief excursion into our confidential bugs I did look at fixing virtio-crypto but found it needs some serious love. Therefor I'm taking the other option of deprecating the module. Finally I'm experimenting with using b4's patch series handling so forgive any finger trouble on this series. Alex. Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> --- Alex Bennée (6): gitlab: use .base_meson_job_template for macOS jobs tests/arm: add explicit CFLAGS for system build gitlab: add arm-softmmu tests to the macOS build char-fe: implement qemu_chr_fe_backend_name hw/block: validate the fdc sector position fits within bounds docs: deprecate virtio-crypto docs/about/deprecated.rst | 14 ++++++++++++++ hw/block/fdc-internal.h | 1 + include/chardev/char-fe.h | 13 ++++++++++++- backends/cryptodev-vhost-user.c | 8 +------- backends/rng-egd.c | 8 +------- backends/vhost-user.c | 8 +------- hw/block/fdc.c | 28 ++++++++++++++++++++++------ hw/char/imx_serial.c | 4 ++-- .gitlab-ci.d/macos.yml | 7 ++++--- tests/tcg/arm/Makefile.softmmu-target | 2 +- 10 files changed, 59 insertions(+), 34 deletions(-) --- base-commit: fa19879df1658f96ac07365fca8835b7decd6995 change-id: 20260819-fixes-for-11-2-f98744b82c12 Best regards, -- Alex Bennée <alex.bennee(a)linaro.org>

6 12

[PATCH] apparmor: Allow vfio-ccw hostdev sysfs access
by Hector Cao 20 Aug '26

20 Aug '26

Attaching a vfio-ccw mediated device as a <hostdev> fails under the libvirt-qemu AppArmor profile because QEMU's channel subsystem code (hw/s390x/css.c) reads several sysfs attributes of the passed-through subchannel when building the guest SCHIB, and the profile does not grant read access to them: css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type The first two are opened via /sys/bus/css/devices/<id> symlinks, which AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ before mediating the access; the CHPID type file is read directly under /sys/devices/. Without these rules the attach (or hotplug) fails with an AppArmor DENIED message and QEMU aborts with: s390_ccw_realize: Failed to build initial schib: Invalid argument Add narrowly-scoped read rules for these three files so vfio-ccw passthrough works without granting broad access to /sys/devices/css*. Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/apparmor/libvirt-qemu | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..428f9a9731 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -50,6 +50,16 @@ /run/udev/data/c16[6,7]* r, /run/udev/data/c18[0,8,9]* r, + # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads + # the channel-path masks, CHPID list and CHPID type of the passed-through + # subchannel from sysfs when building the guest SCHIB. The chpids and + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read + # directly from /sys/devices/cssN/chp0.<chpid>/. + /sys/devices/css[0-9]*/*/chpids r, + /sys/devices/css[0-9]*/*/pimpampom r, + /sys/devices/css[0-9]*/chp0.*/type r, + # WARNING: this gives the guest direct access to host hardware and specific # portions of shared memory. This is required for sound using ALSA with kvm, # but may constitute a security risk. If your environment does not require -- 2.43.0

2 2

[PATCH v2] Allow slices for block backed NVRAM
by John Levon 20 Aug '26

20 Aug '26

For NVRAM storage specifically, the guest-visible size is critical to correct handling of the OVMF address space. Allow specifying storage slices for NVRAM storage when the underlying block may be larger due to alignment/allocation restrictions. As qemuPrepareNVRAMBlock() does not support it, disallow slices with non-raw formats, and slice offsets. Signed-off-by: John Levon <john.levon(a)nutanix.com> --- src/qemu/qemu_validate.c | 32 ++++++++++---- ...ual-efi-nvram-dev-slice.x86_64-latest.args | 35 ++++++++++++++++ ...nual-efi-nvram-dev-slice.x86_64-latest.xml | 42 +++++++++++++++++++ .../firmware-manual-efi-nvram-dev-slice.xml | 25 +++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 128 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 61f3bd3278..ae70eb89f0 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -707,8 +707,32 @@ qemuValidateDomainDefNvram(const virDomainDef *def, switch (src->type) { case VIR_STORAGE_TYPE_FILE: - case VIR_STORAGE_TYPE_BLOCK: case VIR_STORAGE_TYPE_NETWORK: + if (src->sliceStorage) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("slices are not supported with non-block NVRAM")); + return -1; + } + break; + + case VIR_STORAGE_TYPE_BLOCK: + if (src->sliceStorage) { + if (src->sliceStorage->offset != 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("offset slices are not supported with NVRAM")); + } + + switch (src->format) { + case VIR_STORAGE_FILE_RAW: + case VIR_STORAGE_FILE_NONE: + break; + + default: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("NVRAM slices are not supported with format '%1$s'"), + virStorageFileFormatTypeToString(src->format)); + } + } break; case VIR_STORAGE_TYPE_DIR: @@ -728,12 +752,6 @@ qemuValidateDomainDefNvram(const virDomainDef *def, return -1; } - if (src->sliceStorage) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("slices are not supported with NVRAM")); - return -1; - } - if (src->pr) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("persistent reservations are not supported with NVRAM")); diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args new file mode 100644 index 0000000000..bb911d4ae1 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/lv/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"raw","file":"libvirt-pflash1-storage","offset":0,"size":540672,"node-name":"libvirt-0-slice-sto","read-only":false}' \ +-machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-0-slice-sto,acpi=on \ +-accel tcg \ +-cpu qemu64 \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml new file mode 100644 index 0000000000..9409c6a7a6 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml @@ -0,0 +1,42 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os firmware='efi'> + <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' type='block' format='raw'> + <source dev='/dev/lv/guest_VARS.fd'> + <slices> + <slice type='storage' offset='0' size='540672'/> + </slices> + </source> + </nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml new file mode 100644 index 0000000000..31cf086c2a --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml @@ -0,0 +1,25 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type> + <loader readonly='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram type='block'> + <source dev='/dev/lv/guest_VARS.fd'> + <slices> + <slice type="storage" offset="0" size="540672"/> + </slices> + </source> + </nvram> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index e0e64c6c38..3b6f97c2b0 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1442,6 +1442,7 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-iscsi"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-nbd"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-file"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-dev-slice"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-nvram-stateless"); DO_TEST_CAPS_ARCH_LATEST_FULL("firmware-manual-efi-sev-snp", "x86_64", -- 2.43.0

2 2

[PATCH] storage: check bounds before accessing encryption payload offset
by Sergey Zhidkih 20 Aug '26

20 Aug '26

'virStorageFileGetEncryptionPayloadOffset' expects payloadOffset + 4 to be in buffer bounds which isn't checked anywhere. For example malicious actor may provide LUKS header with just magic and version like: '4c554b53 babe 0001'. This example successefully passes 'virStorageFileHasEncryptionFormat' and leads to OOB read of 4 bytes. So the fix is to add bounds checks. Fixes: b7d44f450c06803df7df3ad380f7a5c97425c1e6 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/906 Signed-off-by: Sergey Zhidkih <rx1513(a)altlinux.org> --- src/storage_file/storage_file_probe.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/storage_file_probe.c index cc5854d360..3ac90d698c 100644 --- a/src/storage_file/storage_file_probe.c +++ b/src/storage_file/storage_file_probe.c @@ -938,11 +938,13 @@ virStorageFileHasEncryptionFormat(const struct FileEncryptionInfo *info, static int virStorageFileGetEncryptionPayloadOffset(const struct FileEncryptionInfo *info, - char *buf) + char *buf, + size_t len) { int payload_offset = -1; - if (info->payloadOffset != -1) { + if (info->payloadOffset != -1 && + len >= info->payloadOffset + sizeof(uint32_t)) { if (info->endian == LV_LITTLE_ENDIAN) payload_offset = virReadBufInt32LE(buf + info->payloadOffset); else @@ -999,7 +1001,7 @@ virStorageFileProbeGetMetadata(virStorageSource *meta, } } meta->encryption->payload_offset = - virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo[meta->format].cryptInfo[i], buf); + virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo[meta->format].cryptInfo[i], buf, len); } } } -- 2.50.1

2 1

[PATCH] qemu: tpm: Avoid following symlinks when chown'ing log file
by Jim Fehlig 19 Aug '26

19 Aug '26

From: Jim Fehlig <jfehlig(a)suse.com> libvirt chown()s the swtpm log file to the swtpm user:group when starting a VM. The swtpm log directory is writable by swtmp user, who could replace the logfile with a symlink to a root-owned path. At next VM start, libvirt will chown() that path to the swtpm user:group, which breaks the intended separation between the confined swtpm account and root-owned files. Use fchown() on an fd opened with O_NOFOLLOW to avoid the potential symlink attack. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/qemu/qemu_tpm.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 660410bcba..34e11cc02f 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -1030,6 +1030,8 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDef *tpm, uid_t qemu_user, const char *shortName) { + VIR_AUTOCLOSE logfd = -1; + /* create log dir ... allow 'tss' user to cd into it */ if (g_mkdir_with_parents(logDir, 0711) < 0) return -1; @@ -1039,13 +1041,20 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDef *tpm, VIR_DIR_CREATE_ALLOW_EXIST) < 0) return -1; - if (!virFileExists(tpm->data.emulator.logfile) && - virFileTouch(tpm->data.emulator.logfile, 0644) < 0) { + /* Open (creating if necessary) the logfile without following a + * symlink. The log directory is writable by swtpm_user, so we want + * to avoid chown'ing a symlink to an arbitrary path. + */ + if ((logfd = open(tpm->data.emulator.logfile, + O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC, 0644)) < 0) { + virReportSystemError(errno, + _("Could not open swtpm logfile %1$s"), + tpm->data.emulator.logfile); return -1; } /* ... and make sure it can be accessed by swtpm_user */ - if (chown(tpm->data.emulator.logfile, swtpm_user, swtpm_group) < 0) { + if (fchown(logfd, swtpm_user, swtpm_group) < 0) { virReportSystemError(errno, _("Could not chown on swtpm logfile %1$s"), tpm->data.emulator.logfile); -- 2.51.0

2 2

[PATCH v21 03/16] net/tap: deprecate "no" as special value for script/downscript
by Vladimir Sementsov-Ogievskiy 19 Aug '26

19 Aug '26

The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Ben Chaney <bchaney(a)akamai.com> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> --- docs/about/deprecated.rst | 18 ++++++++++++++++++ docs/system/i386/microvm.rst | 4 ++-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 ++-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- net/tap.c | 17 +++++++++++------ qapi/net.json | 14 ++++++++++---- qemu-options.hx | 8 ++++++-- 9 files changed, 52 insertions(+), 19 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..c4929317e3a 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e7..077ea15751e 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5c..862f38830b1 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc5..ec5aaf14fd9 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84b..7fdb96601ad 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e313..0e4dcf3e70c 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/net/tap.c b/net/tap.c index 2076f5b7802..f4051e8d4b1 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,7 +92,8 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg_value) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { if (!script_arg_value) { return false; @@ -103,16 +104,19 @@ static bool tap_is_explicit_no_script(const char *script_arg_value) } if (strcmp(script_arg_value, "no") == 0) { + warn_report("'%s=no' is deprecated; use '%s=' instead", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg_value, +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, const char *default_path) { - if (tap_is_explicit_no_script(script_arg_value)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } @@ -741,7 +745,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -947,9 +951,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qapi/net.json b/qapi/net.json index 8f0915c4d86..acb8594c952 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,21 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # # @br: bridge name (since 2.8) # diff --git a/qemu-options.hx b/qemu-options.hx index 200949655ea..1efdb8e9860 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3014,7 +3014,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3553,7 +3554,10 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; it disables script + execution now, but in a future version it will be treated as a + plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- 2.43.0

1 0

[PATCH v4 0/3] qemu: Support vCMDQ
by Nathan Chen 19 Aug '26

19 Aug '26

Hi, This is a follow up to the previous patchset [0] for supporting Tegra241 vCMDQ. This patchset is tested with Shameer's qemu series for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-v4/ Thanks, Nathan Changes from v3: - Move qemuValidateDomainDeviceDefIOMMU() check from patch 1 to 2 - Mention default hypervisor value will be used in formatdomain.rst if cmdqv is omitted - Make cmdqv virDomainIOMMUDefValidate() check aligned with order of all cmdqv checks in the function - Include cmdqv for accel validation error message in domain_validate.c Changes from v2: - Add QEMU capabilities support for cmdqv - Change QEMU command line parameter to expect OnOffAuto string Changes from v1: - Remove 'identifier' attribute for SMMUv3 - Change QEMU command line property from 'tegra241-cmdqv' to 'cmdqv' - Support QEMU OnOffAuto CMDQV property instead of expecting a bool [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/NGSB… Nathan Chen (3): qemu: introduce QEMU_CAPS_ARM_SMMUV3_CMDQV qemu: add IOMMU attribute "cmdqv" for smmuv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 8 +++ src/conf/domain_conf.c | 15 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 6 +- src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 1 + src/qemu/qemu_validate.c | 8 +++ .../caps_11.1.0_aarch64.xml | 1 + ...v3-pci-bus-accel-cmdqv.aarch64-latest.args | 40 +++++++++++++ ...uv3-pci-bus-accel-cmdqv.aarch64-latest.xml | 59 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-accel-cmdqv.xml | 49 +++++++++++++++ tests/qemuxmlconftest.c | 1 + 14 files changed, 200 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.xml -- 2.43.0

2 4

[PATCH v3 0/3] qemu: Support vCMDQ
by Nathan Chen 18 Aug '26

18 Aug '26

Hi, This is a follow up to the previous RFC patchset [0] for supporting Tegra241 vCMDQ. This patchset is tested with Shameer's qemu series for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-v3/ Thanks, Nathan Changes from v2: - Add QEMU capabilities support for cmdqv - Change QEMU command line parameter to expect OnOffAuto string Changes from v1: - Remove 'identifier' attribute for SMMUv3 - Change QEMU command line property from 'tegra241-cmdqv' to 'cmdqv' - Support QEMU OnOffAuto CMDQV property instead of expecting a bool [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/CE6U… Nathan Chen (3): qemu: introduce QEMU_CAPS_ARM_SMMUV3_CMDQV qemu: add IOMMU attribute "cmdqv" for smmuv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 15 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 6 +- src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 1 + src/qemu/qemu_validate.c | 8 +++ .../caps_11.1.0_aarch64.xml | 1 + ...v3-pci-bus-accel-cmdqv.aarch64-latest.args | 40 +++++++++++++ ...uv3-pci-bus-accel-cmdqv.aarch64-latest.xml | 59 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-accel-cmdqv.xml | 49 +++++++++++++++ tests/qemuxmlconftest.c | 1 + 14 files changed, 198 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.xml -- 2.43.0

3 8

[PATCH] esx: Don't crash when parsing unmounted datastore
by Michal Privoznik 18 Aug '26

18 Aug '26

From: Michal Privoznik <mprivozn(a)redhat.com> When parsing disk source in ESX driver (esxParseVMXFileName()) the datastore is traversed through trying to find matching prefix. But not every datastore has to be mounted. In that case, esxVI_LookupDatastoreHostMount() returns success and the returned struct has mountInfo->path set to NULL. This can be deducted from the following backtrace (which shows that strlen() hidden in STRSKIP() macro was given NULL pointer). Thread 1 "virsh" received signal SIGSEGV, Segmentation fault. __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 76 VPCMPEQ (%rdi), %ymm0, %ymm1 (gdb) bt full #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 No locals. #1 0x00007ffff7c292d7 in esxParseVMXFileName (fileName=0x5555557341d0 "/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk", opaque=0x7fffffffcf80, out=0x7fffffffc738, allow_missing=false) at ../src/esx/esx_driver.c:172 data = 0x7fffffffcf80 propertyNameList = 0x555555738b50 datastoreList = 0x55555573cf40 datastore = <optimized out> hostMount = 0x555555733640 datastoreName = 0x55555573e590 "mnecas-nfs-test" tmp = <optimized out> saveptr = 0x5555556a5b50 "" strippedFileName = 0x0 copyOfFileName = 0x0 directoryAndFileName = <optimized out> ret = -1 __FUNCTION__ = "esxParseVMXFileName" #2 0x00007ffff7bd47f4 in virVMXParseDisk (ctx=ctx@entry=0x7fffffffcfb0, xmlopt=xmlopt@entry=0x555555738d80, conf=conf@entry=0x5555556a5b50, device=device@entry=0, busType=<optimized out>, busType@entry=3, controllerOrBus=controllerOrBus@entry=1, unit=<optimized out>, def=0x7fffffffc960, vmdef=0x5555557375a0) at ../src/vmx/vmx.c:2553 tmp = 0x0 result = -1 prefix = 0x5555557384d0 "scsi1:0" present_name = "scsi1:0.present", '\000' <repeats 16 times> present = true startConnected_name = "scsi1:0.startConnected\000\000\000\000\000\000\000\000\000" startConnected = true deviceType_name = "scsi1:0.deviceType", '\000' <repeats 13 times> deviceType = 0x555555737f60 "scsi-hardDisk" clientDevice_name = "scsi1:0.clientDevice", '\000' <repeats 11 times> clientDevice = false fileType_name = "scsi1:0.fileType", '\000' <repeats 15 times> fileType = 0x0 fileName_name = "scsi1:0.fileName", '\000' <repeats 15 times> fileName = 0x5555557341d0 "/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk" writeThrough_name = "scsi1:0.writeThrough", '\000' <repeats 11 times> writeThrough = false mode_name = "scsi1:0.mode", '\000' <repeats 19 times> mode = 0x0 cleanup = <optimized out> __FUNCTION__ = "virVMXParseDisk" #3 0x00007ffff7bd5f01 in virVMXParseConfig (ctx=0x7fffffffcfb0, xmlopt=0x555555738d80, caps=<optimized out>, vmx=<optimized out>) at ../src/vmx/vmx.c:1749 #4 0x00007ffff7c35319 in esxDomainGetXMLDesc (domain=<optimized out>, flags=0) at ../src/esx/esx_driver.c:2595 #5 0x00007ffff7cc4fd3 in virDomainGetXMLDesc (domain=domain@entry=0x5555557367f0, flags=flags@entry=0) at ../src/libvirt-domain.c:2898 #6 0x0000555555586cca in cmdDumpXML (ctl=0x7fffffffd1d0, cmd=0x5555556a5450) at ../tools/virsh-domain.c:10787 #7 0x00005555555bc7cb in vshCommandRun (ctl=0x7fffffffd1d0, cmd=0x5555556a5450) at ../tools/vsh.c:1383 #8 0x0000555555562fbc in main (argc=<optimized out>, argv=0x7fffffffd5c8) at ../tools/virsh.c:900 The backtrace was trimmed. To fix this, just check whether mount path is not NULL before passing it to STRSKIP(). Resolves: https://redhat.atlassian.net/browse/RHEL-213506 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- BTW: this crasher is easily reproducible with our test suite too. Just comment line 49 in tests/vmx2xmlmock.c file and run vmx2xmltest. src/esx/esx_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index c5b3fa47b6..75bbd07750 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -169,6 +169,9 @@ esxParseVMXFileName(const char *fileName, goto cleanup; } + if (!hostMount->mountInfo->path) + continue; + tmp = (char *)STRSKIP(fileName, hostMount->mountInfo->path); if (!tmp) -- 2.54.0

2 1