- Devel - libvirt List Archives

[PATCH v2 0/7] qemu: add poll-weight support for iothreads
by Jaehoon Kim 25 Aug '26

25 Aug '26

This series adds support for the QEMU iothread poll-weight property, which controls the weight of the most recent event interval in the adaptive polling duration calculation. The valid range is [0, 63]; a value of 0 lets QEMU use its default weight. Changes in v2: - Move the formatdomain docs patch right after the XML parser/formatter patch - Fix the docs description: "If omitted, the value is not changed" rather than "If omitted or set to 0, the hypervisor selects a default" - Split the getter/stats path (patch 4) from the setter/cmdline path (patch 5), and drop the qemuBuildIOThreadCommandLine qemuCaps parameter since CAPS validation is handled by qemuValidateDomainDefIOThreads - Separate the test driver changes into its own patch (patch 6) with the corresponding iothreads.out updates split accordingly - Move the domstats documentation hunk into the stats patch (patch 4) - Add a qemuxmlconf parse-error test for out-of-range weight values - Fix Since version: 12.6.0 -> 12.7.0 (Peter Krempa) - Drop the docs: fix typos patch (already applied upstream) The series was validated with: meson test -C build virschematest meson test -C build qemucapabilitiestest meson test -C build qemuxmlconftest meson test -C build virshtest meson test -C build genericxml2xmltest QEMU commits: 9fea80ddf0 qapi/iothread: introduce poll-weight parameter for aio-poll 9563d0b5e2 aio-poll: refine iothread polling using weighted handler intervals ed21d9d65c aio-poll: avoid unnecessary polling time computation Jaehoon Kim (7): conf: add iothread poll-weight XML support docs: formatdomain: document iothread poll-weight qemu: capabilities: add capability for iothread poll-weight qemu: add poll-weight getter and stats support qemu: support iothread poll-weight test: add poll-weight support to the test driver virsh: add iothreadset --poll-weight support docs/formatdomain.rst | 8 ++- docs/manpages/virsh.rst | 18 ++++-- include/libvirt/libvirt-domain.h | 25 ++++++++ src/conf/domain_conf.c | 14 ++++- src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 7 +++ src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 6 ++ src/qemu/qemu_driver.c | 38 ++++++++++++ src/qemu/qemu_monitor.h | 2 + src/qemu/qemu_monitor_json.c | 18 ++++++ src/qemu/qemu_validate.c | 10 +++- src/test/test_driver.c | 12 ++++ tests/genericxml2xmlindata/iothreadids.xml | 2 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.xml | 1 + ...s-poll-weight-outofrange.x86_64-latest.err | 1 + .../iothreads-ids-poll-weight-outofrange.xml | 58 +++++++++++++++++++ ...threads-ids-poll-weight.x86_64-latest.args | 40 +++++++++++++ ...othreads-ids-poll-weight.x86_64-latest.xml | 58 +++++++++++++++++++ .../iothreads-ids-poll-weight.xml | 58 +++++++++++++++++++ tests/qemuxmlconftest.c | 2 + tests/virshtestdata/iothreads.in | 2 + tests/virshtestdata/iothreads.out | 18 ++++++ tools/virsh-domain.c | 17 ++++++ 27 files changed, 415 insertions(+), 11 deletions(-) create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight-outofrange.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight-outofrange.xml create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.xml -- 2.54.0

3 17

[PATCH] NEWS: document bhyve changes for 12.7.0
by Roman Bogorodskiy 25 Aug '26

25 Aug '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index ae4d8c18a5..e098fc53f9 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,10 +17,42 @@ v12.7.0 (unreleased) * **New features** + * bhyve: implement ``virDomainGetGuestInfo()`` and ``virDomainAgentSetResponseTimeout()`` APIs + + The bhyve driver now implements ``virDomainGetGuestInfo()`` which returns + information about the guest, and ``virDomainAgentSetResponseTimeout()`` + which sets the guest agent response timeout. + + * bhyve: allow setting disk serial numbers + + The bhyve driver now allows specifying serial numbers for SATA disks and NVMe + controllers:: + + <disk type='file'> + <serial>BHYVE-SER01-0001</serial> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd1.img'/> + <target dev='hda' bus='sata' rotation_rate='7200'/> + </disk> + <controller type='nvme' index='0'> + <serial>BHYVE-NVME0-01234</serial> + </controller> + + It also supports specifying EUI-64 for the NVMe disks:: + + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/path/to/some.img'/> + <target dev='nvme0n1' bus='nvme'/> + <wwn>01000000efbeadde</wwn> + </disk> + * **Improvements** * **Bug fixes** + * bhyve: fix domain API calls hanging after domain shutdown + v12.6.0 (2026-08-03) ==================== -- 2.55.0

1 0

[PATCH v2 0/8] various fixes for 11.2 (gitlab, tests, char-fe, fdc, mailmap, deprecations) pre-PR
by Alex Bennée 24 Aug '26

24 Aug '26

This is a rather random selection of fixes that didn't quite make it to 11.1 although we have some qemu-stable material in here. The CFLAGS tweak allow another target to be built and tested on MacOS. There are also riscv64 compilers which could be enabled via brew but I don't have time to look at those. The CFLAGS changes are also subsumed into Pierrick's check-tcg meson updates which might hit first. The char-fe clean-up removes a code smell of device models reaching into qemu_chr_fe_get_driver which is poor practice. The fdc fix resolves one of the many security reports for those that still care about floppy controllers in VMs. In my brief excursion into our confidential bugs I did look at fixing virtio-crypto but found it needs some serious love. Therefor I'm taking the other option of deprecating the module. Finally I'm experimenting with using b4's patch series handling so forgive any finger trouble on this series. I'll roll the PR on Wednesday. Alex. Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> --- Changes in v2: - added mailmap patch - added fcd test case at review request (AI-used-for trailer) - tweaked virtio-crypto deprecation and commit message - Link to v1: https://lore.kernel.org/qemu-devel/20260819-fixes-for-11-2-v1-0-b7981c2cc37… To: qemu-devel(a)nongnu.org Cc: Philippe Mathieu-Daudé <philmd(a)mailo.com> Cc: Alex Bennée <alex.bennee(a)linaro.org> Cc: Pierrick Bouvier <pierrick.bouvier(a)oss.qualcomm.com> Cc: Peter Maydell <peter.maydell(a)linaro.org> Cc: qemu-arm(a)nongnu.org Cc: "Michael S. Tsirkin" <mst(a)redhat.com> Cc: Stefano Garzarella <sgarzare(a)redhat.com> Cc: "Gonglei (Arei)" <arei.gonglei(a)huawei.com> Cc: zhenwei pi <zhenwei.pi(a)linux.dev> Cc: Laurent Vivier <lvivier(a)redhat.com> Cc: Amit Shah <amit(a)kernel.org> Cc: Marc-André Lureau <marcandre.lureau(a)redhat.com> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: John Snow <jsnow(a)redhat.com> Cc: Kevin Wolf <kwolf(a)redhat.com> Cc: Hanna Reitz <hreitz(a)redhat.com> Cc: qemu-block(a)nongnu.org Cc: Fabiano Rosas <farosas(a)suse.de> Cc: devel(a)lists.libvirt.org --- Alex Bennée (7): gitlab: use .base_meson_job_template for macOS jobs tests/arm: add explicit CFLAGS for system build gitlab: add arm-softmmu tests to the macOS build char-fe: implement qemu_chr_fe_backend_name hw/block: validate the fdc sector position fits within bounds tests/qtest: add test case for fdc sector overflow docs: deprecate virtio-crypto Denis V. Lunev (1): mailmap: map the last From-munged author back to a real identity docs/about/deprecated.rst | 18 +++ hw/block/fdc-internal.h | 1 + include/chardev/char-fe.h | 13 +- backends/cryptodev-vhost-user.c | 8 +- backends/rng-egd.c | 8 +- backends/vhost-user.c | 8 +- hw/block/fdc.c | 30 ++++- hw/char/imx_serial.c | 4 +- tests/qtest/fdc-test.c | 246 +++++++++++++++++++++++++++++++++- .gitlab-ci.d/macos.yml | 7 +- .mailmap | 1 + tests/tcg/arm/Makefile.softmmu-target | 2 +- 12 files changed, 307 insertions(+), 39 deletions(-) --- base-commit: 3375621e78660838b862d411c43f90e905d0b985 change-id: 20260819-fixes-for-11-2-f98744b82c12 Best regards, -- Alex Bennée <alex.bennee(a)linaro.org>

2 9

[RFC PATCH v1 0/2] fix: don't add SELinux MCS categories to IOMMU device
by Omar Elghoul 24 Aug '26

24 Aug '26

Hi, This patchset proposes a fix for what I believe is a bug in libvirt when using iommufd under SELinux enforcing. It is an RFC because I cannot yet vouch for its correctness -- the goal is not to merge this code as is, but rather start a discussion on how we should go about things. When using iommufd, libvirt opens the vfio cdev corresponding to the device (e.g. /dev/vfio/devices/{n}) and the IOMMU device (/dev/iommu) and passes the file descriptors to qemu. The cdev is a device-specific resource, and thus a per-domain resource. The IOMMU on the other hand is a shared resource between all domains. Using the SELinux driver, libvirt relabels and assigns MCS categories to domain-specific devices to isolate from other domains. However, it also incorrectly assigns these categories to the IOMMU device. This can make subsequent domains unable to create DMA mappings. On my s390x host, I've repeatedly observed this problem showing up as PCI error events that show a DMA attempt to a non-present page. This problem is reproducible by running `setenforce 1` and then starting two domains, each with a PCI passthrough device using iommufd, and then performing actions that initiate PCI DMA transactions from within the guests. Launching qemu manually from the command-line does not produce these errors. There is also an additional cleanup problem that is not addressed in libvirt today, nor in my patches. When libvirt relabels a device, it doesn't restore the default label after the domain is destroyed. This is fine for the vfio cdevs, because they will disappear anyway as they get unbound from the vfio driver and rebind their default driver, but again is problematic for /dev/iommu because the inode is never unlinked. For example, the good state before starting a domain: root in ~/libvirt λ matchpathcon /dev/iommu /dev/iommu system_u:object_r:iommu_device_t:s0 root in ~/libvirt λ ls -Z /dev/iommu system_u:object_r:iommu_device_t:s0 /dev/iommu After starting and ending all domains (without my patches): root in ~/libvirt λ ls -Z /dev/iommu system_u:object_r:svirt_image_t:s0:c614,c980 /dev/iommu My patches remove the per-domain MCS categories (i.e., c614,c980) from the IOMMU, but they do NOT clean up the inode relabel. For the domain's lifetime, a relabel from iommu_device_t to svirt_image_t is correct. But I'm skeptical of whether we should clean that up at all when no domains are running, so that's another point I hope to get sorted out. I'd be happy to hear any feedback or thoughts on resolving this issue. If there's more questions or anyone needs more details, I'm available to answer those too. Thanks in advance. Omar Elghoul (2): security: add SetSharedImageFDLabel() for shared image FDs qemu: drop per-domain MCS categories from IOMMU device src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 4 +- src/qemu/qemu_security.h | 1 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 1 + src/security/security_driver.h | 4 ++ src/security/security_manager.c | 16 ++++++++ src/security/security_manager.h | 3 ++ src/security/security_nop.c | 1 + src/security/security_selinux.c | 63 ++++++++++++++++++++++++++++++++ src/security/security_stack.c | 18 +++++++++ 11 files changed, 111 insertions(+), 2 deletions(-) -- 2.55.0

3 9

[PATCH 0/4] bhyve: live/transient domain handling fixes
by Roman Bogorodskiy 24 Aug '26

24 Aug '26

I was doing pre-merge testing of the "bhyve: implement virDomainSetLifecycleAction() API" series and spotted a few issues related to the live/transient domain definitions handling (and in the original series as well, so will likely send a v2 later). This area has quite a few nuances, so I extended the TCK test: https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/92 TCK also helped to catch the issue with the firmware data filling with the scripts/domain/405-ovmf-nvram-efi.t test. It is fixed in the final patch of the series. I think I plan to add more TCK tests for that, but decided to send this series first to make sure I'm on the right track. Roman Bogorodskiy (4): bhyve: process: do not leak live changes to persistent XML bhyve: process: discard stale live definition on reconnect failure bhyve: honor VIR_DOMAIN_XML_INACTIVE in virDomainGetXMLDesc() bhyve: domain: fix filling of firmware data src/bhyve/bhyve_domain.c | 11 ++++++++++- src/bhyve/bhyve_driver.c | 18 ++++++++++++++---- src/bhyve/bhyve_firmware.c | 12 ++++++------ src/bhyve/bhyve_firmware.h | 2 +- src/bhyve/bhyve_process.c | 9 ++++++++- .../three_firmwares/BHYVE_UEFI_VARS.fd | 0 .../x86_64/bhyvexml2xmlout-numa.xml | 2 ++ tests/bhyvexml2xmltest.c | 10 +++++++++- 8 files changed, 50 insertions(+), 14 deletions(-) create mode 100644 tests/bhyvefirmwaredata/three_firmwares/BHYVE_UEFI_VARS.fd -- 2.52.0

2 5

Entering freeze for libvirt-12.7.0
by Jiri Denemark 24 Aug '26

24 Aug '26

I have just tagged v12.7.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 0

[PATCH 0/7] vmx: Add more controllers and parse PCI addresses
by Michal Privoznik 24 Aug '26

24 Aug '26

This is a prerequisite of the following issue: https://redhat.atlassian.net/browse/RHEL-147630 It's not fixing the issue per-se, so you'll not find any reference to the issue in commit messages. But my gut feeling says let's expose more controllers and their PCI addresses in the domain XML. Michal Prívozník (7): vmx: Add SCSI controllers vmx: Parse PCI address for SCSI controllers vmx: Add SATA controllers vmx: Parse PCI address for SATA controllers vmx: Add NVMe controllers vmx: Parse PCI address for NVMe controllers vmx: Parse PCI address for ethernet devices src/vmx/vmx.c | 173 ++++++++++++++------- tests/vmx2xmldata/esx-in-the-wild-10.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-11.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-12.xml | 9 +- tests/vmx2xmldata/esx-in-the-wild-13.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-14.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-15.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-16.xml | 11 +- tests/vmx2xmldata/esx-in-the-wild-17.xml | 9 +- tests/vmx2xmldata/esx-in-the-wild-5.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-6.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-7.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-8.xml | 18 ++- tests/vmx2xmldata/esx-in-the-wild-9.xml | 8 +- tests/vmx2xmldata/fusion-in-the-wild-1.xml | 6 +- tests/vmx2xmldata/gsx-in-the-wild-1.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-2.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-3.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-4.xml | 1 + 19 files changed, 206 insertions(+), 72 deletions(-) -- 2.54.0

1 7

[PATCH] bhyve: allow setting eui64 for NVMe disks
by Roman Bogorodskiy 24 Aug '26

24 Aug '26

Bhyve allows to set eui64 for the NVMe disks: eui64 IEEE Extended Unique Identifier (8 byte value). And in a real command line: -s 5:0,nvme,/data/img/10gb.img,ser=BHYVE-NVME01-F000,eui64=0x01000000efbeadde Model that using the <wwn> element: <disk type='file'> <driver name='file' type='raw'/> <source file='/path/to/some.img'/> <target dev='nvme0n1' bus='nvme'/> <wwn>01000000efbeadde</wwn> </disk> As this element does not allow commas, it's not necessary to add additional validation for that. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/901 Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- I think there's a bug in bhyve that results in a reversed order value, so I have to use "01000000efbeadde" to get "deadbeef00000001". I'm trying to address that in https://reviews.freebsd.org/D59080. src/bhyve/bhyve_command.c | 4 ++++ .../x86_64/bhyvexml2argv-2-nvme-2-controllers.args | 2 +- .../x86_64/bhyvexml2argv-2-nvme-2-controllers.xml | 1 + .../x86_64/bhyvexml2argv-nvme-explicit-controller.args | 2 +- .../x86_64/bhyvexml2argv-nvme-explicit-controller.xml | 1 + .../x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml | 1 + .../x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml | 1 + 7 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 956fcab06c..f0a87cffea 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -479,6 +479,10 @@ bhyveBuildNVMeControllerArgStr(const virDomainDef *def, virBufferAsprintf(&opt, ",maxq=%d", disk->queues); if (disk->queue_size) virBufferAsprintf(&opt, ",qsz=%d", disk->queue_size); + if (disk->wwn) + virBufferAsprintf(&opt, ",eui64=%s%s", + STRPREFIX(disk->wwn, "0x") ? "" : "0x", + disk->wwn); if (controller->opts.nvmeopts.serial) virBufferAsprintf(&opt, ",ser=%s", controller->opts.nvmeopts.serial); diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args index 664eec99bc..5be39bda1d 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args @@ -5,6 +5,6 @@ bhyve \ -H \ -P \ -s 0:0,hostbridge \ --s 2:0,nvme,/tmp/freebsd.img \ +-s 2:0,nvme,/tmp/freebsd.img,eui64=0xdeadbeef00000001 \ -s 3:0,nvme,/tmp/data.img \ bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml index 30f337197e..6a5efd3831 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml @@ -11,6 +11,7 @@ <driver name='file' type='raw'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>0xdeadbeef00000001</wwn> </disk> <disk type='file'> <driver name='file' type='raw'/> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args index 74dd4baa37..022a4df209 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args @@ -5,5 +5,5 @@ bhyve \ -H \ -P \ -s 0:0,hostbridge \ --s 2:0,nvme,/tmp/freebsd.img,maxq=2,qsz=256,ser=BHYVE-NVME0-01234 \ +-s 2:0,nvme,/tmp/freebsd.img,maxq=2,qsz=256,eui64=0x01000000efbeadde,ser=BHYVE-NVME0-01234 \ bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml index 9781d3aaef..fb7ed573c5 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml @@ -14,6 +14,7 @@ <driver name='file' type='raw' queues='2' queue_size='256'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>01000000efbeadde</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> </devices> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml index d0eb9c7fc8..107beef587 100644 --- a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml @@ -17,6 +17,7 @@ <driver name='file' type='raw'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>0xdeadbeef00000001</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <disk type='file' device='disk'> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml index f646267ec5..7c4dd2cdb3 100644 --- a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml @@ -17,6 +17,7 @@ <driver name='file' type='raw' queues='2' queue_size='256'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>01000000efbeadde</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='nvme' index='0'> -- 2.52.0

2 1

[libvirt PATCH] storage: logical: don't write past buffer bounds
by Ján Tomko 24 Aug '26

24 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> If parsed number of extents is 0, the calculated buffer size won't hold the first regex_unit. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage/storage_backend_logical.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 51e9337820..81f9d62d8b 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -161,12 +161,12 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, /* Allocate space for 'nextents' regex_unit strings plus a comma for each */ regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1); - strcat(regex, regex_unit); - for (i = 1; i < nextents; i++) { + for (i = 0; i < nextents; i++) { /* "," is the separator of "devices" field */ - strcat(regex, ","); strcat(regex, regex_unit); + strcat(regex, ","); } + regex[strlen(regex) - 1] = '\0'; re = g_regex_new(regex, 0, 0, &err); if (!re) { -- 2.55.0

2 1

[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks
by Ján Tomko 24 Aug '26

24 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> CVE-2026-77158 In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free. Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; } -- 2.55.0

2 1