- Devel - libvirt List Archives

[libvirt] [PATCH] don't let a bogus packet trigger over-allocation and segfault
by Jim Meyering 03 Mar '10

03 Mar '10

Another not-really-urgent fix: >From 4b56f03dee82657be3af5c79c826ae3091fbf522 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 3 Mar 2010 16:50:02 +0100 Subject: [PATCH] don't let a bogus packet trigger over-allocation and segfault * src/xen/proxy_internal.c (xenProxyDomainDumpXML): An invalid packet could include a too-large "ans.len" value, which would make us allocate too much memory and then copy data from beyond the end of "ans", possibly evoking a segfault. Ensure that the value we use is no larger than the remaining portion of "ans". Also, change unnecessary memmove to memcpy (src and dest obviously do not overlap, so no need to use memmove). --- src/xen/proxy_internal.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/xen/proxy_internal.c b/src/xen/proxy_internal.c index 8e1c226..bd234ec 100644 --- a/src/xen/proxy_internal.c +++ b/src/xen/proxy_internal.c @@ -978,26 +978,27 @@ xenProxyDomainDumpXML(virDomainPtr domain, int flags ATTRIBUTE_UNUSED) memset(&req, 0, sizeof(req)); req.command = VIR_PROXY_DOMAIN_XML; req.data.arg = domain->id; req.len = sizeof(req); ret = xenProxyCommand(domain->conn, &req, &ans, 0); if (ret < 0) { return(NULL); } - if (ans.len <= sizeof(virProxyPacket)) { + if (ans.len <= sizeof(virProxyPacket) + || ans.len > sizeof (ans) - sizeof(virProxyPacket)) { virProxyError(domain->conn, VIR_ERR_OPERATION_FAILED, __FUNCTION__); return (NULL); } xmllen = ans.len - sizeof(virProxyPacket); if (VIR_ALLOC_N(xml, xmllen+1) < 0) { virReportOOMError(); return NULL; } - memmove(xml, &ans.extra.dinfo, xmllen); + memcpy(xml, &ans.extra.dinfo, xmllen); xml[xmllen] = '\0'; return(xml); } /** * xenProxyDomainGetOSType: * @domain: a domain object -- 1.7.0.1.464.g0adc7

2 3

[libvirt] [PATCH] virFileReadLimFD: diagnose maxlen <= 0, rather than passing it on...
by Jim Meyering 03 Mar '10

03 Mar '10

Not urgent. >From 35a24209934cb983ca52e74f580b3ea963d92f57 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 3 Mar 2010 11:42:11 +0100 Subject: [PATCH] virFileReadLimFD: diagnose maxlen <= 0, rather than passing it on... to saferead_lim, which interprets it as a size_t. * src/util/util.c (virFileReadLimFD): Do not malfunction when maxlen < -1. Return -1,EINVAL in that case. Handle maxlen==0 in the same manner. --- src/util/util.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 34c585d..7a3a3c4 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -1030,10 +1030,17 @@ saferead_lim (int fd, size_t max_len, size_t *length) /* A wrapper around saferead_lim that maps a failure due to exceeding the maximum size limitation to EOVERFLOW. */ -int virFileReadLimFD(int fd, int maxlen, char **buf) +int +virFileReadLimFD(int fd, int maxlen, char **buf) { size_t len; - char *s = saferead_lim (fd, maxlen+1, &len); + char *s; + + if (maxlen <= 0) { + errno = EINVAL; + return -1; + } + s = saferead_lim (fd, maxlen+1, &len); if (s == NULL) return -1; if (len > maxlen || (int)len != len) { -- 1.7.0.1.464.g0adc7

2 1

[libvirt] [PATCH] qemu restore: don't let corrupt input provoke unwarranted OOM
by Jim Meyering 03 Mar '10

03 Mar '10

As the log says, we must not use a just-read (and unverified) header.xml_len as the size of buffer to allocate. While looking at this, I noticed a small problem with virFileReadLimFD. Passing it a limit < -1 would cause int->size_t trouble with saferead_lim. Separate patch coming up. >From a4906ba24b576f3219234c519c88d102df2173b2 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 3 Mar 2010 11:27:16 +0100 Subject: [PATCH] qemu restore: don't let corrupt input provoke unwarranted OOM * src/qemu/qemu_driver.c (qemudDomainRestore): A corrupt save file (in particular, a too-large header.xml_len value) would cause an unwarranted out-of-memory error. Do not trust the just-read header.xml_len. Instead, merely use that as a hint, and read/allocate up to that number of bytes from the file. Also verify that header.xml_len is positive; if it were negative, passing it to virFileReadLimFD could cause trouble. --- src/qemu/qemu_driver.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7f7c459..5c9d003 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4725,44 +4725,45 @@ static int qemudDomainRestore(virConnectPtr conn, if (saferead(fd, &header, sizeof(header)) != sizeof(header)) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to read qemu header")); goto cleanup; } if (memcmp(header.magic, QEMUD_SAVE_MAGIC, sizeof(header.magic)) != 0) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("image magic is incorrect")); goto cleanup; } if (header.version > QEMUD_SAVE_VERSION) { qemuReportError(VIR_ERR_OPERATION_FAILED, _("image version is not supported (%d > %d)"), header.version, QEMUD_SAVE_VERSION); goto cleanup; } - if (VIR_ALLOC_N(xml, header.xml_len) < 0) { - virReportOOMError(); + if (header.xml_len <= 0) { + qemuReportError(VIR_ERR_OPERATION_FAILED, + _("invalid XML length: %d"), header.xml_len); goto cleanup; } - if (saferead(fd, xml, header.xml_len) != header.xml_len) { + if (virFileReadLimFD(fd, header.xml_len, &xml) != header.xml_len) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to read XML")); goto cleanup; } /* Create a domain from this XML */ if (!(def = virDomainDefParseString(driver->caps, xml, VIR_DOMAIN_XML_INACTIVE))) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to parse XML")); goto cleanup; } if (virDomainObjIsDuplicate(&driver->domains, def, 1) < 0) goto cleanup; if (!(vm = virDomainAssignDef(driver->caps, &driver->domains, def))) { -- 1.7.0.1.464.g0adc7

2 1

[libvirt] [PATCH 0/1] - for comments/help only, nearly working root-squash-domain-save
by Laine Stump 03 Mar '10

03 Mar '10

(This patch requires that you first apply the virFileOperation patches that I sent to the list yesterday.) I'm hoping someone else's keen eye can see what I'm failing to see here. The patch following this message makes domain save "work" on root-squash NFS (both the libvirt header and the QEMU state are saved to the file), but the files that it saves don't restore properly, even when simply saving to a local directory w/o forking - the guest screen comes up black, or reboots immediately, or some other such thing. I've looked at the data files and the code, and can't see what difference is causing this - at least the header written by libvirt seems to be the same, and the part written by qemu starts in the same place and looks similar. If anyone's got an idea, please let me know! I'd like to get this figured out and a working patch submitted before the day is done.

3 6

[libvirt] [PATCH 0/4] Misc hotplug fixes for QEMU
by Daniel P. Berrange 03 Mar '10

03 Mar '10

This is a series of fixes for hotplug in QEMU

1 4

[libvirt] [PATCH 0/1] Support domain restore from root-squash NFS
by Laine Stump 03 Mar '10

03 Mar '10

Most of the explanation is in the commit message with the patch proper. When reveiwing please take pains to point out any places where I may not be diligent enough cleaning up loose ends, especially in terms of assuring that the child process always terminates properly no matter what happens. The (unrelated) race condition in qemudDomainRestore() remains - I solved it locally by putting a sleep(10) just before qemuMonitorStartCPUs(), but it needs something with a bit higher comfort factor ;-)

5 11

[libvirt] [PATCH] virsh: silence compiler warning
by Eric Blake 03 Mar '10

03 Mar '10

gcc warns: virsh.c:1879: warning: '0' flag ignored with '-' flag in gnu_printf format * tools/virsh.c (cmdDomjobinfo): Delete useless flag. --- tools/virsh.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index a6a637d..65487ed 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1876,27 +1876,27 @@ cmdDomjobinfo(vshControl *ctl, const vshCmd *cmd) vshPrint(ctl, "%-17s %-12llu ms\n", _("Time remaining:"), info.timeRemaining); if (info.dataTotal || info.dataRemaining || info.dataProcessed) { val = prettyCapacity(info.dataProcessed, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Data processed:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Data processed:"), val, unit); val = prettyCapacity(info.dataRemaining, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Data remaining:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Data remaining:"), val, unit); val = prettyCapacity(info.dataTotal, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Data total:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Data total:"), val, unit); } if (info.memTotal || info.memRemaining || info.memProcessed) { val = prettyCapacity(info.memProcessed, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Memory processed:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Memory processed:"), val, unit); val = prettyCapacity(info.memRemaining, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Memory remaining:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Memory remaining:"), val, unit); val = prettyCapacity(info.memTotal, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("Memory total:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("Memory total:"), val, unit); } if (info.fileTotal || info.fileRemaining || info.fileProcessed) { val = prettyCapacity(info.fileProcessed, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("File processed:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("File processed:"), val, unit); val = prettyCapacity(info.fileRemaining, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("File remaining:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("File remaining:"), val, unit); val = prettyCapacity(info.fileTotal, &unit); - vshPrint(ctl, "%-17s %-0.3lf %s\n", _("File total:"), val, unit); + vshPrint(ctl, "%-17s %-.3lf %s\n", _("File total:"), val, unit); } } else { ret = FALSE; -- 1.6.6.1

3 4

[libvirt] [PATCH] Add TCK script for host USB device hotplug/unplug
by Daniel P. Berrange 03 Mar '10

03 Mar '10

This adds support for testing host USB device hotplug/unplug in libvirt drivers. This currently fails in all known libvirt drivers :-) The QEMU driver only support the hotplug action, not unplug, hence the failure. Since the TCK can't assume there are any host USB devices that can be safely messed around with, the person running the test suite must first list one or more devices in the config file. If no devices are listed, the test will automatically skip all parts, rather than failing. * conf/default.cfg: Config entry to specify USB devices that the TCK can mess around with * lib/Sys/Virt/TCK.pm: API for getting a host USB device from the config * scripts/domain/240-usb-host-hotplug.t: Test case for USB device hotplug/unplug. --- conf/default.cfg | 13 +++++ lib/Sys/Virt/TCK.pm | 18 +++++++ scripts/domain/240-usb-host-hotplug.t | 89 +++++++++++++++++++++++++++++++++ 3 files changed, 120 insertions(+), 0 deletions(-) create mode 100644 scripts/domain/240-usb-host-hotplug.t diff --git a/conf/default.cfg b/conf/default.cfg index 556225e..f9c2b5c 100644 --- a/conf/default.cfg +++ b/conf/default.cfg @@ -99,3 +99,16 @@ kernels = ( # ostype = exe # } ) + +# Host USB devices that the test suite can safely mess around with +# without risk of breaking the host OS +host_usb_devices = ( +# Must list either vendor+product, or bus+dev, or both +# { +# vendor = 0x0627 +# product = 0x0001 +# bus = 001 +# device = 002 +# } +# Can list more than one USB device if many are available +) diff --git a/lib/Sys/Virt/TCK.pm b/lib/Sys/Virt/TCK.pm index 9e6b554..ce03935 100644 --- a/lib/Sys/Virt/TCK.pm +++ b/lib/Sys/Virt/TCK.pm @@ -769,4 +769,22 @@ sub xpath { return $xp->find($path); } +sub get_host_usb_device { + my $self = shift; + my $devindex = @_ ? shift : 0; + + my $devs = $self->config("host_usb_devices", []); + + if ($devindex > $#{$devs}) { + return (); + } + + my $bus = $self->config("host_usb_devices/[$devindex]/bus", undef); + my $device = $self->config("host_usb_devices/[$devindex]/device", undef); + my $vendor = $self->config("host_usb_devices/[$devindex]/vendor", undef); + my $product = $self->config("host_usb_devices/[$devindex]/product", undef); + + return ($bus, $device, $vendor, $product); +} + 1; diff --git a/scripts/domain/240-usb-host-hotplug.t b/scripts/domain/240-usb-host-hotplug.t new file mode 100644 index 0000000..4729300 --- /dev/null +++ b/scripts/domain/240-usb-host-hotplug.t @@ -0,0 +1,89 @@ +# -*- perl -*- +# +# Copyright (C) 2009 Red Hat +# Copyright (C) 2009 Daniel P. Berrange +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +domain/240-usb-host-hotplug.t - verify hot plug & unplug of a host USB device + +=head1 DESCRIPTION + +The test case validates that it is possible to hotplug a usb +host device to a running domain, and then unplug it again. +This requires that the TCK configuration file have at least +one host USB device listed. + +=cut + +use strict; +use warnings; + +use Test::More tests => 5; + +use Sys::Virt::TCK; +use Test::Exception; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + + +my $xml = $tck->generic_domain("tck")->as_xml; + +diag "Creating a new transient domain"; +my $dom; +ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + + +my ($bus, $device, $vendor, $product) = $tck->get_host_usb_device(); + +SKIP: { + # Must have one of the pairs at least + unless (($bus && $device) || ($vendor && $product)) { + skip "No host usb device available in configuration file", 4; + } + + my $devxml = "<hostdev mode='subsystem' type='usb'>\n" . + "<source>\n"; + if ($bus && $device) { + $devxml .= "<address bus='$bus' device='$device'/>\n" + } + if ($vendor && $product) { + $devxml .= "<vendor id='$vendor'/>\n"; + $devxml .= "<product id='$product'/>\n"; + } + $devxml .= "</source>\n" . + "</hostdev>\n"; + + my $initialxml = $dom->get_xml_description; + + diag "Attaching the new dev $devxml"; + lives_ok(sub { $dom->attach_device($devxml); }, "USB dev has been attached"); + + my $newxml = $dom->get_xml_description; + ok($newxml =~ m|<hostdev|, "new XML has extra USB dev present"); + + diag "Detaching the new dev $devxml"; + lives_ok(sub { $dom->detach_device($devxml); }, "USB dev has been detached"); + + + my $finalxml = $dom->get_xml_description; + + is($initialxml, $finalxml, "final XML has removed the disk") +} + -- 1.6.5.2

1 0

[libvirt] [PATCH] web docs -- macvtap mode explanation
by Stefan Berger 03 Mar '10

03 Mar '10

This adds more information about the different macvtap device modes. Regards, Stefan

1 0

[libvirt] Xen Daemon error : internal error domain information incomplete, missing cpu_cap
by "J. Oriol Fitó" 03 Mar '10

03 Mar '10

Hi all, I'm using VirtMonitor on top of Xen and I'm wondering when the 'cpu_cap' feature will be available. Best regards, Oriol

1 0