2:34 a.m.
This reduces the affect of an unexpected DoS vulnerablity in libvirtd.
---
include/libvirt/libvirt.h.in | 13 +++++++++++++
src/driver.h | 5 +++++
src/libvirt.c | 32 +++++++++++++++++++++++++++++++
src/libvirt_private.syms | 1 +
src/libvirt_public.syms | 4 ++++
src/qemu/qemu_driver.c | 16 ++++++++++++++++
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 15 ++++++++++++++-
src/util/virutil.c | 23 ++++++++++++++++++++++
src/util/virutil.h | 1 +
tools/virsh-host.c | 45 ++++++++++++++++++++++++++++++++++++++++++++
11 files changed, 155 insertions(+), 1 deletion(-)
diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in
index 930b7e8..d0db483 100644
--- a/include/libvirt/libvirt.h.in
+++ b/include/libvirt/libvirt.h.in
@@ -1540,6 +1540,19 @@ char * virConnectGetURI (virConnectPtr
conn);
char * virConnectGetSysinfo (virConnectPtr conn,
unsigned int flags);
+typedef enum {
+ VIR_CONNECT_CRASH_RANDOM = 0, /* Randomly choose one crash method */
+ VIR_CONNECT_CRASH_NULL_PTR = 1, /* Null pointer access */
+ VIR_CONNECT_CRASH_DOUBLE_FREE = 2, /* Double free */
+
+# ifdef VIR_ENUM_SENTINELS
+ VIR_CONNECT_CRASH_LAST
+# endif
+} virConnectCrashFlags;
+
+int virConnectCrashDaemon (virConnectPtr conn,
+ unsigned int flags);
+
int virConnectSetKeepAlive(virConnectPtr conn,
int interval,
unsigned int count);
diff --git a/src/driver.h b/src/driver.h
index e66fc7a..b899a4f 100644
--- a/src/driver.h
+++ b/src/driver.h
@@ -1149,6 +1149,10 @@ typedef int
unsigned int flags,
int cancelled);
+typedef int
+(*virDrvConnectCrashDaemon)(virConnectPtr conn,
+ unsigned int flags);
+
typedef struct _virDriver virDriver;
typedef virDriver *virDriverPtr;
@@ -1363,6 +1367,7 @@ struct _virDriver {
virDrvDomainMigrateFinish3Params domainMigrateFinish3Params;
virDrvDomainMigrateConfirm3Params domainMigrateConfirm3Params;
virDrvConnectGetCPUModelNames connectGetCPUModelNames;
+ virDrvConnectCrashDaemon connectCrashDaemon;
};
diff --git a/src/libvirt.c b/src/libvirt.c
index 4454829..739c747 100644
--- a/src/libvirt.c
+++ b/src/libvirt.c
@@ -1717,6 +1717,38 @@ virConnectGetSysinfo(virConnectPtr conn, unsigned int flags)
/**
+ * virConnectCrashDaemon:
+ * @conn: pointer to a hypervisor connection
+ * @flags: one of virConnectCrashDaemonFlags
+ *
+ * Crashes the daemon by the method selected via @flags.
+ *
+ * Returns -1 on error or doesn't return at all in case of success.
+ */
+int
+virConnectCrashDaemon(virConnectPtr conn, unsigned int flags)
+{
+ VIR_DEBUG("conn=%p, flags=%x", conn, flags);
+
+ virResetLastError();
+
+ virCheckConnectReturn(conn, -1);
+
+ if (conn->driver->connectCrashDaemon) {
+ if (conn->driver->connectCrashDaemon(conn, flags) < 0)
+ goto error;
+ return 0;
+ }
+
+ virReportUnsupportedError();
+
+error:
+ virDispatchError(conn);
+ return -1;
+}
+
+
+/**
* virConnectGetMaxVcpus:
* @conn: pointer to the hypervisor connection
* @type: value of the 'type' attribute in the <domain> element
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 38fbf63..18f91b2 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1983,6 +1983,7 @@ virUSBDeviceSetUsedBy;
# util/virutil.h
virCompareLimitUlong;
+virCrashDaemon;
virDoubleToStr;
virEnumFromString;
virEnumToString;
diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms
index 9ab0c92..378d256 100644
--- a/src/libvirt_public.syms
+++ b/src/libvirt_public.syms
@@ -650,5 +650,9 @@ LIBVIRT_1.2.3 {
virDomainCoreDumpWithFormat;
} LIBVIRT_1.2.1;
+LIBVIRT_1.2.4 {
+ global:
+ virConnectCrashDaemon;
+} LIBVIRT_1.2.3;
# .... define new API here using predicted next version number ....
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index b032441..cd258b7 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -16661,6 +16661,21 @@ qemuConnectGetCPUModelNames(virConnectPtr conn,
}
+static int
+qemuConnectCrashDaemon(virConnectPtr conn ATTRIBUTE_UNUSED,
+ unsigned int flags)
+{
+ if (flags >= VIR_CONNECT_CRASH_LAST) {
+ virReportError(VIR_ERR_INVALID_ARG,
+ _("Unsupported crash method %u"),
+ flags);
+ return -1;
+ }
+
+ return virCrashDaemon(flags);
+}
+
+
static virDriver qemuDriver = {
.no = VIR_DRV_QEMU,
.name = QEMU_DRIVER_NAME,
@@ -16851,6 +16866,7 @@ static virDriver qemuDriver = {
.domainMigrateFinish3Params = qemuDomainMigrateFinish3Params, /* 1.1.0 */
.domainMigrateConfirm3Params = qemuDomainMigrateConfirm3Params, /* 1.1.0 */
.connectGetCPUModelNames = qemuConnectGetCPUModelNames, /* 1.1.3 */
+ .connectCrashDaemon = qemuConnectCrashDaemon, /* 1.2.4 */
};
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index ed7dde6..b01dd5b 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -7800,6 +7800,7 @@ static virDriver remote_driver = {
.domainMigrateFinish3Params = remoteDomainMigrateFinish3Params, /* 1.1.0 */
.domainMigrateConfirm3Params = remoteDomainMigrateConfirm3Params, /* 1.1.0 */
.connectGetCPUModelNames = remoteConnectGetCPUModelNames, /* 1.1.3 */
+ .connectCrashDaemon = remoteConnectCrashDaemon, /* 1.2.4 */
};
static virNetworkDriver network_driver = {
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
index 6c445cc..7eb7f83 100644
--- a/src/remote/remote_protocol.x
+++ b/src/remote/remote_protocol.x
@@ -442,6 +442,13 @@ struct remote_connect_get_sysinfo_ret {
remote_nonnull_string sysinfo;
};
+struct remote_connect_crash_daemon_args {
+ unsigned int flags;
+};
+
+struct remote_connect_crash_daemon_ret {
+ int retval;
+};
struct remote_connect_get_uri_ret {
remote_nonnull_string uri;
};
@@ -5275,5 +5282,11 @@ enum remote_procedure {
* @generate: both
* @acl: domain:core_dump
*/
- REMOTE_PROC_DOMAIN_CORE_DUMP_WITH_FORMAT = 334
+ REMOTE_PROC_DOMAIN_CORE_DUMP_WITH_FORMAT = 334,
+
+ /**
+ * @generate: both
+ * @acl: none
+ */
+ REMOTE_PROC_CONNECT_CRASH_DAEMON = 335
};
diff --git a/src/util/virutil.c b/src/util/virutil.c
index 9be1590..97215d0 100644
--- a/src/util/virutil.c
+++ b/src/util/virutil.c
@@ -78,6 +78,7 @@
#include "vircommand.h"
#include "nonblocking.h"
#include "virprocess.h"
+#include "virrandom.h"
#include "virstring.h"
#include "virutil.h"
@@ -2204,3 +2205,25 @@ void virUpdateSelfLastChanged(const char *path)
selfLastChanged = sb.st_ctime;
}
}
+
+int virCrashDaemon(unsigned int flags)
+{
+ char **bla = NULL;
+ char **tmp;
+
+ if (flags == VIR_CONNECT_CRASH_RANDOM)
+ flags = virRandomInt(VIR_CONNECT_CRASH_LAST) + 1;
+
+ switch (flags) {
+ case VIR_CONNECT_CRASH_NULL_PTR:
+ bla[1] = bla[0];
+ /* fallthrough */
+ case VIR_CONNECT_CRASH_DOUBLE_FREE:
+ if (VIR_ALLOC_N(bla, 2) < 0)
+ return -1;
+ tmp = bla;
+ VIR_FREE(tmp);
+ VIR_FREE(bla);
+ }
+ return -1;
+}
diff --git a/src/util/virutil.h b/src/util/virutil.h
index 1f2efd5..aaf1bef 100644
--- a/src/util/virutil.h
+++ b/src/util/virutil.h
@@ -202,4 +202,5 @@ bool virIsSUID(void);
time_t virGetSelfLastChanged(void);
void virUpdateSelfLastChanged(const char *path);
+int virCrashDaemon(unsigned int flags);
#endif /* __VIR_UTIL_H__ */
diff --git a/tools/virsh-host.c b/tools/virsh-host.c
index cac6086..28e5e3b 100644
--- a/tools/virsh-host.c
+++ b/tools/virsh-host.c
@@ -939,6 +939,45 @@ cmdNodeMemoryTune(vshControl *ctl, const vshCmd *cmd)
goto cleanup;
}
+/*
+ * "crash" command
+ */
+static const vshCmdInfo info_crash[] = {
+ {.name = "help",
+ .data = N_("crash the daemon")
+ },
+ {.name = "desc",
+ .data = N_("Crash the libvirt daemon using the selected method.")
+ },
+ {.name = NULL}
+};
+
+static const vshCmdOptDef opts_crash[] = {
+ {.name = "null",
+ .type = VSH_OT_BOOL,
+ .help = N_("Crash by null pointer access")
+ },
+ {.name = "doublefree",
+ .type = VSH_OT_BOOL,
+ .help = N_("Crash by double free")
+ },
+ {.name = NULL}
+};
+
+static bool
+cmdCrash(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED)
+{
+ unsigned int flags = VIR_CONNECT_CRASH_RANDOM;
+
+ if (vshCommandOptBool(cmd, "null"))
+ flags = VIR_CONNECT_CRASH_NULL_PTR;
+ if (vshCommandOptBool(cmd, "doublefree"))
+ flags = VIR_CONNECT_CRASH_DOUBLE_FREE;
+
+ virConnectCrashDaemon(ctl->conn, flags);
+ return true;
+}
+
const vshCmdDef hostAndHypervisorCmds[] = {
{.name = "capabilities",
.handler = cmdCapabilities,
@@ -1024,5 +1063,11 @@ const vshCmdDef hostAndHypervisorCmds[] = {
.info = info_version,
.flags = 0
},
+ {.name = "crash",
+ .handler = cmdCrash,
+ .opts = opts_crash,
+ .info = info_crash,
+ .flags = 0
+ },
{.name = NULL}
};
--
1.8.3.2