1. 15 1月, 2014 4 次提交
    • J
      qemu: Fix job usage in qemuDomainBlockCopy · 939b0818
      Jiri Denemark 提交于
      Every API that is going to begin a job should do that before fetching
      data from vm->def.
      
      (cherry picked from commit ff5f30b6)
      939b0818
    • J
      qemu: Fix job usage in qemuDomainBlockJobImpl · bcb9a035
      Jiri Denemark 提交于
      CVE-2013-6458
      
      Every API that is going to begin a job should do that before fetching
      data from vm->def.
      
      (cherry picked from commit f93d2caa)
      bcb9a035
    • J
      qemu: Avoid using stale data in virDomainGetBlockInfo · 54cb7f05
      Jiri Denemark 提交于
      CVE-2013-6458
      
      Generally, every API that is going to begin a job should do that before
      fetching data from vm->def. However, qemuDomainGetBlockInfo does not
      know whether it will have to start a job or not before checking vm->def.
      To avoid using disk alias that might have been freed while we were
      waiting for a job, we use its copy. In case the disk was removed in the
      meantime, we will fail with "cannot find statistics for device '...'"
      error message.
      
      (cherry picked from commit b7992595)
      54cb7f05
    • J
      qemu: Do not access stale data in virDomainBlockStats · 17db7e28
      Jiri Denemark 提交于
      CVE-2013-6458
      https://bugzilla.redhat.com/show_bug.cgi?id=1043069
      
      When virDomainDetachDeviceFlags is called concurrently to
      virDomainBlockStats: libvirtd may crash because qemuDomainBlockStats
      finds a disk in vm->def before getting a job on a domain and uses the
      disk pointer after getting the job. However, the domain in unlocked
      while waiting on a job condition and thus data behind the disk pointer
      may disappear. This happens when thread 1 runs
      virDomainDetachDeviceFlags and enters monitor to actually remove the
      disk. Then another thread starts running virDomainBlockStats, finds the
      disk in vm->def, and while it's waiting on the job condition (owned by
      the first thread), the first thread finishes the disk removal. When the
      second thread gets the job, the memory pointed to be the disk pointer is
      already gone.
      
      That said, every API that is going to begin a job should do that before
      fetching data from vm->def.
      
      (cherry picked from commit db86da5c)
      17db7e28
  2. 29 12月, 2013 1 次提交
    • D
      libxl: avoid crashing if calling `virsh numatune' on inactive domain · 52c40003
      Dario Faggioli 提交于
      by, in libxlDomainGetNumaParameters(), calling libxl_bitmap_init() as soon as
      possible, which avoids getting to 'cleanup:', where libxl_bitmap_dispose()
      happens, without having initialized the nodemap, and hence crashing after some
      invalid free()-s:
      
       # ./daemon/libvirtd -v
       *** Error in `/home/xen/libvirt.git/daemon/.libs/lt-libvirtd': munmap_chunk(): invalid pointer: 0x00007fdd42592666 ***
       ======= Backtrace: =========
       /lib64/libc.so.6(+0x7bbe7)[0x7fdd3f767be7]
       /lib64/libxenlight.so.4.3(libxl_bitmap_dispose+0xd)[0x7fdd2c88c045]
       /home/xen/libvirt.git/daemon/.libs/../../src/.libs/libvirt_driver_libxl.so(+0x12d26)[0x7fdd2caccd26]
       /home/xen/libvirt.git/src/.libs/libvirt.so.0(virDomainGetNumaParameters+0x15c)[0x7fdd4247898c]
       /home/xen/libvirt.git/daemon/.libs/lt-libvirtd(+0x1d9a2)[0x7fdd42ecc9a2]
       /home/xen/libvirt.git/src/.libs/libvirt.so.0(virNetServerProgramDispatch+0x3da)[0x7fdd424e9eaa]
       /home/xen/libvirt.git/src/.libs/libvirt.so.0(+0x1a6f38)[0x7fdd424e3f38]
       /home/xen/libvirt.git/src/.libs/libvirt.so.0(+0xa81e5)[0x7fdd423e51e5]
       /home/xen/libvirt.git/src/.libs/libvirt.so.0(+0xa783e)[0x7fdd423e483e]
       /lib64/libpthread.so.0(+0x7c53)[0x7fdd3febbc53]
       /lib64/libc.so.6(clone+0x6d)[0x7fdd3f7e1dbd]
      Signed-off-by: NDario Faggili <dario.faggioli@citrix.com>
      Cc: Jim Fehlig <jfehlig@suse.com>
      Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
      (cherry picked from commit f9ee91d3)
      
      Conflicts:
      	src/libxl/libxl_driver.c
      52c40003
  3. 20 12月, 2013 2 次提交
    • M
      Fix crash in lxcDomainSetMemoryParameters · f4607504
      Martin Kletzander 提交于
      The function doesn't check whether the request is made for active or
      inactive domain.  Thus when the domain is not running it still tries
      accessing non-existing cgroups (priv->cgroup, which is NULL).
      
      I re-made the function in order for it to work the same way it's qemu
      counterpart does.
      
      Reproducer:
       1) Define an LXC domain
       2) Do 'virsh memtune <domain> --hard-limit 133T'
      
      Backtrace:
       Thread 6 (Thread 0x7fffec8c0700 (LWP 26826)):
       #0  0x00007ffff70edcc4 in virCgroupPathOfController (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", path=0x7fffec8bf718) at util/vircgroup.c:1764
       #1  0x00007ffff70e9206 in virCgroupSetValueStr (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", value=0x7fffe409f360 "1073741824")
           at util/vircgroup.c:669
       #2  0x00007ffff70e98b4 in virCgroupSetValueU64 (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", value=1073741824) at util/vircgroup.c:740
       #3  0x00007ffff70ee518 in virCgroupSetMemory (group=0x0, kb=1048576) at util/vircgroup.c:1904
       #4  0x00007ffff70ee675 in virCgroupSetMemoryHardLimit (group=0x0, kb=1048576)
           at util/vircgroup.c:1944
       #5  0x00005555557d54c8 in lxcDomainSetMemoryParameters (dom=0x7fffe40cc420,
           params=0x7fffe409f100, nparams=1, flags=0) at lxc/lxc_driver.c:774
       #6  0x00007ffff72c20f9 in virDomainSetMemoryParameters (domain=0x7fffe40cc420,
           params=0x7fffe409f100, nparams=1, flags=0) at libvirt.c:4051
       #7  0x000055555561365f in remoteDispatchDomainSetMemoryParameters (server=0x555555eb7e00,
           client=0x555555ec4b10, msg=0x555555eb94e0, rerr=0x7fffec8bfb70, args=0x7fffe40b8510)
           at remote_dispatch.h:7621
       #8  0x00005555556133fd in remoteDispatchDomainSetMemoryParametersHelper (server=0x555555eb7e00,
           client=0x555555ec4b10, msg=0x555555eb94e0, rerr=0x7fffec8bfb70, args=0x7fffe40b8510,
           ret=0x7fffe40b84f0) at remote_dispatch.h:7591
       #9  0x00007ffff73b293f in virNetServerProgramDispatchCall (prog=0x555555ec3ae0,
           server=0x555555eb7e00, client=0x555555ec4b10, msg=0x555555eb94e0)
           at rpc/virnetserverprogram.c:435
       #10 0x00007ffff73b207f in virNetServerProgramDispatch (prog=0x555555ec3ae0,
           server=0x555555eb7e00, client=0x555555ec4b10, msg=0x555555eb94e0)
           at rpc/virnetserverprogram.c:305
       #11 0x00007ffff73a4d2c in virNetServerProcessMsg (srv=0x555555eb7e00, client=0x555555ec4b10,
           prog=0x555555ec3ae0, msg=0x555555eb94e0) at rpc/virnetserver.c:165
       #12 0x00007ffff73a4e8d in virNetServerHandleJob (jobOpaque=0x555555ec3e30, opaque=0x555555eb7e00)
           at rpc/virnetserver.c:186
       #13 0x00007ffff7187f3f in virThreadPoolWorker (opaque=0x555555eb7ac0) at util/virthreadpool.c:144
       #14 0x00007ffff718733a in virThreadHelper (data=0x555555eb7890) at util/virthreadpthread.c:161
       #15 0x00007ffff468ed89 in start_thread (arg=0x7fffec8c0700) at pthread_create.c:308
       #16 0x00007ffff3da26bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
      Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>
      (cherry picked from commit 9faf3f29)
      f4607504
    • M
      CVE-2013-6436: fix crash in lxcDomainGetMemoryParameters · 79384018
      Martin Kletzander 提交于
      The function doesn't check whether the request is made for active or
      inactive domain.  Thus when the domain is not running it still tries
      accessing non-existing cgroups (priv->cgroup, which is NULL).
      
      I re-made the function in order for it to work the same way it's qemu
      counterpart does.
      
      Reproducer:
       1) Define an LXC domain
       2) Do 'virsh memtune <domain>'
      
      Backtrace:
       Thread 6 (Thread 0x7fffec8c0700 (LWP 13387)):
       #0  0x00007ffff70edcc4 in virCgroupPathOfController (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", path=0x7fffec8bf750) at util/vircgroup.c:1764
       #1  0x00007ffff70e958c in virCgroupGetValueStr (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", value=0x7fffec8bf7c0) at util/vircgroup.c:705
       #2  0x00007ffff70e9d29 in virCgroupGetValueU64 (group=0x0, controller=3,
           key=0x7ffff75734bd "memory.limit_in_bytes", value=0x7fffec8bf810) at util/vircgroup.c:804
       #3  0x00007ffff70ee706 in virCgroupGetMemoryHardLimit (group=0x0, kb=0x7fffec8bf8a8)
           at util/vircgroup.c:1962
       #4  0x00005555557d590f in lxcDomainGetMemoryParameters (dom=0x7fffd40024a0,
           params=0x7fffd40027a0, nparams=0x7fffec8bfa24, flags=0) at lxc/lxc_driver.c:826
       #5  0x00007ffff72c28d3 in virDomainGetMemoryParameters (domain=0x7fffd40024a0,
           params=0x7fffd40027a0, nparams=0x7fffec8bfa24, flags=0) at libvirt.c:4137
       #6  0x000055555563714d in remoteDispatchDomainGetMemoryParameters (server=0x555555eb7e00,
           client=0x555555ebaef0, msg=0x555555ebb3e0, rerr=0x7fffec8bfb70, args=0x7fffd40024e0,
           ret=0x7fffd4002420) at remote.c:1895
       #7  0x00005555556052c4 in remoteDispatchDomainGetMemoryParametersHelper (server=0x555555eb7e00,
           client=0x555555ebaef0, msg=0x555555ebb3e0, rerr=0x7fffec8bfb70, args=0x7fffd40024e0,
           ret=0x7fffd4002420) at remote_dispatch.h:4050
       #8  0x00007ffff73b293f in virNetServerProgramDispatchCall (prog=0x555555ec3ae0,
           server=0x555555eb7e00, client=0x555555ebaef0, msg=0x555555ebb3e0)
           at rpc/virnetserverprogram.c:435
       #9  0x00007ffff73b207f in virNetServerProgramDispatch (prog=0x555555ec3ae0,
           server=0x555555eb7e00, client=0x555555ebaef0, msg=0x555555ebb3e0)
           at rpc/virnetserverprogram.c:305
       #10 0x00007ffff73a4d2c in virNetServerProcessMsg (srv=0x555555eb7e00, client=0x555555ebaef0,
           prog=0x555555ec3ae0, msg=0x555555ebb3e0) at rpc/virnetserver.c:165
       #11 0x00007ffff73a4e8d in virNetServerHandleJob (jobOpaque=0x555555ebc7e0, opaque=0x555555eb7e00)
           at rpc/virnetserver.c:186
       #12 0x00007ffff7187f3f in virThreadPoolWorker (opaque=0x555555eb7ac0) at util/virthreadpool.c:144
       #13 0x00007ffff718733a in virThreadHelper (data=0x555555eb7890) at util/virthreadpthread.c:161
       #14 0x00007ffff468ed89 in start_thread (arg=0x7fffec8c0700) at pthread_create.c:308
       #15 0x00007ffff3da26bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
      Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>
      (cherry picked from commit f8c1cb90)
      79384018
  4. 13 11月, 2013 2 次提交
    • M
      qemu: Don't access vm->priv on unlocked domain · b861c09a
      Michal Privoznik 提交于
      Since 86d90b3a (yes, my patch; again) we are supporting NBD storage
      migration. However, on error recovery path we got the steps reversed.
      The correct order is: return NBD port to the virPortAllocator and then
      either unlock the vm or remove it from the driver. Not vice versa.
      
      ==11192== Invalid write of size 4
      ==11192==    at 0x11488559: qemuMigrationPrepareAny (qemu_migration.c:2459)
      ==11192==    by 0x11488EA6: qemuMigrationPrepareDirect (qemu_migration.c:2652)
      ==11192==    by 0x114D1509: qemuDomainMigratePrepare3Params (qemu_driver.c:10332)
      ==11192==    by 0x519075D: virDomainMigratePrepare3Params (libvirt.c:7290)
      ==11192==    by 0x1502DA: remoteDispatchDomainMigratePrepare3Params (remote.c:4798)
      ==11192==    by 0x12DECA: remoteDispatchDomainMigratePrepare3ParamsHelper (remote_dispatch.h:5741)
      ==11192==    by 0x5212127: virNetServerProgramDispatchCall (virnetserverprogram.c:435)
      ==11192==    by 0x5211C86: virNetServerProgramDispatch (virnetserverprogram.c:305)
      ==11192==    by 0x520A8FD: virNetServerProcessMsg (virnetserver.c:165)
      ==11192==    by 0x520A9E1: virNetServerHandleJob (virnetserver.c:186)
      ==11192==    by 0x50DA78F: virThreadPoolWorker (virthreadpool.c:144)
      ==11192==    by 0x50DA11C: virThreadHelper (virthreadpthread.c:161)
      ==11192==  Address 0x1368baa0 is 576 bytes inside a block of size 688 free'd
      ==11192==    at 0x4A07F5C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==11192==    by 0x5079A2F: virFree (viralloc.c:580)
      ==11192==    by 0x11456C34: qemuDomainObjPrivateFree (qemu_domain.c:267)
      ==11192==    by 0x50F41B4: virDomainObjDispose (domain_conf.c:2034)
      ==11192==    by 0x50C2991: virObjectUnref (virobject.c:262)
      ==11192==    by 0x50F4CFC: virDomainObjListRemove (domain_conf.c:2361)
      ==11192==    by 0x1145C125: qemuDomainRemoveInactive (qemu_domain.c:2087)
      ==11192==    by 0x11488520: qemuMigrationPrepareAny (qemu_migration.c:2456)
      ==11192==    by 0x11488EA6: qemuMigrationPrepareDirect (qemu_migration.c:2652)
      ==11192==    by 0x114D1509: qemuDomainMigratePrepare3Params (qemu_driver.c:10332)
      ==11192==    by 0x519075D: virDomainMigratePrepare3Params (libvirt.c:7290)
      ==11192==    by 0x1502DA: remoteDispatchDomainMigratePrepare3Params (remote.c:4798)
      Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
      (cherry picked from commit 1f2f879e)
      b861c09a
    • J
      Disable nwfilter driver when running unprivileged · 17cfc546
      Ján Tomko 提交于
      When opening a new connection to the driver, nwfilterOpen
      only succeeds if the driverState has been allocated.
      
      Move the privilege check in driver initialization before
      the state allocation to disable the driver.
      
      This changes the nwfilter-define error from:
      error: cannot create config directory (null): Bad address
      To:
      this function is not supported by the connection driver:
      virNWFilterDefineXML
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1029266
      (cherry picked from commit b7829f95)
      17cfc546
  5. 30 10月, 2013 13 次提交
  6. 23 10月, 2013 3 次提交
    • M
      python: Fix Create*WithFiles filefd passing · 713a4f4b
      Marian Neagul 提交于
      Commit d76227be added functions virDomainCreateWithFiles and
      virDomainCreateXMLWithFiles, but there was a little piece missing in
      python bindings.  This patch fixes proper passing of file descriptors
      in the overwrites of these functions.
      713a4f4b
    • J
      build: fix build of virt-login-shell on systems with older gnutls · 549f9649
      Jim Fehlig 提交于
      On systems where gnutls uses libgcrypt, I'm seeing the following
      build failure
      
      libvirt.c:314: error: variable 'virTLSThreadImpl' has initializer but incomplete type
      libvirt.c:319: error: 'GCRY_THREAD_OPTION_PTHREAD' undeclared here (not in a function)
      ...
      
      Fix by undefining WITH_GNUTLS_GCRYPT in config-post.h
      549f9649
    • J
      build: fix linking virt-login-shell · 5a275469
      Jim Fehlig 提交于
      After commit 3e2f27e1, I've noticed build failures of virt-login-shell
      when libapparmor-devel is installed on the build host
      
      CCLD     virt-login-shell
      ../src/.libs/libvirt-setuid-rpc-client.a(libvirt_setuid_rpc_client_la-vircommand.o):
      In function `virExec':
      /home/jfehlig/virt/upstream/libvirt/src/util/vircommand.c:653: undefined
      reference to `aa_change_profile'
      collect2: error: ld returned 1 exit status
      
      I was about to commit an easy fix under the build-breaker rule
      (build-fix-1.patch), but thought to extend the notion of SECDRIVER_LIBS
      to SECDRIVER_CFLAGS, and use both throughout src/Makefile.am where it
      makes sense (build-fix-2.patch).
      
      Should I just stick with the simple fix, or is something along the lines
      of patch 2 preferred?
      
      Regards,
      Jim
      
      >From a0f35945f3127ab70d051101037e821b1759b4bb Mon Sep 17 00:00:00 2001
      From: Jim Fehlig <jfehlig@suse.com>
      Date: Mon, 21 Oct 2013 15:30:02 -0600
      Subject: [PATCH] build: fix virt-login-shell build with apparmor
      
      With libapparmor-devel installed, virt-login-shell fails to link
      
      CCLD     virt-login-shell
      ../src/.libs/libvirt-setuid-rpc-client.a(libvirt_setuid_rpc_client_la-vircommand.o): In function `virExec':
      /home/jfehlig/virt/upstream/libvirt/src/util/vircommand.c:653: undefined reference to `aa_change_profile'
      collect2: error: ld returned 1 exit status
      
      Fix by linking libvirt_setuid_rpc_client with previously determined
      SECDRIVER_LIBS in src/Makefile.am.  While at it, introduce SECDRIVER_CFLAGS
      and use both throughout src/Makefile.am where it makes sense.
      Signed-off-by: NJim Fehlig <jfehlig@suse.com>
      
      Conflicts:
      	src/Makefile.am: Context
      5a275469
  7. 21 10月, 2013 5 次提交
  8. 18 10月, 2013 1 次提交
  9. 15 10月, 2013 7 次提交
  10. 07 10月, 2013 1 次提交
  11. 01 10月, 2013 1 次提交