diff --git a/.libvirt.metadata b/.libvirt.metadata new file mode 100644 index 0000000..be2bb6e --- /dev/null +++ b/.libvirt.metadata @@ -0,0 +1 @@ +7a2e402bfb1ad295544de6cd527c4c04e85c5096 libvirt-10.0.0.tar.xz diff --git a/libvirt-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch b/libvirt-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch new file mode 100644 index 0000000..1a441b7 --- /dev/null +++ b/libvirt-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch @@ -0,0 +1,46 @@ +From 68f2278d84fe560123c2ec34275380ed1086b706 Mon Sep 17 00:00:00 2001 +Message-ID: <68f2278d84fe560123c2ec34275380ed1086b706.1713796876.git.jdenemar@redhat.com> +From: Martin Kletzander +Date: Tue, 27 Feb 2024 16:20:12 +0100 +Subject: [PATCH] Fix off-by-one error in udevListInterfacesByStatus +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ever since this function was introduced in 2012 it could've tried +filling in an extra interface name. That was made worse in 2019 when +the caller functions started accepting NULL arrays of size 0. + +This is assigned CVE-2024-1441. + +Signed-off-by: Martin Kletzander +Reported-by: Alexander Kuznetsov +Fixes: 5a33366f5c0b18c93d161bd144f9f079de4ac8ca +Fixes: d6064e2759a24e0802f363e3a810dc5a7d7ebb15 +Reviewed-by: Ján Tomko +(cherry picked from commit c664015fe3a7bf59db26686e9ed69af011c6ebb8) + +Conflicts: + - NEWS.rst: Removed the hunk + +Resolves: https://issues.redhat.com/browse/RHEL-25081 +Signed-off-by: Martin Kletzander +--- + src/interface/interface_backend_udev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c +index fb6799ed94..4091483060 100644 +--- a/src/interface/interface_backend_udev.c ++++ b/src/interface/interface_backend_udev.c +@@ -222,7 +222,7 @@ udevListInterfacesByStatus(virConnectPtr conn, + g_autoptr(virInterfaceDef) def = NULL; + + /* Ensure we won't exceed the size of our array */ +- if (count > names_len) ++ if (count >= names_len) + break; + + path = udev_list_entry_get_name(dev_entry); +-- +2.44.0 diff --git a/libvirt-qemu-Fix-migration-with-custom-XML.patch b/libvirt-qemu-Fix-migration-with-custom-XML.patch new file mode 100644 index 0000000..c4c356b --- /dev/null +++ b/libvirt-qemu-Fix-migration-with-custom-XML.patch @@ -0,0 +1,139 @@ +From 68a98ee089f39edeb2d07f6268cbbcb12629ee8b Mon Sep 17 00:00:00 2001 +Message-ID: <68a98ee089f39edeb2d07f6268cbbcb12629ee8b.1713796876.git.jdenemar@redhat.com> +From: Jiri Denemark +Date: Tue, 16 Apr 2024 12:57:22 +0200 +Subject: [PATCH] qemu: Fix migration with custom XML + +Ages ago origCPU in domain private data was introduced to provide +backward compatibility when migrating to an old libvirt, which did not +support fetching updated CPU definition from QEMU. Thus origCPU will +contain the original CPU definition before such update. But only if the +update actually changed anything. Let's always fill origCPU with the +original definition when starting a domain so that we can rely on it +being always set, even if it matches the updated definition. + +This fixes migration or save operations with custom domain XML after +commit v10.1.0-88-g14d3517410, which expected origCPU to be always set +to the CPU definition from inactive XML to check features explicitly +requested by a user. + +https://issues.redhat.com/browse/RHEL-30622 + +Signed-off-by: Jiri Denemark +Tested-by: Han Han +Reviewed-by: Peter Krempa +(cherry picked from commit 4331048257071211fb98c21453b187919d42dae7) + +https://issues.redhat.com/browse/RHEL-32654 + +Signed-off-by: Jiri Denemark +--- + src/qemu/qemu_domain.c | 33 ++++++++++++++++++++------------- + src/qemu/qemu_process.c | 19 +++++++------------ + 2 files changed, 27 insertions(+), 25 deletions(-) + +diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c +index 1daa53dd1b..341c543280 100644 +--- a/src/qemu/qemu_domain.c ++++ b/src/qemu/qemu_domain.c +@@ -10868,12 +10868,13 @@ virSaveCookieCallbacks virQEMUDriverDomainSaveCookie = { + * @vm: domain which is being started + * @cpu: CPU updated when the domain was running previously (before migration, + * snapshot, or save) +- * @origCPU: where to store the original CPU from vm->def in case @cpu was +- * used instead ++ * @origCPU: where to store the original CPU from vm->def + * +- * Replace the CPU definition with the updated one when QEMU is new enough to +- * allow us to check extra features it is about to enable or disable when +- * starting a domain. The original CPU is stored in @origCPU. ++ * Save the original CPU definition from inactive XML in @origCPU so that we ++ * can safely update it and still be able to check what exactly a user asked ++ * for. The domain definition will either contain a copy of the original CPU ++ * definition or a copy of @cpu in case the domain was already running and ++ * we're just restoring a saved state or preparing for incoming migration. + * + * Returns 0 on success, -1 on error. + */ +@@ -10886,18 +10887,24 @@ qemuDomainUpdateCPU(virDomainObj *vm, + + *origCPU = NULL; + +- if (!cpu || !vm->def->cpu || +- !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION) || +- virCPUDefIsEqual(vm->def->cpu, cpu, false)) ++ if (!vm->def->cpu) + return 0; + +- if (!(cpu = virCPUDefCopy(cpu))) +- return -1; ++ if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION)) ++ return 0; ++ ++ /* nothing to do if only topology part of CPU def is used */ ++ if (vm->def->cpu->mode == VIR_CPU_MODE_CUSTOM && !vm->def->cpu->model) ++ return 0; ++ ++ VIR_DEBUG("Replacing CPU definition"); + +- VIR_DEBUG("Replacing CPU def with the updated one"); ++ *origCPU = g_steal_pointer(&vm->def->cpu); + +- *origCPU = vm->def->cpu; +- vm->def->cpu = cpu; ++ if (cpu) ++ vm->def->cpu = virCPUDefCopy(cpu); ++ else ++ vm->def->cpu = virCPUDefCopy(*origCPU); + + return 0; + } +diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c +index 3563ad215c..b75599de68 100644 +--- a/src/qemu/qemu_process.c ++++ b/src/qemu/qemu_process.c +@@ -4402,8 +4402,6 @@ qemuProcessUpdateLiveGuestCPU(virDomainObj *vm, + virCPUData *disabled) + { + virDomainDef *def = vm->def; +- qemuDomainObjPrivate *priv = vm->privateData; +- g_autoptr(virCPUDef) orig = NULL; + int rc; + + if (!enabled) +@@ -4414,19 +4412,11 @@ qemuProcessUpdateLiveGuestCPU(virDomainObj *vm, + !def->cpu->model)) + return 0; + +- orig = virCPUDefCopy(def->cpu); +- +- if ((rc = virCPUUpdateLive(def->os.arch, def->cpu, enabled, disabled)) < 0) { ++ if ((rc = virCPUUpdateLive(def->os.arch, def->cpu, enabled, disabled)) < 0) + return -1; +- } else if (rc == 0) { +- /* Store the original CPU in priv if QEMU changed it and we didn't +- * get the original CPU via migration, restore, or snapshot revert. +- */ +- if (!priv->origCPU && !virCPUDefIsEqual(def->cpu, orig, false)) +- priv->origCPU = g_steal_pointer(&orig); + ++ if (rc == 0) + def->cpu->check = VIR_CPU_CHECK_FULL; +- } + + return 0; + } +@@ -9144,6 +9134,11 @@ qemuProcessReconnect(void *opaque) + + qemuDomainVcpuPersistOrder(obj->def); + ++ /* Make sure the original CPU is always preserved in priv->origCPU. */ ++ if (!priv->origCPU && ++ qemuDomainUpdateCPU(obj, NULL, &priv->origCPU) < 0) ++ goto error; ++ + if (qemuProcessRefreshCPU(driver, obj) < 0) + goto error; + +-- +2.44.0 diff --git a/libvirt-qemu-virtiofs-do-not-crash-if-cgroups-are-missing.patch b/libvirt-qemu-virtiofs-do-not-crash-if-cgroups-are-missing.patch new file mode 100644 index 0000000..be1b2f1 --- /dev/null +++ b/libvirt-qemu-virtiofs-do-not-crash-if-cgroups-are-missing.patch @@ -0,0 +1,42 @@ +From 08318e2c7dd6d5ea76c2f7ddfa7e61519903744c Mon Sep 17 00:00:00 2001 +Message-ID: <08318e2c7dd6d5ea76c2f7ddfa7e61519903744c.1713796876.git.jdenemar@redhat.com> +From: =?UTF-8?q?J=C3=A1n=20Tomko?= +Date: Tue, 5 Mar 2024 14:55:26 +0100 +Subject: [PATCH] qemu: virtiofs: do not crash if cgroups are missing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On domain startup, qemuSetupCgroupForExtDevices checks +if a cgroup controller is present and skips the setup if not. + +Add a similar check to qemuVirtioFSSetupCgroup to prevent +crashing when hotplugging a virtiofs filesystem. + +Signed-off-by: Ján Tomko +Reviewed-by: Michal Privoznik +(cherry picked from commit a9da0092198ba2f278cea370f8251f2e29f57c7d) + +https://issues.redhat.com/browse/RHEL-7386 + +Signed-off-by: Ján Tomko +--- + src/qemu/qemu_virtiofs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c +index d539d0a192..15dea3bb57 100644 +--- a/src/qemu/qemu_virtiofs.c ++++ b/src/qemu/qemu_virtiofs.c +@@ -353,6 +353,9 @@ qemuVirtioFSSetupCgroup(virDomainObj *vm, + pid_t pid = -1; + int rc; + ++ if (!cgroup) ++ return 0; ++ + if (!(pidfile = qemuVirtioFSCreatePidFilename(vm, fs->info.alias))) + return -1; + +-- +2.44.0 diff --git a/libvirt-qemu-virtiofs-error-out-if-getting-the-group-or-user-name-fails.patch b/libvirt-qemu-virtiofs-error-out-if-getting-the-group-or-user-name-fails.patch new file mode 100644 index 0000000..d18ad0a --- /dev/null +++ b/libvirt-qemu-virtiofs-error-out-if-getting-the-group-or-user-name-fails.patch @@ -0,0 +1,37 @@ +From 0859b9bf3efde1522aee3be9d007ff1967e14d44 Mon Sep 17 00:00:00 2001 +Message-ID: <0859b9bf3efde1522aee3be9d007ff1967e14d44.1713796876.git.jdenemar@redhat.com> +From: =?UTF-8?q?J=C3=A1n=20Tomko?= +Date: Thu, 7 Mar 2024 13:36:45 +0100 +Subject: [PATCH] qemu: virtiofs: error out if getting the group or user name + fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Ján Tomko +Reviewed-by: Michal Privoznik +(cherry picked from commit c9de7a1c3bca9f0732205f2c2b84526781dbf5e5) + +https://issues.redhat.com/browse/RHEL-7386 + +Signed-off-by: Ján Tomko +--- + src/qemu/qemu_virtiofs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c +index d80cddd3ba..78897d8177 100644 +--- a/src/qemu/qemu_virtiofs.c ++++ b/src/qemu/qemu_virtiofs.c +@@ -388,6 +388,9 @@ qemuVirtioFSPrepareIdMap(virDomainFSDef *fs) + username = virGetUserName(euid); + groupname = virGetGroupName(egid); + ++ if (!username || !groupname) ++ return -1; ++ + fs->idmap.uidmap = g_new0(virDomainIdMapEntry, 2); + fs->idmap.gidmap = g_new0(virDomainIdMapEntry, 2); + +-- +2.44.0 diff --git a/libvirt-qemu-virtiofs-set-correct-label-when-creating-the-socket.patch b/libvirt-qemu-virtiofs-set-correct-label-when-creating-the-socket.patch new file mode 100644 index 0000000..0a5f538 --- /dev/null +++ b/libvirt-qemu-virtiofs-set-correct-label-when-creating-the-socket.patch @@ -0,0 +1,39 @@ +From 1be4ebe8c9e67ed4086d9ef4bce9ae6a63c753d9 Mon Sep 17 00:00:00 2001 +Message-ID: <1be4ebe8c9e67ed4086d9ef4bce9ae6a63c753d9.1713796876.git.jdenemar@redhat.com> +From: =?UTF-8?q?J=C3=A1n=20Tomko?= +Date: Wed, 6 Mar 2024 17:26:40 +0100 +Subject: [PATCH] qemu: virtiofs: set correct label when creating the socket +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Use svirt_t instead of virtd_t, since virtd_t is not available in the +session mode and qemu with svirt_t won't be able to talk to unconfined_t +socket. + +Signed-off-by: Ján Tomko +Reviewed-by: Michal Privoznik +(cherry picked from commit 4c5b2e1e0d0d0cbbf8c6ed28ce77d055d5974f7f) + +https://issues.redhat.com/browse/RHEL-7386 + +Signed-off-by: Ján Tomko +--- + src/qemu/qemu_virtiofs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c +index 15dea3bb57..d80cddd3ba 100644 +--- a/src/qemu/qemu_virtiofs.c ++++ b/src/qemu/qemu_virtiofs.c +@@ -102,7 +102,7 @@ qemuVirtioFSOpenChardev(virQEMUDriver *driver, + chrdev->data.nix.listen = true; + chrdev->data.nix.path = g_strdup(socket_path); + +- if (qemuSecuritySetDaemonSocketLabel(driver->securityManager, vm->def) < 0) ++ if (qemuSecuritySetSocketLabel(driver->securityManager, vm->def) < 0) + goto cleanup; + fd = qemuOpenChrChardevUNIXSocket(chrdev); + if (fd < 0) { +-- +2.44.0 diff --git a/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch b/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch new file mode 100644 index 0000000..c9441ae --- /dev/null +++ b/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch @@ -0,0 +1,218 @@ +From 3841ddc4d4fe2f4f4aced0e6c259958cbcc1ab80 Mon Sep 17 00:00:00 2001 +Message-ID: <3841ddc4d4fe2f4f4aced0e6c259958cbcc1ab80.1713796876.git.jdenemar@redhat.com> +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Fri, 15 Mar 2024 10:47:50 +0000 +Subject: [PATCH] remote: check for negative array lengths before allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +While the C API entry points will validate non-negative lengths +for various parameters, the RPC server de-serialization code +will need to allocate memory for arrays before entering the C +API. These allocations will thus happen before the non-negative +length check is performed. + +Passing a negative length to the g_new0 function will usually +result in a crash due to the negative length being treated as +a huge positive number. + +This was found and diagnosed by ALT Linux Team with AFLplusplus. + +CVE-2024-2494 +Reviewed-by: Michal Privoznik +Found-by: Alexandr Shashkin +Co-developed-by: Alexander Kuznetsov +Signed-off-by: Daniel P. Berrangé +(cherry picked from commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2) +Signed-off-by: Jiri Denemark +--- + src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++ + src/rpc/gendispatch.pl | 5 +++ + 2 files changed, 70 insertions(+) + +diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c +index aaabd1e56c..01dcac4b12 100644 +--- a/src/remote/remote_daemon_dispatch.c ++++ b/src/remote/remote_daemon_dispatch.c +@@ -2291,6 +2291,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2339,6 +2343,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2497,6 +2505,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED, + goto cleanup; + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2717,6 +2729,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->ncpumaps < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative")); ++ goto cleanup; ++ } ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); ++ goto cleanup; ++ } + if (args->ncpumaps > REMOTE_VCPUINFO_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX")); + goto cleanup; +@@ -2811,6 +2831,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); ++ goto cleanup; ++ } ++ + /* Allocate buffers to take the results */ + if (args->maplen > 0) + cpumaps = g_new0(unsigned char, args->maplen); +@@ -2858,6 +2883,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->maxinfo < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); ++ goto cleanup; ++ } ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); ++ goto cleanup; ++ } + if (args->maxinfo > REMOTE_VCPUINFO_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX")); + goto cleanup; +@@ -3096,6 +3129,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3156,6 +3193,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3216,6 +3257,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3277,6 +3322,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3339,6 +3388,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3514,6 +3567,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -5081,6 +5138,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -5301,6 +5362,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl +index 5ce988c5ae..c5842dc796 100755 +--- a/src/rpc/gendispatch.pl ++++ b/src/rpc/gendispatch.pl +@@ -1070,6 +1070,11 @@ elsif ($mode eq "server") { + print "\n"; + + if ($single_ret_as_list) { ++ print " if (args->$single_ret_list_max_var < 0) {\n"; ++ print " virReportError(VIR_ERR_RPC,\n"; ++ print " \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n"; ++ print " goto cleanup;\n"; ++ print " }\n"; + print " if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n"; + print " virReportError(VIR_ERR_RPC,\n"; + print " \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n"; +-- +2.44.0 diff --git a/libvirt.spec b/libvirt.spec index 4b31724..c962c5b 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -270,7 +270,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 10.0.0 -Release: 5%{?dist}%{?extra_release} +Release: 7%{?dist}%{?extra_release} License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1 URL: https://libvirt.org/ @@ -358,6 +358,12 @@ Patch76: libvirt-Add-vmx-features-to-SapphireRapids.patch Patch77: libvirt-Add-vmx-features-to-Skylake.patch Patch78: libvirt-Add-vmx-features-to-Snowridge.patch Patch79: libvirt-Add-vmx-features-to-Westmere.patch +Patch80: libvirt-qemu-virtiofs-do-not-crash-if-cgroups-are-missing.patch +Patch81: libvirt-qemu-virtiofs-set-correct-label-when-creating-the-socket.patch +Patch82: libvirt-qemu-virtiofs-error-out-if-getting-the-group-or-user-name-fails.patch +Patch83: libvirt-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch +Patch84: libvirt-remote-check-for-negative-array-lengths-before-allocation.patch +Patch85: libvirt-qemu-Fix-migration-with-custom-XML.patch Requires: libvirt-daemon = %{version}-%{release} @@ -2661,6 +2667,14 @@ exit 0 %endif %changelog +* Mon Apr 22 2024 Jiri Denemark - 10.0.0-7 +- qemu: virtiofs: do not crash if cgroups are missing +- qemu: virtiofs: set correct label when creating the socket +- qemu: virtiofs: error out if getting the group or user name fails +- Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441) +- remote: check for negative array lengths before allocation (CVE-2024-2494) +- qemu: Fix migration with custom XML (RHEL-30622) + * Tue Mar 19 2024 Jiri Denemark - 10.0.0-5 - cpu: x86: Add support for adding features to existing CPU models (RHEL-25995) - qemu: domain: Check arch in qemuDomainMakeCPUMigratable (RHEL-25995)