Implementation is pretty similar to the one found in the qemu driver.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Move:
* qemuAgentDiskInfoFormatParams
* qemuAgentFSInfoFormatParams
* virDomainInterfaceFormatParams
from the qemu driver to hypervisor/qemu_agent.c so they could be reused
by the other drivers implementing virDomainGetGuestInfo() using the qemu
agent.
Also, rename virDomainInterfaceFormatParams() to
qemuAgentInterfaceFormatParams() to follow the common naming schema as
it's not really used outside of the qemu agent related code.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Add enum and static-list completers for 'attach-disk' options
targetbus, type, cache, io, mode, and sourcetype, and reuse the
existing storage file format completer for subdriver.
Partially-fixes: https://gitlab.com/libvirt/libvirt/-/work_items/9
Signed-off-by: Radoslaw Smigielski <rsmigiel@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Add a completer callback for local file paths used as command output,
where the target file may not exist yet.
Use it for 'dump', 'save', and 'blockcopy' commands, and fix
'screenshot' to use it instead of vshCompletePathLocalExisting.
Partially-fixes: https://gitlab.com/libvirt/libvirt/-/work_items/9
Signed-off-by: Radoslaw Smigielski <rsmigiel@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
qemuAutostartDomain() starts domains with conn=NULL as there is no
client connection during driver initialisation. Since the managed save
restore path of qemuDomainObjStart() was switched to
qemuDomainRestoreInternal(), which obtains the driver by dereferencing
conn->privateData, any domain with both a managed save image and the
autostart (or autostart-once) flag crashes virtqemud/libvirtd with
SIGSEGV on daemon startup.
The session daemon's auto-shutdown feature creates exactly this
combination on logout with a running VM (auto_shutdown_try_save saves
the domain and auto_shutdown_restore marks it autostart-once), so the
first daemon start of every subsequent boot segfaults and clients such
as GNOME Boxes fail with "Cannot recv data: Connection reset by peer",
showing an empty machine list.
Pass the driver as an explicit parameter, as qemuDomainObjRestore() did
before it was merged into qemuDomainRestoreInternal(), and keep @conn
only for use by the ACL check callbacks, which are not used in the
autostart code path.
Fixes: 0e2ab42778 ("qemu: driver: Merge 'qemuDomainRestoreInternal' and 'qemuDomainObjRestore'")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
YAML specification does not allow duplicate keys [1]:
JSON's RFC4627 requires that mappings keys merely “SHOULD” be
unique, while YAML insists they “MUST” be. Technically, YAML
therefore complies with the JSON spec, choosing to treat
duplicates as an error.
And while gitlab's documentation is a bit relaxed [2] it only
masks the problem:
When there are duplicate keys, the latest included key wins and
overrides the other keys.
Now, the 'potfile' job definition has two 'before_script' keys.
The first occurrence prints out list of installed packages, the
second exports env vars. Join them under one key.
1: https://yaml.org/spec/1.2-old/spec.html#id2759572
2: https://docs.gitlab.com/ci/yaml/yaml_optimization/#anchors
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Currently, virHostCPUGetInfo() reports an error if it cannot obtain CPU
frequency on FreeBSD. As this function is called for virNodeGetInfo(),
virNodeGetInfo() also fails in this scenario.
Failing virNodeGetInfo() is problematic because for example virt-manager
fails to connect to the driver in this case.
Change behavior to report CPU frequency as 0 in this case. It resolves
the issue with virt-manager. And the 'nodeinfo' command in virsh just
does not report CPU frequency if it is zero.
This also matches the virNodeInfo.mhz API contract, where 0 means the
frequency is unknown.
Signed-off-by: Tiago Espinha Gasiba <tiago.gasiba@gmail.com>
Reviewed-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
qemu-11.1 was released, update the capability dump to the final state.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
qemu-11.1 was released, update the capability dump to the final state.
Notable change:
- 'win-dmp' dump format gained 'allowed-by-guest' feature flag
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
CVE-2026-18917
The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'
argument with the 'cellcount' argument passed to 'virNodeGetFreePages',
both of which are declared as 'unsigned int' to both do an RPC limit
check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate
the memory to hold the result from the actual hypervisor driver.
Since both the values are 'unsigned int' the product is also unsigned
int so big enough numbers can overflow, both passing the check and also
allocating not enough memory for the result. The hypervisor driver
assumes that the passed buffer is large enough and overwrites memory.
When this happens the the hypervisor daemon crashes.
This can be triggered e.g. by passing 1023 and 4198405 as values which
multiply to 1019 after wrapping to 32 bit unsigned value.
Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue
the same way as we do for other APIs doing multiplication of arguments
to determine amount of required memory.
Fixes: 34f2d0319d (v1.2.5-164-g34f2d0319d)
Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
In a recent commit we introduced checking for newlines in certain
dnsmasq.conf values that are expected to be fed through from
untrusted user input. Newlines could be used to inject malicious
config statements so must be forbidden.
We have many other dnsmasq.conf entries, however, that have no
checking, and while they're not considered to be security sensitive,
from a robustness POV we should exclude newlines there too to
guarantee a well-formed config file.
Instead of using virBufferAsprintf to directly format config
entries, introduce some helpers that wrap virBuffer APIs.
static void
networkDnsmasqConfAddKey(virBuffer *buf,
const char *key)
static int
networkDnsmasqConfAddValue(virBuffer *buf,
const char *key,
const char *val)
G_GNUC_WARN_UNUSED_RESULT;
#define networkDnsmasqConfAddValueLit(buf, key, val) \
ignore_value(networkDnsmasqConfAddValue(buf, key, "" val ""))
static int
networkDnsmasqConfAddValueFmt(virBuffer *buf,
const char *key,
const char *fmt,
...)
G_GNUC_PRINTF(3, 4)
G_GNUC_WARN_UNUSED_RESULT;
This ensures that every config file entry we write out will
always be well-formed.
Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Archives (as witnessed by recent reports) hide useful information by
requiring the maintainer to download the archive which may be dangerous.
Recent submissions also contained a lot of fluff inside the archives.
Instruct submitters of security issues to attach files directly instead
of hiding them in an archive.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Use the same heading color as we do for '.. warning::'.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
The virBhyveProcessStop() function which handles bhyve process
shutdown does not remove the transient definition, meaning
that it overrides the persistent definition.
Update it to call virDomainObjRemoveTransientDef(). Also, move the body
of the code to virBhyveProcessStopImpl() which accepts 'restoreDef'
argument telling whether the transient definition should be removed.
That is necessary as reboot is implemented as stop + start, and
in this case the transient definition should not be removed.
Closes: https://gitlab.com/libvirt/libvirt/-/work_items/900
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
daemonStreamHandleWrite() snapshots status from msg->header.status
before dispatching to the per-type handler, then reuses that stale
snapshot afterwards to decide whether to send a fake release reply.
A stale snapshot lets it send that reply twice for the same 'msg',
linking the message to itself and deadlooping the event loop thread
in virNetMessageQueuePush()'s tail-walk loop.
Remove the 'status' variable and read msg->header.status directly
at the point of use instead. Commit 411cbe7199 ("remote: fix
stream use-after-free") introduced it alongside its real fix: it
also moved virNetMessageQueueServe() to dequeue 'msg' from
stream->rx before dispatch instead of after, which is what actually
prevents corrupting stream->rx's linkage and remains unchanged
here. The variable itself was never load-bearing: no dispatch
handler frees 'msg' on the path that reaches this check, so reading
msg->header.status straight from 'msg' cannot go stale.
Fixes: 411cbe7199 ("remote: fix stream use-after-free")
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Data obtained by running:
virsh -q capabilities > tests/capabilityschemadata/caps-qemu-real-full.xml
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Allow '.' so that CPU features such as:
<feature name='sse4.1'/>
pass schema validation.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Implement the virDomainAgentSetResponseTimeout() which allows to
set the qemu guest agent timeout.
The change consists of two main parts:
- bhyveDomainAgentSetResponseTimeout() driver method implementation
which actually sets the agent timeout.
- Updating virDomainXMLPrivateDataCallbacks with "parse" and "format"
methods implementation for parsing and formatting of the agent
timeout value in domain's XML.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Provide sample XML and CLI args for the HW-accel smmuv3 XML schema
for virt machine types.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Add support for enabling HW-accelerated nested SMMUv3 via <accel>
attribute and its additional attributes for ATS, SSID, RIL, and OAS
configuration.
Validate the domain iommu accel attribute in qemu_validate.c when
QEMU lacks this capability. Checking accel is sufficient because ats,
ril, ssidsize, and oas were introduced in the same QEMU release, and
it only makes sense to backport accel, ats, ril, ssidsize, and oas
all together.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
The arm-smmuv3 accel device property, used for HW-accelerated nested
SMMUv3, was added in QEMU 11.0.0 on top of the pluggable device
introduced in 10.2. Probe it alongside smmu_per_bus via
device-list-properties.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
The arm-smmuv3 QOM type appears in qom-list-types on ARM QEMU as far
back as 8.2 because the type is used for machine-integrated IOMMU
(-machine virt,iommu=smmuv3). That reply does not indicate support
for a user-pluggable -device arm-smmuv3.
User-pluggable SMMUv3 with the smmu_per_bus property was added in QEMU
10.2.0. Probe that property via device-list-properties, gated on
QEMU_CAPS_DEVICE_SMMUV3, so the capability tracks pluggable device
support rather than mere QOM visibility.
In qemu_validate.c, an IOMMU with pci_bus set requires
QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS; machine-integrated SMMUv3 without
pci_bus keeps using QEMU_CAPS_MACHINE_VIRT_IOMMU.
Update caps_8.2.0_aarch64, caps_9.2.0_aarch64, caps_10.0.0_aarch64,
caps_10.2.0_aarch64, caps_11.0.0_aarch64, caps_8.2.0_armv7l, and
caps_11.1.0_aarch64 .replies with the arm-smmuv3 device-list-properties
exchange.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
The arm-smmuv3 QOM type is reported by qom-list-types on ARM QEMU.
Register it as QEMU_CAPS_DEVICE_ARM_SMMUV3 so later device-list-properties
probing for arm-smmuv3 properties can be gated on this capability
instead of an architecture check.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
virDomainIOMMUDefEquals() should check for pci_bus being equal
across two virDomainIOMMUDef being compared.
Fixes: 4d6419b286 ("qemu: Implement pluggable-device smmuv3")
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
virBhyveProcessStop() calls virBhyveDomainObjStopWorker(), which expects
the domain object to be locked. It temporarily releases the lock while
stopping the event thread and acquires it again before returning.
bhyveMonitorIO() called the process stop and restart paths without
holding the domain lock. As a result, the lock acquired by
virBhyveDomainObjStopWorker() was never released, causing subsequent
domain API calls to hang after the guest exited.
Lock the domain object while processing the bhyve process exit event and
release it after the stop or restart operation completes.
Fixes: 0041788857 ("bhyve: clean up event thread")
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
crash when the 'ctl' parameter to vshPrintStderr() is NULL. Below is an
example backtrace of the crash when attempting to detach a non-existent
disk with 'virsh detach-disk test vdz'
#0 vshPrintStderr (ctl=0x0, level=4, format=<optimized out>, ap=<optimized out>) at ../tools/vsh.c:2148
#1 0x00005555555e6b2c in vshError (ctl=ctl@entry=0x0, format=<optimized out>) at ../tools/vsh.c:2170
#2 0x00005555555afec7 in virshFindDisk
(doc=doc@entry=0x555555696ee0 "<domain type='kvm' id='1'>\n <name>test</name>\n <uuid>9b27a21e-dfa2-4c1e-9d11-2de275aefb03</uuid>\n <metadata>\n <libosinfo:libosinfo xmlns:libosinfo=\"http://libosinfo.org/xmlns/libvirt/domain/1."..., path=0x555555651240 "vdz", type=type@entry=0) at ../tools/virsh-domain.c:13055
#3 0x00005555555b0151 in cmdDetachDisk (ctl=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/virsh-domain.c:13231
#4 0x00005555555e6ddb in vshCommandRun (ctl=ctl@entry=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/vsh.c:1383
#5 0x000055555559347a in main (argc=<optimized out>, argv=0x7fffffffdeb8) at ../tools/virsh.c:908
Ensure 'ctl' is valid before dereferencing it.
Fixes: 9899c91515
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Use of email for security disclosures is not a sustainable approach
in the new world with countless LLM assisted security researchers.
The old security approach has been to keep disclosures visible to
a very small number of hand-picked maintainers, on the assumption
that information has to be highly classified. This view is no
longer valid with LLMs assisted research, as multiple people can
report the same flaw within a short window of time. It is assumed
that anyone with access to LLMs will be capable of re-discovering
issues at any time.
As such there is less compelling benefit to limiting the visibility
of disclosures originating with LLMs. Rather than try to distinguish
which disclosures come purely from humans vs those assisted by LLMs,
just assume LLMs will be involved as that is the common case. Thus
make disclosures visible to all maintainers immediately.
By the same rational of repeated re-discovery there is also less
benefit to applying embargoes to issues once a fix is available.
Thus this proposal intends to make CVEs public as soon as a fix
is proposed for merge.
With this new open approach to disclosures, there is then no
reason to have a separate process for disclosing regular bugs vs
security issues. By using the regular bug tracker for security
disclosures, the process can be simplified and gain access to
better tools for tracking & triage than email offers.
Thus the new security disclosure process is simply with bug
tracking process with two add-ons:
* The initial disclosure has the "confidential" flag set
* The use of "CVE::Required" and "CVE::Assigned" labels
to handle CVE allocation.
This is essentially identical to the process adopted by QEMU
last month which has been successful at scaling the triage
process.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Currently, when the bhyve driver builds capabilities, it uses
just "bhyve" as emulator path. That leads to issues, e.g.
virt-manager uses this value to fill domain's emulator field,
which has to be an absolute path. So that results in a domain
XML that fails validation.
Fix by trying to find "bhyve" in PATH and falling back to
"/usr/sbin/bhyve".
Closes: https://gitlab.com/libvirt/libvirt/-/work_items/899
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
On the local (non-NETFS) path virStorageBackendCreateExecCommand() ran
qemu-img with umask 0, so the destination image was created
world-readable (0644) and the full source disk was written into it
before libvirt tightened the mode with a later chmod(). This is the same
class as CVE-2025-13193; apply the same fix by setting a 0077 umask so
qemu-img creates the file private from the start.
Fixes: CVE-2026-63623
Reported-by: HE WEI（ギカク） <skyexpoc@gmail.com>
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
[DB: merged the two virCommandSetUmask to one]
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows
symlinks) and changed ownership with chown() (follows symlinks). A component
that owns the target directory at a lower privilege (e.g. the swtpm/tss state
directory) can plant a symlink to an arbitrary regular file and have the root
caller chown that file. Use lstat() to skip non-regular entries and
fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never
followed.
Fixes: CVE-2026-63622
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
[DB: use g_lstat instead of stat; use lchown instead of
fchownat for portability; added comment]
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Fix three pre-existing typos in the iothread poll sub-element
description:
- Remove spurious 'with' in 'poll with can be used to'
- Add missing closing ')' after the poll-grow/shrink '0' note
- Fix typo 'extensive' -> 'excessive'
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Add NEWS entries for the new libvirtd build option and new sanlock
plugin setting.
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Currently, eventThread cleanup is missing. Fix that by calling
virBhyveDomainObjStopWorker() in virBhyveProcessStop()
and un-referring the eventThread in bhyveDomainObjPrivateFree().
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
The following APIs where all implemented in 12.5.0 timeframe:
- virDomainGetTime(), virDomainSetTime() -> v12.5.0-rc1~66
- virDomainSetUserPassword() -> v12.5.0-rc1~65
- virDomainAuthorizedSSHKeysGet(),
virDomainAuthorizedSSHKeysSet() -> v12.5.0-rc1~64
But respective comments suggest they were implemented in 12.6.0
timeframe. Fix those comments.
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
Some guest OSes (e.g. windows) can do an internal crash dump and reboot
after a crash. They unfortunately notify the OS before doing the crash
dump though so we need a new possibility for the <on_crash> action to
keep the VM as is.
This patch introduces 'preserve-running' mode for on_crash and wires it
up into the qemu driver.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Separate the individual steps (setting of VM state, dumping, unlocking,
final state transition) under individual switch statements for future
extension.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Roman Bogorodskiy
Radoslaw Smigielski
Daniel Golle
Michal Privoznik
Denis V. Lunev via Devel
Tiago Gasiba
Peter Krempa
Daniel P. Berrangé
Shalini Chellathurai Saroja
Nathan Chen
Jim Fehlig
Jiri Denemark
HE WEI（ギカク）
Jaehoon Kim