Skip to content
Snippets Groups Projects
Commit 90a18817 authored by Guido Günther's avatar Guido Günther
Browse files

Update patches

Dropped patches fixed upstream
    CVE-2013-4153-qemu-Fix-double-free-of-returned-JSON-.patch
    CVE-2013-4154-qemu-Prevent-crash-of-libvirtd-without.patch
    Create-directory-for-lease-files-if-it-s-missing.patch
    Fix-crash-when-multiple-event-callbacks-were-registe.patch
parent a1c747a4
No related branches found
No related tags found
No related merge requests found
Showing
with 27 additions and 219 deletions
......@@ -19,7 +19,7 @@ Closes: #685749
12 files changed, 24 insertions(+), 26 deletions(-)
diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng
index 106ca73..9745e26 100644
index 65c7c72..c36ad7c 100644
--- a/docs/schemas/capability.rng
+++ b/docs/schemas/capability.rng
@@ -263,13 +263,13 @@
......@@ -39,10 +39,10 @@ index 106ca73..9745e26 100644
</define>
diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c
index a318ea5..e9da6a3 100644
index 53bbcaa..57799d2 100644
--- a/src/xen/xen_hypervisor.c
+++ b/src/xen/xen_hypervisor.c
@@ -2081,11 +2081,9 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
@@ -2142,11 +2142,9 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
if ((guest = virCapabilitiesAddGuest(caps,
guest_archs[i].hvm ? "hvm" : "xen",
guest_archs[i].arch,
......
From: Peter Krempa <pkrempa@redhat.com>
Date: Tue, 16 Jul 2013 15:39:06 +0200
Subject: CVE-2013-4153: qemu: Fix double free of returned JSON array in
qemuAgentGetVCPUs()
A part of the returned monitor response was freed twice and caused
crashes of the daemon when using guest agent cpu count retrieval.
# virsh vcpucount dom --guest
Introduced in v1.0.6-48-gc6afcb0
Closes: #717354
---
src/qemu/qemu_agent.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
index 9914521..d6be677 100644
--- a/src/qemu/qemu_agent.c
+++ b/src/qemu/qemu_agent.c
@@ -1538,7 +1538,6 @@ qemuAgentGetVCPUs(qemuAgentPtr mon,
cleanup:
virJSONValueFree(cmd);
virJSONValueFree(reply);
- virJSONValueFree(data);
return ret;
}
From: Alex Jia <ajia@redhat.com>
Date: Tue, 16 Jul 2013 17:30:20 +0800
Subject: CVE-2013-4154: qemu: Prevent crash of libvirtd without guest agent
configuration
If users haven't configured guest agent then qemuAgentCommand() will
dereference a NULL 'mon' pointer, which causes crash of libvirtd when
using agent based cpu (un)plug.
With the patch, when the qemu-ga service isn't running in the guest,
a expected error "error: Guest agent is not responding: Guest agent
not available for now" will be raised, and the error "error: argument
unsupported: QEMU guest agent is not configured" is raised when the
guest hasn't configured guest agent.
GDB backtrace:
(gdb) bt
#0 virNetServerFatalSignal (sig=11, siginfo=<value optimized out>, context=<value optimized out>) at rpc/virnetserver.c:326
#1 <signal handler called>
#2 qemuAgentCommand (mon=0x0, cmd=0x7f39300017b0, reply=0x7f394b090910, seconds=-2) at qemu/qemu_agent.c:975
#3 0x00007f39429507f6 in qemuAgentGetVCPUs (mon=0x0, info=0x7f394b0909b8) at qemu/qemu_agent.c:1475
#4 0x00007f39429d9857 in qemuDomainGetVcpusFlags (dom=<value optimized out>, flags=9) at qemu/qemu_driver.c:4849
#5 0x00007f3957dffd8d in virDomainGetVcpusFlags (domain=0x7f39300009c0, flags=8) at libvirt.c:9843
How to reproduce?
# To start a guest without guest agent configuration
# then run the following cmdline
# virsh vcpucount foobar --guest
error: End of file while reading data: Input/output error
error: One or more references were leaked after disconnect from the hypervisor
error: Failed to reconnect to the hypervisor
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=984821
Signed-off-by: Alex Jia <ajia@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Closes: #717355
---
src/qemu/qemu_driver.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 9d6160f..5ddd9af 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3963,6 +3963,19 @@ qemuDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus,
goto endjob;
}
+ if (priv->agentError) {
+ virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s",
+ _("QEMU guest agent is not "
+ "available due to an error"));
+ goto endjob;
+ }
+
+ if (!priv->agent) {
+ virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
+ _("QEMU guest agent is not configured"));
+ goto endjob;
+ }
+
qemuDomainObjEnterAgent(vm);
ncpuinfo = qemuAgentGetVCPUs(priv->agent, &cpuinfo);
qemuDomainObjExitAgent(vm);
@@ -4685,6 +4698,19 @@ qemuDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags)
if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0)
goto cleanup;
+ if (priv->agentError) {
+ virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s",
+ _("QEMU guest agent is not "
+ "available due to an error"));
+ goto endjob;
+ }
+
+ if (!priv->agent) {
+ virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
+ _("QEMU guest agent is not configured"));
+ goto endjob;
+ }
+
if (!virDomainObjIsActive(vm)) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s",
_("domain is not running"));
From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx@sigxcpu.org>
Date: Sun, 7 Jul 2013 14:59:48 +0200
Subject: Create directory for lease files if it's missing
If we don't autostart a network it's not being created.
Debian Bug http://bugs.debian.org/715200
---
src/nwfilter/nwfilter_dhcpsnoop.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c
index 708e67f..3fdb507 100644
--- a/src/nwfilter/nwfilter_dhcpsnoop.c
+++ b/src/nwfilter/nwfilter_dhcpsnoop.c
@@ -74,8 +74,9 @@
#ifdef HAVE_LIBPCAP
-# define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases"
-# define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp"
+# define LEASEFILE_DIR LOCALSTATEDIR "/run/libvirt/network/"
+# define LEASEFILE LEASEFILE_DIR "nwfilter.leases"
+# define TMPLEASEFILE LEASEFILE_DIR "nwfilter.ltmp"
struct virNWFilterSnoopState {
/* lease file */
@@ -1893,6 +1894,11 @@ virNWFilterSnoopLeaseFileRefresh(void)
{
int tfd;
+ if (virFileMakePathWithMode(LEASEFILE_DIR, 0700) < 0) {
+ virReportError(errno, _("mkdir(\"%s\")"), LEASEFILE_DIR);
+ return;
+ }
+
if (unlink(TMPLEASEFILE) < 0 && errno != ENOENT)
virReportSystemError(errno, _("unlink(\"%s\")"), TMPLEASEFILE);
......@@ -8,7 +8,7 @@ until we debugged the interaction with pbuilder
1 file changed, 2 insertions(+)
diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
index 4c5a0ea..261e63f 100644
index 5b434ba..fad9a98 100644
--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
@@ -497,10 +497,12 @@ mymain(void)
......
......@@ -7,10 +7,10 @@ Subject: Don't fail if we can't setup avahi
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c
index 9f56b03..8684b35 100644
index cb770c3..8c15d41 100644
--- a/src/rpc/virnetserver.c
+++ b/src/rpc/virnetserver.c
@@ -1064,8 +1064,7 @@ void virNetServerRun(virNetServerPtr srv)
@@ -1055,8 +1055,7 @@ void virNetServerRun(virNetServerPtr srv)
virObjectLock(srv);
......
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
Date: Tue, 2 Jul 2013 15:17:09 +0200
Subject: Fix crash when multiple event callbacks were registered
CVE-2013-2230
Don't overwrite the callback ID returned by
virDomainEventStateRegisterID in ret by 0.
Introduced by abf75aea.
Closes: #715559
---
src/qemu/qemu_driver.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index f51e766..9d6160f 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -9914,9 +9914,7 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn,
driver->domainEventState,
dom, eventID,
callback, opaque, freecb, &ret) < 0)
- goto cleanup;
-
- ret = 0;
+ ret = -1;
cleanup:
return ret;
......@@ -10,10 +10,10 @@ Closes: #663931
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/util/virutil.c b/src/util/virutil.c
index 569d035..ab55e95 100644
index adcdb3c..328e36e 100644
--- a/src/util/virutil.c
+++ b/src/util/virutil.c
@@ -1419,7 +1419,7 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid,
@@ -1398,7 +1398,7 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups,
void virFileWaitForDevices(void)
{
# ifdef UDEVADM
......
......@@ -10,30 +10,30 @@ to not interfere with existing network configurations
2 files changed, 6 deletions(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index 4cf999d..e82ed3e 100644
index 62e427e..57cbceb 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -2340,9 +2340,6 @@ if WITH_NETWORK
cp $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t \
$(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml && \
rm $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t; }
- test -e $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml || \
@@ -2362,9 +2362,6 @@ if WITH_NETWORK
cp $(DESTDIR)$(confdir)/qemu/networks/default.xml.t \
$(DESTDIR)$(confdir)/qemu/networks/default.xml && \
rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; }
- test -e $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml || \
- ln -s ../default.xml \
- $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml
- $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml
endif
uninstall-local:: uninstall-init uninstall-systemd
diff --git a/src/Makefile.in b/src/Makefile.in
index 1ef1a46..2b7e632 100644
index b14c682..540d1c0 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -7919,9 +7919,6 @@ install-data-local: install-init install-systemd
@WITH_NETWORK_TRUE@ cp $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t \
@WITH_NETWORK_TRUE@ $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml && \
@WITH_NETWORK_TRUE@ rm $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t; }
-@WITH_NETWORK_TRUE@ test -e $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml || \
@@ -8079,9 +8079,6 @@ install-data-local: install-init install-systemd
@WITH_NETWORK_TRUE@ cp $(DESTDIR)$(confdir)/qemu/networks/default.xml.t \
@WITH_NETWORK_TRUE@ $(DESTDIR)$(confdir)/qemu/networks/default.xml && \
@WITH_NETWORK_TRUE@ rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; }
-@WITH_NETWORK_TRUE@ test -e $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml || \
-@WITH_NETWORK_TRUE@ ln -s ../default.xml \
-@WITH_NETWORK_TRUE@ $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml
-@WITH_NETWORK_TRUE@ $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml
uninstall-local:: uninstall-init uninstall-systemd
@WITH_LIBVIRTD_TRUE@ rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/lockd/files" ||:
......@@ -13,10 +13,10 @@ Closes: #517059
5 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c
index 9d9c3ee..a318ea5 100644
index cd85b75..53bbcaa 100644
--- a/src/xen/xen_hypervisor.c
+++ b/src/xen/xen_hypervisor.c
@@ -2085,7 +2085,7 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
@@ -2146,7 +2146,7 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
"/usr/lib64/xen/bin/qemu-dm" :
"/usr/lib/xen/bin/qemu-dm"),
(guest_archs[i].hvm ?
......
......@@ -7,7 +7,7 @@ Subject: remove-RHism.diff
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/virsh.pod b/tools/virsh.pod
index 94fe897..583be37 100644
index 3ff6da1..e3d9a4a 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -107,7 +107,7 @@ alphabetic character, @, [, ], \, ^, _.
......
......@@ -42,10 +42,10 @@ to savely detect that the command 'info migrate' is not implemented.
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c
index 15fbcb7..1a02a61 100644
index 7b81079..99f7641 100644
--- a/src/qemu/qemu_monitor_text.c
+++ b/src/qemu/qemu_monitor_text.c
@@ -1568,7 +1568,15 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon,
@@ -1533,7 +1533,15 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon,
}
status->disk_total *= 1024;
}
......
......@@ -10,7 +10,3 @@ Don-t-fail-if-we-can-t-setup-avahi.patch
Reduce-udevadm-settle-timeout-to-10-seconds.patch
debian/Debianize-systemd-service-files.patch
Allow-xen-toolstack-to-find-it-s-binaries.patch
Create-directory-for-lease-files-if-it-s-missing.patch
Fix-crash-when-multiple-event-callbacks-were-registe.patch
CVE-2013-4153-qemu-Fix-double-free-of-returned-JSON-.patch
CVE-2013-4154-qemu-Prevent-crash-of-libvirtd-without.patch
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment