Update patches
Dropped patches fixed upstream
CVE-2013-4153-qemu-Fix-double-free-of-returned-JSON-.patch
CVE-2013-4154-qemu-Prevent-crash-of-libvirtd-without.patch
Create-directory-for-lease-files-if-it-s-missing.patch
Fix-crash-when-multiple-event-callbacks-were-registe.patch
Guido Günther
10 years ago
18 | 18 | 12 files changed, 24 insertions(+), 26 deletions(-) |
19 | 19 | |
20 | 20 | diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng |
21 | index 106ca73..9745e26 100644 | |
21 | index 65c7c72..c36ad7c 100644 | |
22 | 22 | --- a/docs/schemas/capability.rng |
23 | 23 | +++ b/docs/schemas/capability.rng |
24 | 24 | @@ -263,13 +263,13 @@ |
38 | 38 | </define> |
39 | 39 | |
40 | 40 | diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c |
41 | index a318ea5..e9da6a3 100644 | |
41 | index 53bbcaa..57799d2 100644 | |
42 | 42 | --- a/src/xen/xen_hypervisor.c |
43 | 43 | +++ b/src/xen/xen_hypervisor.c |
44 | @@ -2081,11 +2081,9 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch, | |
44 | @@ -2142,11 +2142,9 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch, | |
45 | 45 | if ((guest = virCapabilitiesAddGuest(caps, |
46 | 46 | guest_archs[i].hvm ? "hvm" : "xen", |
47 | 47 | guest_archs[i].arch, |
0 | From: Peter Krempa <pkrempa@redhat.com> | |
1 | Date: Tue, 16 Jul 2013 15:39:06 +0200 | |
2 | Subject: CVE-2013-4153: qemu: Fix double free of returned JSON array in | |
3 | qemuAgentGetVCPUs() | |
4 | ||
5 | A part of the returned monitor response was freed twice and caused | |
6 | crashes of the daemon when using guest agent cpu count retrieval. | |
7 | ||
8 | # virsh vcpucount dom --guest | |
9 | ||
10 | Introduced in v1.0.6-48-gc6afcb0 | |
11 | ||
12 | Closes: #717354 | |
13 | --- | |
14 | src/qemu/qemu_agent.c | 1 - | |
15 | 1 file changed, 1 deletion(-) | |
16 | ||
17 | diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c | |
18 | index 9914521..d6be677 100644 | |
19 | --- a/src/qemu/qemu_agent.c | |
20 | +++ b/src/qemu/qemu_agent.c | |
21 | @@ -1538,7 +1538,6 @@ qemuAgentGetVCPUs(qemuAgentPtr mon, | |
22 | cleanup: | |
23 | virJSONValueFree(cmd); | |
24 | virJSONValueFree(reply); | |
25 | - virJSONValueFree(data); | |
26 | return ret; | |
27 | } | |
28 |
0 | From: Alex Jia <ajia@redhat.com> | |
1 | Date: Tue, 16 Jul 2013 17:30:20 +0800 | |
2 | Subject: CVE-2013-4154: qemu: Prevent crash of libvirtd without guest agent | |
3 | configuration | |
4 | ||
5 | If users haven't configured guest agent then qemuAgentCommand() will | |
6 | dereference a NULL 'mon' pointer, which causes crash of libvirtd when | |
7 | using agent based cpu (un)plug. | |
8 | ||
9 | With the patch, when the qemu-ga service isn't running in the guest, | |
10 | a expected error "error: Guest agent is not responding: Guest agent | |
11 | not available for now" will be raised, and the error "error: argument | |
12 | unsupported: QEMU guest agent is not configured" is raised when the | |
13 | guest hasn't configured guest agent. | |
14 | ||
15 | GDB backtrace: | |
16 | ||
17 | (gdb) bt | |
18 | #0 virNetServerFatalSignal (sig=11, siginfo=<value optimized out>, context=<value optimized out>) at rpc/virnetserver.c:326 | |
19 | #1 <signal handler called> | |
20 | #2 qemuAgentCommand (mon=0x0, cmd=0x7f39300017b0, reply=0x7f394b090910, seconds=-2) at qemu/qemu_agent.c:975 | |
21 | #3 0x00007f39429507f6 in qemuAgentGetVCPUs (mon=0x0, info=0x7f394b0909b8) at qemu/qemu_agent.c:1475 | |
22 | #4 0x00007f39429d9857 in qemuDomainGetVcpusFlags (dom=<value optimized out>, flags=9) at qemu/qemu_driver.c:4849 | |
23 | #5 0x00007f3957dffd8d in virDomainGetVcpusFlags (domain=0x7f39300009c0, flags=8) at libvirt.c:9843 | |
24 | ||
25 | How to reproduce? | |
26 | ||
27 | # To start a guest without guest agent configuration | |
28 | # then run the following cmdline | |
29 | ||
30 | # virsh vcpucount foobar --guest | |
31 | error: End of file while reading data: Input/output error | |
32 | error: One or more references were leaked after disconnect from the hypervisor | |
33 | error: Failed to reconnect to the hypervisor | |
34 | ||
35 | RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=984821 | |
36 | ||
37 | Signed-off-by: Alex Jia <ajia@redhat.com> | |
38 | Signed-off-by: Peter Krempa <pkrempa@redhat.com> | |
39 | ||
40 | Closes: #717355 | |
41 | --- | |
42 | src/qemu/qemu_driver.c | 26 ++++++++++++++++++++++++++ | |
43 | 1 file changed, 26 insertions(+) | |
44 | ||
45 | diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c | |
46 | index 9d6160f..5ddd9af 100644 | |
47 | --- a/src/qemu/qemu_driver.c | |
48 | +++ b/src/qemu/qemu_driver.c | |
49 | @@ -3963,6 +3963,19 @@ qemuDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus, | |
50 | goto endjob; | |
51 | } | |
52 | ||
53 | + if (priv->agentError) { | |
54 | + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", | |
55 | + _("QEMU guest agent is not " | |
56 | + "available due to an error")); | |
57 | + goto endjob; | |
58 | + } | |
59 | + | |
60 | + if (!priv->agent) { | |
61 | + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", | |
62 | + _("QEMU guest agent is not configured")); | |
63 | + goto endjob; | |
64 | + } | |
65 | + | |
66 | qemuDomainObjEnterAgent(vm); | |
67 | ncpuinfo = qemuAgentGetVCPUs(priv->agent, &cpuinfo); | |
68 | qemuDomainObjExitAgent(vm); | |
69 | @@ -4685,6 +4698,19 @@ qemuDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) | |
70 | if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) | |
71 | goto cleanup; | |
72 | ||
73 | + if (priv->agentError) { | |
74 | + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", | |
75 | + _("QEMU guest agent is not " | |
76 | + "available due to an error")); | |
77 | + goto endjob; | |
78 | + } | |
79 | + | |
80 | + if (!priv->agent) { | |
81 | + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", | |
82 | + _("QEMU guest agent is not configured")); | |
83 | + goto endjob; | |
84 | + } | |
85 | + | |
86 | if (!virDomainObjIsActive(vm)) { | |
87 | virReportError(VIR_ERR_OPERATION_INVALID, "%s", | |
88 | _("domain is not running")); |
0 | From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx@sigxcpu.org> | |
1 | Date: Sun, 7 Jul 2013 14:59:48 +0200 | |
2 | Subject: Create directory for lease files if it's missing | |
3 | ||
4 | If we don't autostart a network it's not being created. | |
5 | ||
6 | Debian Bug http://bugs.debian.org/715200 | |
7 | --- | |
8 | src/nwfilter/nwfilter_dhcpsnoop.c | 10 ++++++++-- | |
9 | 1 file changed, 8 insertions(+), 2 deletions(-) | |
10 | ||
11 | diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c | |
12 | index 708e67f..3fdb507 100644 | |
13 | --- a/src/nwfilter/nwfilter_dhcpsnoop.c | |
14 | +++ b/src/nwfilter/nwfilter_dhcpsnoop.c | |
15 | @@ -74,8 +74,9 @@ | |
16 | ||
17 | #ifdef HAVE_LIBPCAP | |
18 | ||
19 | -# define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases" | |
20 | -# define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp" | |
21 | +# define LEASEFILE_DIR LOCALSTATEDIR "/run/libvirt/network/" | |
22 | +# define LEASEFILE LEASEFILE_DIR "nwfilter.leases" | |
23 | +# define TMPLEASEFILE LEASEFILE_DIR "nwfilter.ltmp" | |
24 | ||
25 | struct virNWFilterSnoopState { | |
26 | /* lease file */ | |
27 | @@ -1893,6 +1894,11 @@ virNWFilterSnoopLeaseFileRefresh(void) | |
28 | { | |
29 | int tfd; | |
30 | ||
31 | + if (virFileMakePathWithMode(LEASEFILE_DIR, 0700) < 0) { | |
32 | + virReportError(errno, _("mkdir(\"%s\")"), LEASEFILE_DIR); | |
33 | + return; | |
34 | + } | |
35 | + | |
36 | if (unlink(TMPLEASEFILE) < 0 && errno != ENOENT) | |
37 | virReportSystemError(errno, _("unlink(\"%s\")"), TMPLEASEFILE); | |
38 |
7 | 7 | 1 file changed, 2 insertions(+) |
8 | 8 | |
9 | 9 | diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c |
10 | index 4c5a0ea..261e63f 100644 | |
10 | index 5b434ba..fad9a98 100644 | |
11 | 11 | --- a/tests/virnetsockettest.c |
12 | 12 | +++ b/tests/virnetsockettest.c |
13 | 13 | @@ -497,10 +497,12 @@ mymain(void) |
6 | 6 | 1 file changed, 1 insertion(+), 2 deletions(-) |
7 | 7 | |
8 | 8 | diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c |
9 | index 9f56b03..8684b35 100644 | |
9 | index cb770c3..8c15d41 100644 | |
10 | 10 | --- a/src/rpc/virnetserver.c |
11 | 11 | +++ b/src/rpc/virnetserver.c |
12 | @@ -1064,8 +1064,7 @@ void virNetServerRun(virNetServerPtr srv) | |
12 | @@ -1055,8 +1055,7 @@ void virNetServerRun(virNetServerPtr srv) | |
13 | 13 | |
14 | 14 | virObjectLock(srv); |
15 | 15 |
0 | From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com> | |
1 | Date: Tue, 2 Jul 2013 15:17:09 +0200 | |
2 | Subject: Fix crash when multiple event callbacks were registered | |
3 | ||
4 | CVE-2013-2230 | |
5 | ||
6 | Don't overwrite the callback ID returned by | |
7 | virDomainEventStateRegisterID in ret by 0. | |
8 | ||
9 | Introduced by abf75aea. | |
10 | ||
11 | Closes: #715559 | |
12 | --- | |
13 | src/qemu/qemu_driver.c | 4 +--- | |
14 | 1 file changed, 1 insertion(+), 3 deletions(-) | |
15 | ||
16 | diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c | |
17 | index f51e766..9d6160f 100644 | |
18 | --- a/src/qemu/qemu_driver.c | |
19 | +++ b/src/qemu/qemu_driver.c | |
20 | @@ -9914,9 +9914,7 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn, | |
21 | driver->domainEventState, | |
22 | dom, eventID, | |
23 | callback, opaque, freecb, &ret) < 0) | |
24 | - goto cleanup; | |
25 | - | |
26 | - ret = 0; | |
27 | + ret = -1; | |
28 | ||
29 | cleanup: | |
30 | return ret; |
9 | 9 | 1 file changed, 1 insertion(+), 1 deletion(-) |
10 | 10 | |
11 | 11 | diff --git a/src/util/virutil.c b/src/util/virutil.c |
12 | index 569d035..ab55e95 100644 | |
12 | index adcdb3c..328e36e 100644 | |
13 | 13 | --- a/src/util/virutil.c |
14 | 14 | +++ b/src/util/virutil.c |
15 | @@ -1419,7 +1419,7 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, | |
15 | @@ -1398,7 +1398,7 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups, | |
16 | 16 | void virFileWaitForDevices(void) |
17 | 17 | { |
18 | 18 | # ifdef UDEVADM |
9 | 9 | 2 files changed, 6 deletions(-) |
10 | 10 | |
11 | 11 | diff --git a/src/Makefile.am b/src/Makefile.am |
12 | index 4cf999d..e82ed3e 100644 | |
12 | index 62e427e..57cbceb 100644 | |
13 | 13 | --- a/src/Makefile.am |
14 | 14 | +++ b/src/Makefile.am |
15 | @@ -2340,9 +2340,6 @@ if WITH_NETWORK | |
16 | cp $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t \ | |
17 | $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml && \ | |
18 | rm $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t; } | |
19 | - test -e $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml || \ | |
15 | @@ -2362,9 +2362,6 @@ if WITH_NETWORK | |
16 | cp $(DESTDIR)$(confdir)/qemu/networks/default.xml.t \ | |
17 | $(DESTDIR)$(confdir)/qemu/networks/default.xml && \ | |
18 | rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; } | |
19 | - test -e $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml || \ | |
20 | 20 | - ln -s ../default.xml \ |
21 | - $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml | |
21 | - $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml | |
22 | 22 | endif |
23 | 23 | |
24 | 24 | uninstall-local:: uninstall-init uninstall-systemd |
25 | 25 | diff --git a/src/Makefile.in b/src/Makefile.in |
26 | index 1ef1a46..2b7e632 100644 | |
26 | index b14c682..540d1c0 100644 | |
27 | 27 | --- a/src/Makefile.in |
28 | 28 | +++ b/src/Makefile.in |
29 | @@ -7919,9 +7919,6 @@ install-data-local: install-init install-systemd | |
30 | @WITH_NETWORK_TRUE@ cp $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t \ | |
31 | @WITH_NETWORK_TRUE@ $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml && \ | |
32 | @WITH_NETWORK_TRUE@ rm $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/default.xml.t; } | |
33 | -@WITH_NETWORK_TRUE@ test -e $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml || \ | |
29 | @@ -8079,9 +8079,6 @@ install-data-local: install-init install-systemd | |
30 | @WITH_NETWORK_TRUE@ cp $(DESTDIR)$(confdir)/qemu/networks/default.xml.t \ | |
31 | @WITH_NETWORK_TRUE@ $(DESTDIR)$(confdir)/qemu/networks/default.xml && \ | |
32 | @WITH_NETWORK_TRUE@ rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; } | |
33 | -@WITH_NETWORK_TRUE@ test -e $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml || \ | |
34 | 34 | -@WITH_NETWORK_TRUE@ ln -s ../default.xml \ |
35 | -@WITH_NETWORK_TRUE@ $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml | |
35 | -@WITH_NETWORK_TRUE@ $(DESTDIR)$(confdir)/qemu/networks/autostart/default.xml | |
36 | 36 | |
37 | 37 | uninstall-local:: uninstall-init uninstall-systemd |
38 | 38 | @WITH_LIBVIRTD_TRUE@ rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/lockd/files" ||: |
12 | 12 | 5 files changed, 6 insertions(+), 6 deletions(-) |
13 | 13 | |
14 | 14 | diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c |
15 | index 9d9c3ee..a318ea5 100644 | |
15 | index cd85b75..53bbcaa 100644 | |
16 | 16 | --- a/src/xen/xen_hypervisor.c |
17 | 17 | +++ b/src/xen/xen_hypervisor.c |
18 | @@ -2085,7 +2085,7 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch, | |
18 | @@ -2146,7 +2146,7 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch, | |
19 | 19 | "/usr/lib64/xen/bin/qemu-dm" : |
20 | 20 | "/usr/lib/xen/bin/qemu-dm"), |
21 | 21 | (guest_archs[i].hvm ? |
6 | 6 | 1 file changed, 1 insertion(+), 1 deletion(-) |
7 | 7 | |
8 | 8 | diff --git a/tools/virsh.pod b/tools/virsh.pod |
9 | index 94fe897..583be37 100644 | |
9 | index 3ff6da1..e3d9a4a 100644 | |
10 | 10 | --- a/tools/virsh.pod |
11 | 11 | +++ b/tools/virsh.pod |
12 | 12 | @@ -107,7 +107,7 @@ alphabetic character, @, [, ], \, ^, _. |
41 | 41 | 1 file changed, 9 insertions(+), 1 deletion(-) |
42 | 42 | |
43 | 43 | diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c |
44 | index 15fbcb7..1a02a61 100644 | |
44 | index 7b81079..99f7641 100644 | |
45 | 45 | --- a/src/qemu/qemu_monitor_text.c |
46 | 46 | +++ b/src/qemu/qemu_monitor_text.c |
47 | @@ -1568,7 +1568,15 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon, | |
47 | @@ -1533,7 +1533,15 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon, | |
48 | 48 | } |
49 | 49 | status->disk_total *= 1024; |
50 | 50 | } |
9 | 9 | Reduce-udevadm-settle-timeout-to-10-seconds.patch |
10 | 10 | debian/Debianize-systemd-service-files.patch |
11 | 11 | Allow-xen-toolstack-to-find-it-s-binaries.patch |
12 | Create-directory-for-lease-files-if-it-s-missing.patch | |
13 | Fix-crash-when-multiple-event-callbacks-were-registe.patch | |
14 | CVE-2013-4153-qemu-Fix-double-free-of-returned-JSON-.patch | |
15 | CVE-2013-4154-qemu-Prevent-crash-of-libvirtd-without.patch |