[Xen-changelog] [xen stable-4.5] libxl: set XEN_QEMU_CONSOLE_LIMIT for QEMU

[patchbot@xxxxxxx]

commit 44a703dfbe3cb6e6ec6d2699b631807137dfdc1e
Author:     Wei Liu <wei.liu2@xxxxxxxxxx>
AuthorDate: Thu May 26 16:11:42 2016 +0100
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Fri Jun 10 12:41:24 2016 +0100

    libxl: set XEN_QEMU_CONSOLE_LIMIT for QEMU
    
    XSA-180 provides a patch to QEMU to bodge QEMU logging issue. We
    explicitly set the limit in libxl for 4.7.
    
    Introduce a function for setting the environment variable and call it in
    the right places.
    
    Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    Release-acked-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    (cherry picked from commit b0d409d9c4944ed29d29457fea4ad6b41d698eca)
    
    (cherry picked from commit fe82a96a657f36b08ade60ec4f3a53e67a4ee314)
    Conflicts:
        tools/libxl/libxl_dm.c
    
    This version of libxl does not pass a dm_envs to the
    *build_device_model_args* functions.  Instead, call
    libxl__set_qemu_env_for_xsa_180 in libxl__spawn_local_dm.
    
    The other call ultimate site of *build_device_model_args* (ie of
    libxl__build_device_model_args) is in libxl__spawn_stub_dm, where we
    don't need to set the env var.
    
    Signed-off-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---
 tools/libxl/libxl_dm.c | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
index 8cec460..7691460 100644
--- a/tools/libxl/libxl_dm.c
+++ b/tools/libxl/libxl_dm.c
@@ -92,6 +92,20 @@ const char *libxl__domain_device_model(libxl__gc *gc,
     return dm;
 }
 
+/* XSA-180 / CVE-2014-3672
+ *
+ * The QEMU shipped with Xen has a bodge. It checks for
+ * XEN_QEMU_CONSOLE_LIMIT to see how much data QEMU is allowed
+ * to write to stderr. We set that to 1MB if it is not set by
+ * system administrator.
+ */
+static void libxl__set_qemu_env_for_xsa_180(libxl__gc *gc,
+                                            flexarray_t *dm_envs)
+{
+    if (getenv("XEN_QEMU_CONSOLE_LIMIT")) return;
+    flexarray_append_pair(dm_envs, "XEN_QEMU_CONSOLE_LIMIT", "1048576");
+}
+
 const libxl_vnc_info *libxl__dm_vnc(const libxl_domain_config *guest_config)
 {
     const libxl_vnc_info *vnc = NULL;
@@ -1345,7 +1359,8 @@ void libxl__spawn_local_dm(libxl__egc *egc, 
libxl__dm_spawn_state *dmss)
     char *path;
     int logfile_w, null;
     int rc;
-    char **args, **arg;
+    flexarray_t *dm_envs;
+    char **args, *const *envs, **arg;
     xs_transaction_t t;
     char *vm_path;
     char **pass_stuff;
@@ -1374,6 +1389,10 @@ void libxl__spawn_local_dm(libxl__egc *egc, 
libxl__dm_spawn_state *dmss)
         goto out;
     }
 
+    dm_envs = flexarray_make(gc, 16, 1);
+    libxl__set_qemu_env_for_xsa_180(gc, dm_envs);
+    envs = (char**) flexarray_contents(dm_envs);
+
     if (b_info->type == LIBXL_DOMAIN_TYPE_HVM) {
         path = xs_get_domain_path(ctx->xsh, domid);
         libxl__xs_write(gc, XBT_NULL,
@@ -1452,7 +1471,7 @@ retry_transaction:
         goto out_close;
     if (!rc) { /* inner child */
         setsid();
-        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, NULL);
+        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, envs);
     }
 
     rc = 0;
@@ -1524,8 +1543,8 @@ static void device_model_spawn_outcome(libxl__egc *egc,
 void libxl__spawn_qdisk_backend(libxl__egc *egc, libxl__dm_spawn_state *dmss)
 {
     STATE_AO_GC(dmss->spawn.ao);
-    flexarray_t *dm_args;
-    char **args;
+    flexarray_t *dm_args, *dm_envs;
+    char **args, **envs;
     const char *dm;
     int logfile_w, null, rc;
     uint32_t domid = dmss->guest_domid;
@@ -1534,6 +1553,8 @@ void libxl__spawn_qdisk_backend(libxl__egc *egc, 
libxl__dm_spawn_state *dmss)
     dm = qemu_xen_path(gc);
 
     dm_args = flexarray_make(gc, 15, 1);
+    dm_envs = flexarray_make(gc, 1, 1);
+
     flexarray_vappend(dm_args, dm, "-xen-domid",
                       GCSPRINTF("%d", domid), NULL);
     flexarray_append(dm_args, "-xen-attach");
@@ -1547,6 +1568,9 @@ void libxl__spawn_qdisk_backend(libxl__egc *egc, 
libxl__dm_spawn_state *dmss)
     flexarray_append(dm_args, NULL);
     args = (char **) flexarray_contents(dm_args);
 
+    libxl__set_qemu_env_for_xsa_180(gc, dm_envs);
+    envs = (char **) flexarray_contents(dm_envs);
+
     logfile_w = libxl__create_qemu_logfile(gc, GCSPRINTF("qdisk-%u", domid));
     if (logfile_w < 0) {
         rc = logfile_w;
@@ -1580,7 +1604,7 @@ void libxl__spawn_qdisk_backend(libxl__egc *egc, 
libxl__dm_spawn_state *dmss)
         goto error;
     if (!rc) { /* inner child */
         setsid();
-        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, NULL);
+        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, envs);
     }
 
     return;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog