Merge ~paelzer/ubuntu/+source/libvirt:fix-pid-duplication-and-more-1997269-1993304-1996176-KINETIC into ubuntu/+source/libvirt:ubuntu/kinetic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~paelzer/+archive/ubuntu/libvirt-1997269-1993304-1996176/+packages

[Lena Voytek (lvoytek)]

My patch matches the original I uploaded. Also finished adding the SRU info to the bug report. The other two patches look good and match what I expect based on their descriptions. LGTM

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: paelzer, lvoytek
Uploaders: paelzer
MP auto-approved

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, both PPA builds are fine as well (no FTBFS there as in lunar, as that was due to new libxen which isn't hitting the older releases).

Uploading ...

[Christian Ehrhardt  (paelzer)]

Uploading libvirt_8.6.0-0ubuntu3.1.dsc
Uploading libvirt_8.6.0-0ubuntu3.1.debian.tar.xz
Uploading libvirt_8.6.0-0ubuntu3.1_source.buildinfo
Uploading libvirt_8.6.0-0ubuntu3.1_source.changes

diff --git a/debian/changelog b/debian/changelog
index 22a9983..9844888 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,18 @@
+libvirt (8.6.0-0ubuntu3.1) kinetic; urgency=medium
+
+  [ Lena Voytek ]
+  * d/p/u/fix-swtpm-pid-duplication.patch: Clean up swtpm pids after a vm
+    shuts down (LP: #1997269)
+
+  [Christian Ehrhardt ]
+  * d/p/u/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch: prevent
+    apparmor denials on USB forwarding (LP: #1993304)
+  * d/p/u/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch:
+    tolerate the impact of too large udev data avoiding a busy loop
+    (LP: #1996176)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 22 Nov 2022 11:21:30 +0100
+
 libvirt (8.6.0-0ubuntu3) kinetic; urgency=medium
 
   * d/p/u/lp-1990499-virt-aa-helper-allow-common-riscv64-loader-paths.patch:
diff --git a/debian/patches/series b/debian/patches/series
index c2f6adb..6b0c1f9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -14,6 +14,7 @@ ubuntu/lp-1861125-ubuntu-models.patch
 ubuntu/dnsmasq-as-priv-user
 ubuntu/ovmf_paths.patch
 ubuntu/wait-for-qemu-kvm.patch
+ubuntu/lp-1997269-fix-swtpm-pid-duplication.patch
 
 # Ubuntu Apparmor Changes
 ubuntu-aa/0020-virt-aa-helper-ubuntu-storage-paths.patch
@@ -26,3 +27,5 @@ ubuntu-aa/lp-1815910-allow-vhost-hotplug.patch
 ubuntu/swtpm-by-swtpm-user.patch
 ubuntu/lp-1990499-virt-aa-helper-allow-common-riscv64-loader-paths.patch
 ubuntu/lp-1990949-virpcivpd-reduce-errors-in-log-due-to-invalid-VPD.patch
+ubuntu/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch
+ubuntu/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch
diff --git a/debian/patches/ubuntu/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch b/debian/patches/ubuntu/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch
new file mode 100644
index 0000000..ad62376
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch
@@ -0,0 +1,49 @@
+From d6ecd766aa95028b35b6da0d709721720c75c7c1 Mon Sep 17 00:00:00 2001
+From: Christian Ehrhardt <[e-mail]>
+Date: Thu, 17 Nov 2022 09:35:05 +0100
+Subject: [PATCH] apparmor: allow getattr on usb devices
+
+For the handling of usb we already allow plenty of read access,
+but so far /sys/bus/usb/devices only needed read access to the directory
+to enumerate the symlinks in there that point to the actual entries via
+relative links to ../../../devices/.
+
+But in more recent systemd with updated libraries a program might do
+getattr calls on those symlinks. And while symlinks in apparmor usually
+do not matter, as it is the effective target of an access that has to be
+allowed, here the getattr calls are on the links themselves.
+
+On USB hostdev usage that causes a set of denials like:
+ apparmor="DENIED" operation="getattr" class="file"
+ name="/sys/bus/usb/devices/usb1" comm="qemu-system-x86"
+ requested_mask="r" denied_mask="r" ...
+
+It is safe to read the links, therefore add a rule to allow it to
+the block of rules that covers the usb related access.
+
+Signed-off-by: Christian Ehrhardt <[e-mail]>
+Reviewed-by: Michal Privoznik <mprivozn at redhat.com>
+
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/d6ecd766aa950
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1993304
+Last-Update: 2022-11-22
+
+---
+ src/security/apparmor/libvirt-qemu | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
+index 02ee273e7e..d0289b8943 100644
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -42,6 +42,7 @@
+ 
+   # For hostdev access. The actual devices will be added dynamically
+   /sys/bus/usb/devices/ r,
++  /sys/bus/usb/devices/* r,
+   /sys/devices/**/usb[0-9]*/** r,
+   # libusb needs udev data about usb devices (~equal to content of lsusb -v)
+   /run/udev/data/+usb* r,
+-- 
+2.38.1
+
diff --git a/debian/patches/ubuntu/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch b/debian/patches/ubuntu/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch
new file mode 100644
index 0000000..16a3e9c
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch
@@ -0,0 +1,58 @@
+From 33a38492b75acb7dbec9b64c41a5dba4acde4240 Mon Sep 17 00:00:00 2001
+From: Christian Ehrhardt <[e-mail]>
+Date: Thu, 10 Nov 2022 10:36:28 +0100
+Subject: [PATCH] nodedev: ignore EINVAL from libudev in udevEventHandleThread
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Certain udev entries might be of a size that makes libudev emit EINVAL
+which right now leads to udevEventHandleThread exiting. Due to no more
+handling events other elements of libvirt will start pushing for events
+to be consumed which never happens causing a busy loop burning a cpu
+without any gain.
+
+After evaluation of the example case discussed in in #245 and a test
+run ignoring EINVAL it was considered safe to add EINVAL to the ignored
+errnos to not exit udevEventHandleThread giving it more resilience.
+
+The root cause is in systemd and by now was discussed and fixed via
+https://github.com/systemd/systemd/issues/24987, but hardening libvirt
+to be able to better deal with EINVAL returned still is the right thing
+to avoid the reported busy loops on systemd with older systemd versions.
+
+Fixes: https://gitlab.com/libvirt/libvirt/-/issues/245
+
+Signed-off-by: Christian Ehrhardt <[e-mail]>
+Reviewed-by: Daniel P. Berrangé <[e-mail]>
+
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/33a38492b75acb7
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1996176
+Last-Update: 2022-11-22
+
+---
+ src/node_device/node_device_udev.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
+index 24ef1c25a9..2454cab8f8 100644
+--- a/src/node_device/node_device_udev.c
++++ b/src/node_device/node_device_udev.c
+@@ -1865,10 +1865,12 @@ udevEventHandleThread(void *opaque G_GNUC_UNUSED)
+             }
+ 
+             /* POSIX allows both EAGAIN and EWOULDBLOCK to be used
+-             * interchangeably when the read would block or timeout was fired
++             * interchangeably when the read would block or timeout was fired.
++             * EINVAL might happen on too large udev entries, ignore those for
++             * the robustness of udevEventHandleThread.
+              */
+             VIR_WARNINGS_NO_WLOGICALOP_EQUAL_EXPR
+-            if (errno != EAGAIN && errno != EWOULDBLOCK) {
++            if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINVAL) {
+             VIR_WARNINGS_RESET
+                 virReportSystemError(errno, "%s",
+                                      _("failed to receive device from udev "
+-- 
+2.38.1
+
diff --git a/debian/patches/ubuntu/lp-1997269-fix-swtpm-pid-duplication.patch b/debian/patches/ubuntu/lp-1997269-fix-swtpm-pid-duplication.patch
new file mode 100644
index 0000000..ac4dfc9
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1997269-fix-swtpm-pid-duplication.patch
@@ -0,0 +1,52 @@
+Description: Do not keep swtpm pidfile around after stopping qemu vm
+Author: Martin Kletzander <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/3c2d06d78e1bd2d9298276b44a6ab09cc3b36e5a
+Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2111301
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1997269
+Last-Update: 2022-11-21
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/qemu/qemu_tpm.c
++++ b/src/qemu/qemu_tpm.c
+@@ -793,28 +793,25 @@
+     g_autofree char *pathname = NULL;
+     g_autofree char *errbuf = NULL;
+     g_autofree char *swtpm_ioctl = virTPMGetSwtpmIoctl();
++    g_autofree char *pidfile = qemuTPMEmulatorPidFileBuildPath(swtpmStateDir,
++        shortName);
+ 
+-    if (!swtpm_ioctl)
+-        return;
++    if (swtpm_ioctl &&
++        (pathname = qemuTPMEmulatorSocketBuildPath(swtpmStateDir, shortName)) &&
++        virFileExists(pathname)) {
+ 
+-    if (!(pathname = qemuTPMEmulatorSocketBuildPath(swtpmStateDir, shortName)))
+-        return;
++        cmd = virCommandNewArgList(swtpm_ioctl, "--unix", pathname, "-s", NULL);
+ 
+-    if (!virFileExists(pathname))
+-        return;
++        virCommandSetErrorBuffer(cmd, &errbuf);
+ 
+-    cmd = virCommandNew(swtpm_ioctl);
+-    if (!cmd)
+-        return;
++        ignore_value(virCommandRun(cmd, NULL));
+ 
+-    virCommandAddArgList(cmd, "--unix", pathname, "-s", NULL);
++        /* clean up the socket */
++        unlink(pathname);
++    }
+ 
+-    virCommandSetErrorBuffer(cmd, &errbuf);
+-
+-    ignore_value(virCommandRun(cmd, NULL));
+-
+-    /* clean up the socket */
+-    unlink(pathname);
++    if (pidfile)
++        virPidFileForceCleanupPath(pidfile);
+ }
+ 
+