[PULL 0/6] Trivial patches for 2026-11-12

[PULL 0/6] Trivial patches for 2026-11-12

[Michael Tokarev]

The following changes since commit 29760efaf96bbe5928f8111881eddbf5ac06439e:

  Update version for v11.2.0-rc0 release (2026-11-10 14:47:54 -0800)

are available in the Git repository at:

  https://gitlab.com/mjt0k/qemu.git tags/pull-trivial-patches

for you to fetch changes up to dab5f72a8f44af4e984f91986f41d4968ff7e337:

  configure: --disable-containers should prevent `docker.py probe` (2026-11-12 13:30:40 +0300)

----------------------------------------------------------------
trivial patches for 2026-11-12.

Nothing fancy, some stuff collected since long time.

----------------------------------------------------------------
Alex Bennée (1):
      MAINTAINERS: fix typo in Gerd's name

Filip Hejsek (2):
      io: avoid potential double close of qio_channel_file's fd
      docs: fix a few typos

Lucas Cardoso (1):
      hw/audio/fmopl.c: Convert malloc, free to g_malloc0, g_new and g_free

Markus Armbruster (1):
      hw/audio/intel-hda: Belatedly update comment for removal of -soundhw

Matthew White (1):
      configure: --disable-containers should prevent `docker.py probe`

 MAINTAINERS                           |  2 +-
 configure                             | 17 +++++++++-----
 docs/devel/clocks.rst                 |  2 +-
 docs/devel/control-flow-integrity.rst |  2 +-
 docs/devel/docs.rst                   |  2 +-
 docs/devel/ebpf_rss.rst               |  2 +-
 docs/devel/multi-process.rst          |  6 ++---
 docs/devel/submitting-a-patch.rst     |  2 +-
 docs/interop/vfio-user.rst            |  2 +-
 docs/specs/ppc-spapr-hcalls.rst       |  2 +-
 docs/specs/ppc-spapr-xive.rst         |  2 +-
 docs/system/security.rst              |  2 +-
 docs/user/main.rst                    |  2 +-
 hw/audio/fmopl.c                      | 43 ++++++++++-------------------------
 hw/audio/intel-hda.c                  |  4 ++--
 io/channel-file.c                     | 18 ++++++++++++---
 16 files changed, 54 insertions(+), 56 deletions(-)

[PULL 1/6] io: avoid potential double close of qio_channel_file's fd

[Michael Tokarev]

From: Filip Hejsek <filip.hejsek@gmail.com>

Make qio_channel_file_close() set fd to -1 even if qemu_close() returns
an error so that qio_channel_file_finalize() doesn't call close again.

On Linux, close() always closes the fd, even when it returns an error.
Because the fd can be reused after it is closed, the close must not
be retried.

Signed-off-by: Filip Hejsek <filip.hejsek@gmail.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 io/channel-file.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/io/channel-file.c b/io/channel-file.c
index 4c9da6619b9..2487adaea2a 100644
--- a/io/channel-file.c
+++ b/io/channel-file.c
@@ -261,12 +261,24 @@ static int qio_channel_file_close(QIOChannel *ioc,
 {
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 
-    if (qemu_close(fioc->fd) < 0) {
+    int ret = qemu_close(fioc->fd);
+    /*
+     * Set fioc->fd to -1, to prevent qio_channel_file_finalize() from
+     * closing it again.
+     *
+     * POSIX.1-2024 specifies that the fd is closed even when close()
+     * returns an error, except when the error is EINTR.  The systems that
+     * QEMU supports however violate the standard and always close the fd,
+     * even when returning EINTR.  If the fd was actually closed, we must not
+     * try to close it a second time as we could accidentally close someone
+     * else's fd. 
+     */
+    fioc->fd = -1;
+    if (ret < 0) {
         error_setg_errno(errp, errno,
-                         "Unable to close file");
+                         "Got an error while closing file");
         return -1;
     }
-    fioc->fd = -1;
     return 0;
 }
 
-- 
2.47.3

[PULL 2/6] hw/audio/fmopl.c: Convert malloc, free to g_malloc0, g_new and g_free

[Michael Tokarev]

From: Lucas Cardoso <luc.fast2004@gmail.com>

In accordance with QEMU's coding style guidelines, replace raw memory
allocation functions (malloc/free) with their GLib equivalents
(g_new/g_malloc0/g_free/g_clear_pointer).

Also removes the old generic error-handling code from
OPLOpenTable(), since the Glib functions abort the program automatically
if memory is exhausted.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1798
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Lucas Cardoso <luc.fast2004@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/audio/fmopl.c | 43 ++++++++++++-------------------------------
 1 file changed, 12 insertions(+), 31 deletions(-)

diff --git a/hw/audio/fmopl.c b/hw/audio/fmopl.c
index a63ad0f04d5..91fe806fd66 100644
--- a/hw/audio/fmopl.c
+++ b/hw/audio/fmopl.c
@@ -607,26 +607,10 @@ static int OPLOpenTable( void )
 	double pom;
 
 	/* allocate dynamic tables */
-	if( (TL_TABLE = malloc(TL_MAX*2*sizeof(int32_t))) == NULL)
-		return 0;
-	if( (SIN_TABLE = malloc(SIN_ENT*4 *sizeof(int32_t *))) == NULL)
-	{
-		free(TL_TABLE);
-		return 0;
-	}
-	if( (AMS_TABLE = malloc(AMS_ENT*2 *sizeof(int32_t))) == NULL)
-	{
-		free(TL_TABLE);
-		free(SIN_TABLE);
-		return 0;
-	}
-	if( (VIB_TABLE = malloc(VIB_ENT*2 *sizeof(int32_t))) == NULL)
-	{
-		free(TL_TABLE);
-		free(SIN_TABLE);
-		free(AMS_TABLE);
-		return 0;
-	}
+    TL_TABLE = g_new(int32_t, TL_MAX * 2);
+    SIN_TABLE = g_new(int32_t *, SIN_ENT * 4);
+    AMS_TABLE = g_new(int32_t, AMS_ENT * 2);
+    VIB_TABLE = g_new(int32_t, VIB_ENT * 2);
     ENV_CURVE = g_new(int32_t, 2 * EG_ENT + 1);
 	/* make total level table */
 	for (t = 0;t < EG_ENT-1 ;t++){
@@ -695,11 +679,11 @@ static int OPLOpenTable( void )
 
 static void OPLCloseTable( void )
 {
-    g_free(ENV_CURVE);
-	free(TL_TABLE);
-	free(SIN_TABLE);
-	free(AMS_TABLE);
-	free(VIB_TABLE);
+    g_clear_pointer(&ENV_CURVE, g_free);
+    g_clear_pointer(&TL_TABLE, g_free);
+    g_clear_pointer(&SIN_TABLE, g_free);
+    g_clear_pointer(&AMS_TABLE, g_free);
+    g_clear_pointer(&VIB_TABLE, g_free);
 }
 
 /* CSM Key Control */
@@ -1081,11 +1065,8 @@ FM_OPL *OPLCreate(int clock, int rate)
 	/* allocate OPL state space */
 	state_size  = sizeof(FM_OPL);
 	state_size += sizeof(OPL_CH)*max_ch;
-	/* allocate memory block */
-	ptr = malloc(state_size);
-	if(ptr==NULL) return NULL;
-	/* clear */
-	memset(ptr,0,state_size);
+    /* allocate memory block and zero-initialize */
+    ptr = g_malloc0(state_size);
 	OPL        = (FM_OPL *)ptr; ptr+=sizeof(FM_OPL);
 	OPL->P_CH  = (OPL_CH *)ptr; ptr+=sizeof(OPL_CH)*max_ch;
 	/* set channel state pointer */
@@ -1128,7 +1109,7 @@ void OPLDestroy(FM_OPL *OPL)
 	}
 #endif
 	OPL_UnLockTable();
-	free(OPL);
+    g_free(OPL);
 }
 
 /* ----------  Option handlers ----------       */
-- 
2.47.3

[PULL 3/6] docs: fix a few typos

[Michael Tokarev]

From: Filip Hejsek <filip.hejsek@gmail.com>

Signed-off-by: Filip Hejsek <filip.hejsek@gmail.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/devel/clocks.rst                 | 2 +-
 docs/devel/control-flow-integrity.rst | 2 +-
 docs/devel/docs.rst                   | 2 +-
 docs/devel/ebpf_rss.rst               | 2 +-
 docs/devel/multi-process.rst          | 6 +++---
 docs/devel/submitting-a-patch.rst     | 2 +-
 docs/interop/vfio-user.rst            | 2 +-
 docs/specs/ppc-spapr-hcalls.rst       | 2 +-
 docs/specs/ppc-spapr-xive.rst         | 2 +-
 docs/system/security.rst              | 2 +-
 docs/user/main.rst                    | 2 +-
 11 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst
index 16de32147b9..997b09c6a4e 100644
--- a/docs/devel/clocks.rst
+++ b/docs/devel/clocks.rst
@@ -280,7 +280,7 @@ so you can use this to model clock controller devices which
 have guest-programmable frequency multipliers or dividers.
 
 Similarly to ``clock_set()``, ``clock_set_mul_div()`` returns ``true`` if
-the clock state was modified; that is, if the multiplier or the diviser
+the clock state was modified; that is, if the multiplier or the divisor
 or both were changed by the call.
 
 Note that ``clock_set_mul_div()`` does not automatically call
diff --git a/docs/devel/control-flow-integrity.rst b/docs/devel/control-flow-integrity.rst
index 3d5702fa4cc..466888bdf16 100644
--- a/docs/devel/control-flow-integrity.rst
+++ b/docs/devel/control-flow-integrity.rst
@@ -39,7 +39,7 @@ are planning to also enable fuzzing, then Clang 11+ is needed (more on this
 later).
 
 Given the use of LTO, a version of AR that supports LLVM IR is required.
-The easies way of doing this is by selecting the AR provided by LLVM::
+The easiest way of doing this is by selecting the AR provided by LLVM::
 
  AR=llvm-ar-9 CC=clang-9 CXX=clang++-9 /path/to/configure --enable-cfi
 
diff --git a/docs/devel/docs.rst b/docs/devel/docs.rst
index a7768b53117..7fe7e44429f 100644
--- a/docs/devel/docs.rst
+++ b/docs/devel/docs.rst
@@ -5,7 +5,7 @@ QEMU Documentation
 
 QEMU's documentation is written in reStructuredText format and
 built using the Sphinx documentation generator. We generate both
-the HTML manual and the manpages from the some documentation sources.
+the HTML manual and the manpages from the same documentation sources.
 
 hxtool and .hx files
 --------------------
diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
index ed5d33767bd..85ef5476232 100644
--- a/docs/devel/ebpf_rss.rst
+++ b/docs/devel/ebpf_rss.rst
@@ -31,7 +31,7 @@ Not for all packets, the hash can/should be calculated.
 
 Note: currently, eBPF RSS does not support hash reporting.
 
-eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
+eBPF RSS turned on by different combinations of vhost-net, virtio-net and tap configurations:
 
 - eBPF is used:
 
diff --git a/docs/devel/multi-process.rst b/docs/devel/multi-process.rst
index 4ef539c0b0b..cafe2aaba78 100644
--- a/docs/devel/multi-process.rst
+++ b/docs/devel/multi-process.rst
@@ -158,7 +158,7 @@ IOMMUs introduce another level of complexity, since the address given to
 the guest virtio device to DMA to or from is not a guest physical
 address. This case is handled by having vhost code within QEMU register
 as a listener for IOMMU mapping changes. The vhost application maintains
-a cache of IOMMMU translations: sending translation requests back to
+a cache of IOMMU translations: sending translation requests back to
 QEMU on cache misses, and in turn receiving flush requests from QEMU
 when mappings are purged.
 
@@ -573,7 +573,7 @@ live migration
 When a remote process receives a live migration indication from QEMU, it
 will set up a channel using the received file descriptor with
 ``qio_channel_socket_new_fd()``. This channel will be used to create a
-*QEMUfile* that can be passed to ``qemu_save_device_state()`` to send
+*QEMUFile* that can be passed to ``qemu_save_device_state()`` to send
 the process's device state back to QEMU. This method will be reversed on
 restore - the channel will be passed to ``qemu_loadvm_state()`` to
 restore the device state.
@@ -853,7 +853,7 @@ intx irq descriptor
 
 The irq descriptors are created by the proxy object
 ``using event_notifier_init()`` to create the irq and re-sampling
-*eventds*, and ``kvm_vm_ioctl(KVM_IRQFD)`` to bind them to an interrupt.
+*eventfds*, and ``kvm_vm_ioctl(KVM_IRQFD)`` to bind them to an interrupt.
 The interrupt route can be found with
 ``pci_device_route_intx_to_irq()``.
 
diff --git a/docs/devel/submitting-a-patch.rst b/docs/devel/submitting-a-patch.rst
index 5ccd09a3978..cd08881dfb3 100644
--- a/docs/devel/submitting-a-patch.rst
+++ b/docs/devel/submitting-a-patch.rst
@@ -241,7 +241,7 @@ Use B4
 ~~~~~~
 
 The `b4`_ tool, used for Linux kernel development, can also be used for QEMU
-development. It is packaged in most distros and PyPi. The QEMU source tree
+development. It is packaged in most distros and PyPI. The QEMU source tree
 includes a ``b4`` project configuration file at the root: ``.b4-config``.
 
 Example workflow to prepare a patch series:
diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst
index b49781a7550..bdd73f41f41 100644
--- a/docs/interop/vfio-user.rst
+++ b/docs/interop/vfio-user.rst
@@ -1583,7 +1583,7 @@ Neither the request or reply have a payload.
 --------------------------------
 
 This message can be used to coalesce multiple device write operations
-into a single messgage.  It is only used as an optimization when the
+into a single message.  It is only used as an optimization when the
 outgoing message queue is relatively full.
 
 Request
diff --git a/docs/specs/ppc-spapr-hcalls.rst b/docs/specs/ppc-spapr-hcalls.rst
index 6cdcef20265..550026ea550 100644
--- a/docs/specs/ppc-spapr-hcalls.rst
+++ b/docs/specs/ppc-spapr-hcalls.rst
@@ -20,7 +20,7 @@ to an implementation specific range in PAPR.
 ``H_RTAS (0xf000)``
 ===================
 
-RTAS stands for Run-Time Abstraction Sercies and is a set of runtime services
+RTAS stands for Run-Time Abstraction Services and is a set of runtime services
 generally provided by the firmware inside the guest to the operating system. It
 predates the existence of hypervisors (it was originally an extension to Open
 Firmware) and is still used by PAPR and LoPAR to provide various services that
diff --git a/docs/specs/ppc-spapr-xive.rst b/docs/specs/ppc-spapr-xive.rst
index f47f739e019..8b83942a290 100644
--- a/docs/specs/ppc-spapr-xive.rst
+++ b/docs/specs/ppc-spapr-xive.rst
@@ -171,7 +171,7 @@ native exploitation mode* is selected should contain:
 - ``reg``
 
   contains the base address and size of the thread interrupt
-  managnement areas (TIMA), for the User level and for the Guest OS
+  management areas (TIMA), for the User level and for the Guest OS
   level. Only the Guest OS level is taken into account today.
 
 - ``ibm,xive-eq-sizes``
diff --git a/docs/system/security.rst b/docs/system/security.rst
index e211fdd2344..92a5d87503e 100644
--- a/docs/system/security.rst
+++ b/docs/system/security.rst
@@ -107,7 +107,7 @@ an issue as a normal bug.
   possibility of large memory peaks and apply countermeasures to
   provide continuity of host operations. It is typical for the Linux
   OOM killer to reap the process triggering host memory overcommit
-  in the case of exccessive usage, offering a degree of protection.
+  in the case of excessive usage, offering a degree of protection.
   As such, bugs which can lead to excessive/unbounded memory allocations
   will usually not be classified as security flaws, but should be
   fixed as hardening bugs.
diff --git a/docs/user/main.rst b/docs/user/main.rst
index a8ddf914249..aef33bfd9aa 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -23,7 +23,7 @@ System call translation
 System calls are the principle interface between user-space and the
 kernel. Generally the same system calls exist on all versions of the
 kernel so QEMU includes a generic system call translator. The
-translator takes care of adjusting endianess, 32/64 bit parameter size
+translator takes care of adjusting endianness, 32/64 bit parameter size
 and then calling the equivalent host system call.
 
 QEMU can also adjust device specific ``ioctl()`` calls in a similar
-- 
2.47.3

[PULL 4/6] MAINTAINERS: fix typo in Gerd's name

[Michael Tokarev]

From: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Gustavo Romero <gromero@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index fa0c6d0c9bc..3d53e104c5b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2945,7 +2945,7 @@ F: tests/qtest/vmgenid-test.c
 
 VM Launch Update
 M: Ani Sinha <anisinha@redhat.com>
-M: Gerd Hoffman <kraxel@redhat.com>
+M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: hw/misc/vmlaunchupdate.c
 F: include/hw/misc/vmlaunchupdate.h
-- 
2.47.3

[PULL 5/6] hw/audio/intel-hda: Belatedly update comment for removal of -soundhw

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Comment is stale since commit 039a68373c4 (introduce -audio as a
replacement for -soundhw).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/audio/intel-hda.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3d361a4976c..431deb22113 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1303,8 +1303,8 @@ static const TypeInfo hda_codec_device_type_info = {
 };
 
 /*
- * create intel hda controller with codec attached to it,
- * so '-soundhw hda' works.
+ * Create intel hda controller with codec attached to it,
+ * so '-audio model=hda' works.
  */
 static void intel_hda_and_codec_init(const char *audiodev)
 {
-- 
2.47.3

[PULL 6/6] configure: --disable-containers should prevent `docker.py probe`

[Michael Tokarev]

From: Matthew White <mehw.is.me@proton.me>

Upstream commit c4ce04cfb7460d46c0262d437a7f35bb5c5fc449 changed the
configure file to set container_command regardless of use_containers.
As a result, it runs `docker.py probe` to detect a Docker-compatible
application, such as Podman, even when --disable-containers is used.

On Gentoo, this reopens https://bugs.gentoo.org/732972.  As reported
in https://bugs.gentoo.org/984747, the `docker.py probe` command can
trigger SANDBOX ACCESS VIOLATION errors under QEMU v11.1.2:

 * ACCESS DENIED:  open_wr_creat: /var/lib/rpm/rpmdb.sqlite-wal
 * ACCESS DENIED:  fchown:        /var/lib/rpm/rpmdb.sqlite-wal
 ...

This patch is to prevent `docker.py probe` from running and to clear
container_command when --disable-containers is used.

Buglink: https://bugs.gentoo.org/984747
Signed-off-by: Matthew White <mehw.is.me@proton.me>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 configure | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/configure b/configure
index af14a9c23ef..d38268e340f 100755
--- a/configure
+++ b/configure
@@ -1277,12 +1277,17 @@ fi
 ##########################################
 # functions to probe cross compilers
 
-if test "$container_command" = ""; then
-    container_command=$($python "$source_path"/tests/docker/docker.py probe)
-    test "$container_command" = "no" && container_command=""
-fi
-if test $use_containers = "yes" && test "$container_command" != ""; then
-    docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
+if test $use_containers = "yes"; then
+    if test "$container_command" = ""; then
+        container_command=$($python "$source_path"/tests/docker/docker.py probe)
+        test "$container_command" = "no" && container_command=""
+    fi
+    if test "$container_command" != ""; then
+        docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
+    fi
+else
+    # the option --disable-containers should override and disable --container-command
+    container_command=""
 fi
 
 # cross compilers defaults, can be overridden with --cross-cc-ARCH
-- 
2.47.3

Re: [PULL 6/6] configure: --disable-containers should prevent `docker.py probe`

[Daniel P. Berrangé]

On Thu, Nov 12, 2026 at 09:45:09PM +0300, Michael Tokarev wrote:
> From: Matthew White <mehw.is.me@proton.me>
> 
> Upstream commit c4ce04cfb7460d46c0262d437a7f35bb5c5fc449 changed the
> configure file to set container_command regardless of use_containers.
> As a result, it runs `docker.py probe` to detect a Docker-compatible
> application, such as Podman, even when --disable-containers is used.
> 
> On Gentoo, this reopens https://bugs.gentoo.org/732972.  As reported
> in https://bugs.gentoo.org/984747, the `docker.py probe` command can
> trigger SANDBOX ACCESS VIOLATION errors under QEMU v11.1.2:
> 
>  * ACCESS DENIED:  open_wr_creat: /var/lib/rpm/rpmdb.sqlite-wal
>  * ACCESS DENIED:  fchown:        /var/lib/rpm/rpmdb.sqlite-wal
>  ...

I'm puzzled why docker.py probe would touch the RPM database.

As long as the configure script does not break though, having
the system log sandbox warnings is not a bug from QEMU's POV
IMHO.

The probe can be disabled by using --container-command=podman
or probably even --container-command=false would work.

> This patch is to prevent `docker.py probe` from running and to clear
> container_command when --disable-containers is used.

This reintroduces the problem that c4ce04cfb7460d46c0262d437a7f35bb5c5fc449
was fixing, because tests/docker/Makefile will now re-run the docker
probe on every command.

The --disable-containers arg was only intended to disable the use of
cross compilation in containers for the purposes of TCG testsuite.

> 
> Buglink: https://bugs.gentoo.org/984747
> Signed-off-by: Matthew White <mehw.is.me@proton.me>
> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
>  configure | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/configure b/configure
> index af14a9c23ef..d38268e340f 100755
> --- a/configure
> +++ b/configure
> @@ -1277,12 +1277,17 @@ fi
>  ##########################################
>  # functions to probe cross compilers
>  
> -if test "$container_command" = ""; then
> -    container_command=$($python "$source_path"/tests/docker/docker.py probe)
> -    test "$container_command" = "no" && container_command=""
> -fi
> -if test $use_containers = "yes" && test "$container_command" != ""; then
> -    docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
> +if test $use_containers = "yes"; then
> +    if test "$container_command" = ""; then
> +        container_command=$($python "$source_path"/tests/docker/docker.py probe)
> +        test "$container_command" = "no" && container_command=""
> +    fi
> +    if test "$container_command" != ""; then
> +        docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
> +    fi
> +else
> +    # the option --disable-containers should override and disable --container-command
> +    container_command=""
>  fi
>  
>  # cross compilers defaults, can be overridden with --cross-cc-ARCH
> -- 
> 2.47.3
> 
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PULL 6/6] configure: --disable-containers should prevent `docker.py probe`

[Michael Tokarev]

On 11/12/26 21:58, Daniel P. Berrangé wrote:
> On Thu, Nov 12, 2026 at 09:45:09PM +0300, Michael Tokarev wrote:
>> From: Matthew White <mehw.is.me@proton.me>
>>
>> Upstream commit c4ce04cfb7460d46c0262d437a7f35bb5c5fc449 changed the
>> configure file to set container_command regardless of use_containers.
>> As a result, it runs `docker.py probe` to detect a Docker-compatible
>> application, such as Podman, even when --disable-containers is used.
>>
>> On Gentoo, this reopens https://bugs.gentoo.org/732972.  As reported
>> in https://bugs.gentoo.org/984747, the `docker.py probe` command can
>> trigger SANDBOX ACCESS VIOLATION errors under QEMU v11.1.2:
>>
>>   * ACCESS DENIED:  open_wr_creat: /var/lib/rpm/rpmdb.sqlite-wal
>>   * ACCESS DENIED:  fchown:        /var/lib/rpm/rpmdb.sqlite-wal
>>   ...
> 
> I'm puzzled why docker.py probe would touch the RPM database.

Yeah, that was puzzling for me too, but that wasn't the reason
I took this patch (which turned out not to be trivial in the end).

> As long as the configure script does not break though, having
> the system log sandbox warnings is not a bug from QEMU's POV
> IMHO.

My immediate reaction is - why probe at all once --disable-containers
is given.

There might be different reasons for the error (or lack thereof), but
once it's been told to disable containers, there's no reason to probe
container environment, end of story....

> The probe can be disabled by using --container-command=podman
> or probably even --container-command=false would work.
> 
>> This patch is to prevent `docker.py probe` from running and to clear
>> container_command when --disable-containers is used.
> 
> This reintroduces the problem that c4ce04cfb7460d46c0262d437a7f35bb5c5fc449
> was fixing, because tests/docker/Makefile will now re-run the docker
> probe on every command.
> 
> The --disable-containers arg was only intended to disable the use of
> cross compilation in containers for the purposes of TCG testsuite.

...And this is the actual problem.  It isn't --disable-containers-for-tests.
It is --disable-container.  It's more, the help currently says:

   --disable-containers     don't use containers for cross-building

so it isn't obvious at all this is only used for tests.

And as long as it is actually doing something else, not what the name suggests,
people will try to use it for something it isn't intended for.

As long as these two options (coming together) are interpreted in such
an awkward way, there will be more attempts to do the same, like this one.

(Why this change seemed trivial to me: because it restores the status-quo,
everything seems to match now, disable-containers means empty container
command, end of question).

I re-sent the pull request without this change.  But this should be
fixed one way or another, I think :)

And I should be more careful next time.

Thanks,

/mjt