|
 |
c401cc |
From d0d647753f48a4520f7eac8756e4fd2916b76ac2 Mon Sep 17 00:00:00 2001
|
|
|
c401cc |
Message-Id: <d0d647753f48a4520f7eac8756e4fd2916b76ac2.1389183249.git.jdenemar@redhat.com>
|
|
|
c401cc |
From: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
Date: Fri, 20 Dec 2013 15:04:09 +0100
|
|
|
c401cc |
Subject: [PATCH] qemu: Fix job usage in qemuDomainBlockJobImpl
|
|
|
c401cc |
|
|
|
c401cc |
CVE-2013-6458
|
|
|
c401cc |
|
|
|
c401cc |
Every API that is going to begin a job should do that before fetching
|
|
|
c401cc |
data from vm->def.
|
|
|
c401cc |
|
|
|
c401cc |
(cherry picked from commit f93d2caa070f6197ab50d372d286018b0ba6bbd8)
|
|
|
c401cc |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
---
|
|
|
c401cc |
src/qemu/qemu_driver.c | 22 +++++++++++-----------
|
|
|
c401cc |
1 file changed, 11 insertions(+), 11 deletions(-)
|
|
|
c401cc |
|
|
|
c401cc |
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
|
|
c401cc |
index f0748c6..1ff07bb 100644
|
|
|
c401cc |
--- a/src/qemu/qemu_driver.c
|
|
|
c401cc |
+++ b/src/qemu/qemu_driver.c
|
|
|
c401cc |
@@ -14451,16 +14451,25 @@ qemuDomainBlockJobImpl(virDomainObjPtr vm,
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
+ if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0)
|
|
|
c401cc |
+ goto cleanup;
|
|
|
c401cc |
+
|
|
|
c401cc |
+ if (!virDomainObjIsActive(vm)) {
|
|
|
c401cc |
+ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
+ _("domain is not running"));
|
|
|
c401cc |
+ goto endjob;
|
|
|
c401cc |
+ }
|
|
|
c401cc |
+
|
|
|
c401cc |
device = qemuDiskPathToAlias(vm, path, &idx);
|
|
|
c401cc |
if (!device)
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
+ goto endjob;
|
|
|
c401cc |
disk = vm->def->disks[idx];
|
|
|
c401cc |
|
|
|
c401cc |
if (mode == BLOCK_JOB_PULL && disk->mirror) {
|
|
|
c401cc |
virReportError(VIR_ERR_BLOCK_COPY_ACTIVE,
|
|
|
c401cc |
_("disk '%s' already in active block copy job"),
|
|
|
c401cc |
disk->dst);
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
+ goto endjob;
|
|
|
c401cc |
}
|
|
|
c401cc |
if (mode == BLOCK_JOB_ABORT &&
|
|
|
c401cc |
(flags & VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT) &&
|
|
|
c401cc |
@@ -14468,15 +14477,6 @@ qemuDomainBlockJobImpl(virDomainObjPtr vm,
|
|
|
c401cc |
virReportError(VIR_ERR_OPERATION_INVALID,
|
|
|
c401cc |
_("pivot of disk '%s' requires an active copy job"),
|
|
|
c401cc |
disk->dst);
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
- if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0)
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
-
|
|
|
c401cc |
- if (!virDomainObjIsActive(vm)) {
|
|
|
c401cc |
- virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
- _("domain is not running"));
|
|
|
c401cc |
goto endjob;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
--
|
|
|
c401cc |
1.8.5.2
|
|
|
c401cc |
|