|
 |
2daa92 |
From 815828b54398429bddb290d954e6b0291e8831a4 Mon Sep 17 00:00:00 2001
|
|
|
db2858 |
From: Jim Fehlig <jfehlig@suse.com>
|
|
|
db2858 |
Date: Mon, 5 Aug 2013 10:27:23 -0600
|
|
|
db2858 |
Subject: [PATCH] xen: fix memory corruption in legacy driver
|
|
|
db2858 |
|
|
|
db2858 |
Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains
|
|
|
db2858 |
by starting to populate the names array at index -1, causing all sorts
|
|
|
db2858 |
of havoc in libvirtd such as aborts like the following
|
|
|
db2858 |
|
|
|
db2858 |
*** Error in `/usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20 ***
|
|
|
db2858 |
======= Backtrace: =========
|
|
|
db2858 |
/lib64/libc.so.6(+0x7abf6)[0x7ffff3fa0bf6]
|
|
|
db2858 |
/lib64/libc.so.6(+0x7b973)[0x7ffff3fa1973]
|
|
|
db2858 |
/lib64/libc.so.6(xdr_array+0xde)[0x7ffff403cbae]
|
|
|
db2858 |
/usr/sbin/libvirtd(+0x50251)[0x5555555a4251]
|
|
|
db2858 |
/lib64/libc.so.6(xdr_free+0x15)[0x7ffff403ccd5]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(+0x1fad34)[0x7ffff76b1d34]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(virNetServerProgramDispatch+0x1fc)[0x7ffff76b16f1]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(+0x1f214a)[0x7ffff76a914a]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(+0x1f222d)[0x7ffff76a922d]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(+0xbcc4f)[0x7ffff7573c4f]
|
|
|
db2858 |
/usr/lib64/libvirt.so.0(+0xbc5e5)[0x7ffff75735e5]
|
|
|
db2858 |
/lib64/libpthread.so.0(+0x7e0f)[0x7ffff48f7e0f]
|
|
|
db2858 |
/lib64/libc.so.6(clone+0x6d)[0x7ffff400e7dd]
|
|
|
db2858 |
|
|
|
db2858 |
Fix by initializing ret to 0 and only setting to error on failure path.
|
|
|
2daa92 |
|
|
|
2daa92 |
(cherry picked from commit 0e671a1646df543eab683b38f6644f70d12fbee1)
|
|
|
db2858 |
---
|
|
|
db2858 |
src/xen/xend_internal.c | 7 +++----
|
|
|
db2858 |
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
db2858 |
|
|
|
db2858 |
diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c
|
|
|
2daa92 |
index 9d61fca..01e74bd 100644
|
|
|
db2858 |
--- a/src/xen/xend_internal.c
|
|
|
db2858 |
+++ b/src/xen/xend_internal.c
|
|
|
2daa92 |
@@ -2897,7 +2897,7 @@ xenDaemonListDefinedDomains(virConnectPtr conn,
|
|
|
db2858 |
{
|
|
|
db2858 |
struct sexpr *root = NULL;
|
|
|
db2858 |
size_t i;
|
|
|
db2858 |
- int ret = -1;
|
|
|
db2858 |
+ int ret = 0;
|
|
|
db2858 |
struct sexpr *_for_i, *node;
|
|
|
db2858 |
|
|
|
db2858 |
if (maxnames == 0)
|
|
|
2daa92 |
@@ -2920,16 +2920,15 @@ xenDaemonListDefinedDomains(virConnectPtr conn,
|
|
|
db2858 |
break;
|
|
|
db2858 |
}
|
|
|
db2858 |
|
|
|
db2858 |
- ret = 0;
|
|
|
db2858 |
-
|
|
|
db2858 |
cleanup:
|
|
|
db2858 |
sexpr_free(root);
|
|
|
db2858 |
return ret;
|
|
|
db2858 |
|
|
|
db2858 |
error:
|
|
|
db2858 |
- for (i = 0; ret != -1 && i < ret; ++i)
|
|
|
db2858 |
+ for (i = 0; i < ret; ++i)
|
|
|
db2858 |
VIR_FREE(names[i]);
|
|
|
db2858 |
|
|
|
db2858 |
+ ret = -1;
|
|
|
db2858 |
goto cleanup;
|
|
|
db2858 |
}
|
|
|
db2858 |
|