|
 |
ab145e |
From b794a0e4e657defe9a491eb20adf61eafa443ca3 Mon Sep 17 00:00:00 2001
|
|
|
ab145e |
Message-Id: <b794a0e4e657defe9a491eb20adf61eafa443ca3@dist-git>
|
|
|
ab145e |
From: Peter Krempa <pkrempa@redhat.com>
|
|
|
ab145e |
Date: Wed, 28 Jul 2021 14:59:01 +0200
|
|
|
ab145e |
Subject: [PATCH] storage_driver: Unlock object on ACL fail in
|
|
|
ab145e |
storagePoolLookupByTargetPath
|
|
|
ab145e |
MIME-Version: 1.0
|
|
|
ab145e |
Content-Type: text/plain; charset=UTF-8
|
|
|
ab145e |
Content-Transfer-Encoding: 8bit
|
|
|
ab145e |
|
|
|
ab145e |
'virStoragePoolObjListSearch' returns a locked and refed object, thus we
|
|
|
ab145e |
must release it on ACL permission failure.
|
|
|
ab145e |
|
|
|
ab145e |
Fixes: 7aa0e8c0cb8
|
|
|
ab145e |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318
|
|
|
ab145e |
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
|
|
|
ab145e |
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
ab145e |
(cherry picked from commit 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87)
|
|
|
ab145e |
CVE-2021-3667
|
|
|
ab145e |
Message-Id: <a398ad51fa2db3697d91711134d28d3e07536bfc.1627476632.git.pkrempa@redhat.com>
|
|
|
ab145e |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
ab145e |
---
|
|
|
ab145e |
src/storage/storage_driver.c | 4 +++-
|
|
|
ab145e |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
ab145e |
|
|
|
ab145e |
diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
|
|
|
ab145e |
index 0bb116cf08..4f0b8c1218 100644
|
|
|
ab145e |
--- a/src/storage/storage_driver.c
|
|
|
ab145e |
+++ b/src/storage/storage_driver.c
|
|
|
ab145e |
@@ -1733,8 +1733,10 @@ storagePoolLookupByTargetPath(virConnectPtr conn,
|
|
|
ab145e |
storagePoolLookupByTargetPathCallback,
|
|
|
ab145e |
cleanpath))) {
|
|
|
ab145e |
def = virStoragePoolObjGetDef(obj);
|
|
|
ab145e |
- if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0)
|
|
|
ab145e |
+ if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) {
|
|
|
ab145e |
+ virStoragePoolObjEndAPI(&obj);
|
|
|
ab145e |
return NULL;
|
|
|
ab145e |
+ }
|
|
|
ab145e |
|
|
|
ab145e |
pool = virGetStoragePool(conn, def->name, def->uuid, NULL, NULL);
|
|
|
ab145e |
virStoragePoolObjEndAPI(&obj);
|
|
|
ab145e |
--
|
|
|
ab145e |
2.32.0
|
|
|
ab145e |
|