|
 |
c480ed |
From ad3f8f1d128f726d1504079ec34b68f6db297d3a Mon Sep 17 00:00:00 2001
|
|
|
c480ed |
Message-Id: <ad3f8f1d128f726d1504079ec34b68f6db297d3a@dist-git>
|
|
|
c480ed |
From: Marc Hartmayer <mhartmay@linux.ibm.com>
|
|
|
c480ed |
Date: Wed, 10 Jul 2019 11:49:45 +0200
|
|
|
c480ed |
Subject: [PATCH] virDomainObjListAddLocked: fix double free
|
|
|
c480ed |
MIME-Version: 1.0
|
|
|
c480ed |
Content-Type: text/plain; charset=UTF-8
|
|
|
c480ed |
Content-Transfer-Encoding: 8bit
|
|
|
c480ed |
|
|
|
c480ed |
If @vm has flagged as "to be removed" virDomainObjListFindByNameLocked
|
|
|
c480ed |
returns NULL (although the definition actually exists). Therefore, the
|
|
|
c480ed |
possibility exits that "virHashAddEntry" will raise the error
|
|
|
c480ed |
"Duplicate key" => virDomainObjListAddObjLocked fails =>
|
|
|
c480ed |
virDomainObjEndAPI(&vm) is called and this leads to a freeing of @def
|
|
|
c480ed |
since @def is already assigned to vm->def. But actually this leads to
|
|
|
c480ed |
a double free since the common usage pattern is that the caller of
|
|
|
c480ed |
virDomainObjListAdd(Locked) is responsible for freeing @def in case of
|
|
|
c480ed |
an error.
|
|
|
c480ed |
|
|
|
c480ed |
Let's fix this by setting vm->def to NULL in case of an error.
|
|
|
c480ed |
|
|
|
c480ed |
Backtrace:
|
|
|
c480ed |
|
|
|
c480ed |
➤ bt
|
|
|
c480ed |
#0 virFree (ptrptr=0x7575757575757575)
|
|
|
c480ed |
#1 0x000003ffb5b25b3e in virDomainResourceDefFree
|
|
|
c480ed |
#2 0x000003ffb5b37c34 in virDomainDefFree
|
|
|
c480ed |
#3 0x000003ff9123f734 in qemuDomainDefineXMLFlags
|
|
|
c480ed |
#4 0x000003ff9123f7f4 in qemuDomainDefineXML
|
|
|
c480ed |
#5 0x000003ffb5cd2c84 in virDomainDefineXML
|
|
|
c480ed |
#6 0x000000011745aa82 in remoteDispatchDomainDefineXML
|
|
|
c480ed |
...
|
|
|
c480ed |
|
|
|
c480ed |
Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
|
|
|
c480ed |
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
|
|
|
c480ed |
(cherry picked from commit 7e760f61577e6c4adbb0b015f8f7ac1796570cdd)
|
|
|
c480ed |
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
|
|
c480ed |
|
|
|
c480ed |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1728530
|
|
|
c480ed |
Message-Id: <b651c347f5775c8298347ef8602d0205fab9c3e7.1562752178.git.jtomko@redhat.com>
|
|
|
c480ed |
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
|
|
|
c480ed |
---
|
|
|
c480ed |
src/conf/virdomainobjlist.c | 4 +++-
|
|
|
c480ed |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
c480ed |
|
|
|
c480ed |
diff --git a/src/conf/virdomainobjlist.c b/src/conf/virdomainobjlist.c
|
|
|
c480ed |
index 72064d7c66..e7c3e326ca 100644
|
|
|
c480ed |
--- a/src/conf/virdomainobjlist.c
|
|
|
c480ed |
+++ b/src/conf/virdomainobjlist.c
|
|
|
c480ed |
@@ -329,8 +329,10 @@ virDomainObjListAddLocked(virDomainObjListPtr doms,
|
|
|
c480ed |
goto cleanup;
|
|
|
c480ed |
vm->def = def;
|
|
|
c480ed |
|
|
|
c480ed |
- if (virDomainObjListAddObjLocked(doms, vm) < 0)
|
|
|
c480ed |
+ if (virDomainObjListAddObjLocked(doms, vm) < 0) {
|
|
|
c480ed |
+ vm->def = NULL;
|
|
|
c480ed |
goto error;
|
|
|
c480ed |
+ }
|
|
|
c480ed |
}
|
|
|
c480ed |
cleanup:
|
|
|
c480ed |
return vm;
|
|
|
c480ed |
--
|
|
|
c480ed |
2.22.0
|
|
|
c480ed |
|