External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-22 03:12:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

node_device_udev: Set @def to NULL

Browse Source 
@def is owned by @obj after adding it the node device object list. As soon as
the @obj lock has been released, another thread could free @obj and therefore
@def. If now someone accesses @def this would lead to a heap-use-after-free and
therefore most likely to a segmentation fault, therefore set @def to NULL after
the ownership has moved.

While at it, add comments to other code places why @def is set to NULL.

Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
This commit is contained in:
Marc Hartmayer 2024-04-23 20:08:48 +02:00 committed by Jonathon Jongsma
parent 7ccf76ea34
commit 30354f5b1f
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/node_device/node_device_udev.c
View File

@ -1588,6 +1588,8 @@ udevAddOneDevice(struct udev_device *device)
* and the current definition will take its place. */
if (!(obj = virNodeDeviceObjListAssignDef(driver->devs, def)))
goto cleanup;
/* @def is now owned by @obj */
def = NULL;
virNodeDeviceObjSetPersistent(obj, persistent);
virNodeDeviceObjSetAutostart(obj, autostart);
objdef = virNodeDeviceObjGetDef(obj);
@ -1983,6 +1985,8 @@ udevSetupSystemDev(void)
if (!(obj = virNodeDeviceObjListAssignDef(driver->devs, def)))
goto cleanup;
/* @def is now owned by @obj */
def = NULL;
virNodeDeviceObjSetActive(obj, true);
virNodeDeviceObjSetAutostart(obj, true);
virNodeDeviceObjSetPersistent(obj, true);

3
src/test/test_driver.c
View File

@ -7674,8 +7674,9 @@ testNodeDeviceMockCreateVport(testDriver *driver,
if (!(obj = virNodeDeviceObjListAssignDef(driver->devs, def)))
goto cleanup;
virNodeDeviceObjSetSkipUpdateCaps(obj, true);
/* @def is now owned by @obj */
def = NULL;
virNodeDeviceObjSetSkipUpdateCaps(obj, true);
objdef = virNodeDeviceObjGetDef(obj);
event = virNodeDeviceEventLifecycleNew(objdef->name,