External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-04-01 20:05:19 +00:00
Code

qemuBlockJobProcessEventCompletedPull: Avoid dangling pointer after blockpull

Browse Source 
When doing a full block pull job (base == NULL) and the config XML
contains a compatible disk, the completer function would leave a
dangling pointer in 'cfgdisk->src->backingStore' as cfgdisk->src would
be set to the value of 'cfgbase' which was always set to
'cfgdisk->src->backingStore'.

This is wrong though since for the live definition XML we set the
respective counterpart to 'job->data.pull.base' which is NULL in the
above scenario.

This leads to a invalid pointer read when saving the config XML and may
end up in a crash.

Resolve it by setting 'cfgbase' only when 'job->data.pull.base' is
non-NULL.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1946918
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
This commit is contained in:
Peter Krempa 2021-04-12 17:24:22 +02:00
parent b3605a4d83
commit 46e748aa02
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/qemu/qemu_blockjob.c
View File

@ -1005,10 +1005,7 @@ qemuBlockJobProcessEventCompletedPull(virQEMUDriverPtr driver,
if (!job->disk)
return;
if ((cfgdisk = qemuBlockJobGetConfigDisk(vm, job->disk, job->data.pull.base)))
cfgbase = cfgdisk->src->backingStore;
if (!cfgdisk)
if (!(cfgdisk = qemuBlockJobGetConfigDisk(vm, job->disk, job->data.pull.base)))
qemuBlockJobClearConfigChain(vm, job->disk);
qemuBlockJobProcessEventCompletedPullBitmaps(vm, job, asyncJob);
@ -1018,6 +1015,8 @@ qemuBlockJobProcessEventCompletedPull(virQEMUDriverPtr driver,
return;
if (job->data.pull.base) {
if (cfgdisk)
cfgbase = cfgdisk->src->backingStore;
for (n = job->disk->src->backingStore; n && n != job->data.pull.base; n = n->backingStore) {
/* find the image on top of 'base' */