External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-22 20:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Don't steal pointers from 'persistentDef' in qemuDomainGetBlockIoTune

Browse Source 
While the code path that queries the monitor allocates a separate copy
of the 'group_name' string the path querying the config would not copy
it. The call to virTypedParameterAssign would then steal the pointer
(without clearing it) and the RPC layer freed it. Any subsequent call
resulted into a crash.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1433183
This commit is contained in:
Peter Krempa 2017-03-17 08:43:27 +01:00
parent 009c07b9f2
commit 4b57f76502
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/qemu/qemu_driver.c
View File

@ -17707,6 +17707,11 @@ qemuDomainGetBlockIoTune(virDomainPtr dom,
goto endjob;
}
reply = disk->blkdeviotune;
/* Group name needs to be copied since qemuMonitorGetBlockIoThrottle
* allocates it as well */
if (VIR_STRDUP(reply.group_name, disk->blkdeviotune.group_name))
goto endjob;
}
#define BLOCK_IOTUNE_ASSIGN(name, var) \
@ -17736,13 +17741,15 @@ qemuDomainGetBlockIoTune(virDomainPtr dom,
BLOCK_IOTUNE_ASSIGN(SIZE_IOPS_SEC, size_iops_sec);
/* NB: Cannot use macro since this is a STRING not a ULLONG */
if (*nparams < maxparams &&
virTypedParameterAssign(&params[(*nparams)++],
VIR_DOMAIN_BLOCK_IOTUNE_GROUP_NAME,
VIR_TYPED_PARAM_STRING,
reply.group_name) < 0)
goto endjob;
if (*nparams < maxparams) {
if (virTypedParameterAssign(&params[(*nparams)++],
VIR_DOMAIN_BLOCK_IOTUNE_GROUP_NAME,
VIR_TYPED_PARAM_STRING,
reply.group_name) < 0)
goto endjob;
reply.group_name = NULL;
}
BLOCK_IOTUNE_ASSIGN(TOTAL_BYTES_SEC_MAX_LENGTH, total_bytes_sec_max_length);
BLOCK_IOTUNE_ASSIGN(READ_BYTES_SEC_MAX_LENGTH, read_bytes_sec_max_length);
@ -17759,6 +17766,7 @@ qemuDomainGetBlockIoTune(virDomainPtr dom,
qemuDomainObjEndJob(driver, vm);
cleanup:
VIR_FREE(reply.group_name);
VIR_FREE(device);
virDomainObjEndAPI(&vm);
return ret;