mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 19:41:16 +00:00
virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef
https://bugzilla.redhat.com/show_bug.cgi?id=1686927 When trying to create a nwfilter binding via nwfilterBindingCreateXML() we may encounter a crash. The sequence of functions called is as follows: 1) nwfilterBindingCreateXML() parses the XML and calls virNWFilterBindingObjListAdd() which calls virNWFilterBindingObjListAddLocked() 2) Here, @binding is not found because binding->remove is set. 3) Therefore, controls continue with creating new @binding, setting its def to the one from 1) and adding it to the hash table. 4) This fails, because the binding is still in the hash table (duplicate key is detected). 5) The control jumps to 'error' label where virNWFilterBindingObjEndAPI() is called which frees the binding definition passed. 6) Error is propagated to the caller, which calls virNWFilterBindingDefFree() over the definition again. The solution is to unset binding->def in case of failure so it's not freed in step 5). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
parent
971872ca27
commit
8c08a99745
@ -88,6 +88,16 @@ virNWFilterBindingObjSetDef(virNWFilterBindingObjPtr obj,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
virNWFilterBindingDefPtr
|
||||||
|
virNWFilterBindingObjStealDef(virNWFilterBindingObjPtr obj)
|
||||||
|
{
|
||||||
|
virNWFilterBindingDefPtr def;
|
||||||
|
|
||||||
|
VIR_STEAL_PTR(def, obj->def);
|
||||||
|
return def;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
bool
|
bool
|
||||||
virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj)
|
virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj)
|
||||||
{
|
{
|
||||||
|
@ -39,6 +39,9 @@ void
|
|||||||
virNWFilterBindingObjSetDef(virNWFilterBindingObjPtr obj,
|
virNWFilterBindingObjSetDef(virNWFilterBindingObjPtr obj,
|
||||||
virNWFilterBindingDefPtr def);
|
virNWFilterBindingDefPtr def);
|
||||||
|
|
||||||
|
virNWFilterBindingDefPtr
|
||||||
|
virNWFilterBindingObjStealDef(virNWFilterBindingObjPtr obj);
|
||||||
|
|
||||||
bool
|
bool
|
||||||
virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj);
|
virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj);
|
||||||
|
|
||||||
|
@ -167,6 +167,7 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingObjListPtr bindings,
|
|||||||
virNWFilterBindingDefPtr def)
|
virNWFilterBindingDefPtr def)
|
||||||
{
|
{
|
||||||
virNWFilterBindingObjPtr binding;
|
virNWFilterBindingObjPtr binding;
|
||||||
|
bool stealDef = false;
|
||||||
|
|
||||||
/* See if a binding with matching portdev already exists */
|
/* See if a binding with matching portdev already exists */
|
||||||
if ((binding = virNWFilterBindingObjListFindByPortDevLocked(
|
if ((binding = virNWFilterBindingObjListFindByPortDevLocked(
|
||||||
@ -181,6 +182,7 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingObjListPtr bindings,
|
|||||||
goto error;
|
goto error;
|
||||||
|
|
||||||
virNWFilterBindingObjSetDef(binding, def);
|
virNWFilterBindingObjSetDef(binding, def);
|
||||||
|
stealDef = true;
|
||||||
|
|
||||||
if (virNWFilterBindingObjListAddObjLocked(bindings, binding) < 0)
|
if (virNWFilterBindingObjListAddObjLocked(bindings, binding) < 0)
|
||||||
goto error;
|
goto error;
|
||||||
@ -188,6 +190,8 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingObjListPtr bindings,
|
|||||||
return binding;
|
return binding;
|
||||||
|
|
||||||
error:
|
error:
|
||||||
|
if (stealDef)
|
||||||
|
virNWFilterBindingObjStealDef(binding);
|
||||||
virNWFilterBindingObjEndAPI(&binding);
|
virNWFilterBindingObjEndAPI(&binding);
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
@ -1101,6 +1101,7 @@ virNWFilterBindingObjParseFile;
|
|||||||
virNWFilterBindingObjSave;
|
virNWFilterBindingObjSave;
|
||||||
virNWFilterBindingObjSetDef;
|
virNWFilterBindingObjSetDef;
|
||||||
virNWFilterBindingObjSetRemoving;
|
virNWFilterBindingObjSetRemoving;
|
||||||
|
virNWFilterBindingObjStealDef;
|
||||||
|
|
||||||
|
|
||||||
# conf/virnwfilterbindingobjlist.h
|
# conf/virnwfilterbindingobjlist.h
|
||||||
|
Loading…
Reference in New Issue
Block a user