External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-11 15:27:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

do not unref obj in qemuDomainObjExitMonitor*

Browse Source 
Steps to reproduce this bug:
# cat test.sh
  #! /bin/bash -x
  virsh start domain
  sleep 5
  virsh qemu-monitor-command domain 'cpu_set 2 online' --hmp
# while true; do ./test.sh ; done

Then libvirtd will crash.

The reason is that:
we add a reference of obj when we open the monitor. We will reduce this
reference when we free the monitor.

If the reference of monitor is 0, we will free monitor automatically and
the reference of obj is reduced.

But in the function qemuDomainObjExitMonitorWithDriver(), we reduce this
reference again when the reference of monitor is 0.

It will cause the obj be freed in the function qemuDomainObjEndJob().

Then we start the domain again, and libvirtd will crash in the function
virDomainObjListSearchName(), because we pass a null pointer(obj->def->name)
to strcmp().

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
This commit is contained in:
Wen Congyang 2011-03-16 17:01:23 +08:00 committed by Laine Stump
parent e2aec53b97
commit d5df67be3c
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/qemu/qemu_domain.c
View File

@ -588,7 +588,6 @@ void qemuDomainObjExitMonitor(virDomainObjPtr obj)
virDomainObjLock(obj);
if (refs == 0) {
virDomainObjUnref(obj);
priv->mon = NULL;
}
}
@ -634,7 +633,6 @@ void qemuDomainObjExitMonitorWithDriver(struct qemud_driver *driver,
virDomainObjLock(obj);
if (refs == 0) {
virDomainObjUnref(obj);
priv->mon = NULL;
}
}