mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-02-02 09:55:18 +00:00
d5df67be3c
Steps to reproduce this bug: # cat test.sh #! /bin/bash -x virsh start domain sleep 5 virsh qemu-monitor-command domain 'cpu_set 2 online' --hmp # while true; do ./test.sh ; done Then libvirtd will crash. The reason is that: we add a reference of obj when we open the monitor. We will reduce this reference when we free the monitor. If the reference of monitor is 0, we will free monitor automatically and the reference of obj is reduced. But in the function qemuDomainObjExitMonitorWithDriver(), we reduce this reference again when the reference of monitor is 0. It will cause the obj be freed in the function qemuDomainObjEndJob(). Then we start the domain again, and libvirtd will crash in the function virDomainObjListSearchName(), because we pass a null pointer(obj->def->name) to strcmp(). Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
LibVirt : simple API for virtualization
Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.
Daniel Veillard <veillard@redhat.com>