59 lines
2.2 KiB
Diff
59 lines
2.2 KiB
Diff
From 86bc1ce2b3518c375eaba5d838709af8f52c4165 Mon Sep 17 00:00:00 2001
|
|
From: Peter Krempa <pkrempa@redhat.com>
|
|
Date: Mon, 12 Apr 2021 17:24:22 +0200
|
|
Subject: [PATCH 057/108] qemuBlockJobProcessEventCompletedPull: Avoid dangling
|
|
pointer after blockpull
|
|
|
|
When doing a full block pull job (base == NULL) and the config XML
|
|
contains a compatible disk, the completer function would leave a
|
|
dangling pointer in 'cfgdisk->src->backingStore' as cfgdisk->src would
|
|
be set to the value of 'cfgbase' which was always set to
|
|
'cfgdisk->src->backingStore'.
|
|
|
|
This is wrong though since for the live definition XML we set the
|
|
respective counterpart to 'job->data.pull.base' which is NULL in the
|
|
above scenario.
|
|
|
|
This leads to a invalid pointer read when saving the config XML and may
|
|
end up in a crash.
|
|
|
|
Resolve it by setting 'cfgbase' only when 'job->data.pull.base' is
|
|
non-NULL.
|
|
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1946918
|
|
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
|
|
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
|
|
(cherry picked from commit 46e748aa02cbd5923fa4b500352f528de35dc665)
|
|
---
|
|
src/qemu/qemu_blockjob.c | 7 +++----
|
|
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c
|
|
index 21a043d369..049afdd71a 100644
|
|
--- a/src/qemu/qemu_blockjob.c
|
|
+++ b/src/qemu/qemu_blockjob.c
|
|
@@ -971,10 +971,7 @@ qemuBlockJobProcessEventCompletedPull(virQEMUDriverPtr driver,
|
|
if (!job->disk)
|
|
return;
|
|
|
|
- if ((cfgdisk = qemuBlockJobGetConfigDisk(vm, job->disk, job->data.pull.base)))
|
|
- cfgbase = cfgdisk->src->backingStore;
|
|
-
|
|
- if (!cfgdisk)
|
|
+ if (!(cfgdisk = qemuBlockJobGetConfigDisk(vm, job->disk, job->data.pull.base)))
|
|
qemuBlockJobClearConfigChain(vm, job->disk);
|
|
|
|
/* when pulling if 'base' is right below the top image we don't have to modify it */
|
|
@@ -982,6 +979,8 @@ qemuBlockJobProcessEventCompletedPull(virQEMUDriverPtr driver,
|
|
return;
|
|
|
|
if (job->data.pull.base) {
|
|
+ if (cfgdisk)
|
|
+ cfgbase = cfgdisk->src->backingStore;
|
|
for (n = job->disk->src->backingStore; n && n != job->data.pull.base; n = n->backingStore) {
|
|
/* find the image on top of 'base' */
|
|
|
|
--
|
|
2.33.0
|
|
|