[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] Avoid use of free'd memory in auto destroy callback



On 01/23/2013 10:25 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange redhat com>
> 
> The autodestroy callback code has the following function
> called from a hash iterator
> 
>   qemuDriverCloseCallbackRun(void *payload,
>                              const void *name,
>                              void *opaque)
>   {
>     ...
>     char *uuidstr = name
>     ...
> 
>     dom = closeDef->cb(data->driver, dom, data->conn);
>     if (dom)
>         virObjectUnlock(dom);
> 
>     virHashRemoveEntry(data->driver->closeCallbacks, uuidstr);
>   }
> 
> The closeDef->cb function may well cause the current callback
> to be removed, if it shuts down 'dom'. As such the use of
> 'uuidstr' in virHashRemoveEntry is accessing free'd memory.
> We must make a copy of the uuid str before invoking the
> callback to be safe.
> 
> Signed-off-by: Daniel P. Berrange <berrange redhat com>
> ---
>  src/qemu/qemu_conf.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)

ACK.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]