[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] Avoid use of free'd memory in auto destroy callback



On Wed, Jan 23, 2013 at 05:25:32PM +0000, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange redhat com>
> 
> The autodestroy callback code has the following function
> called from a hash iterator
> 
>   qemuDriverCloseCallbackRun(void *payload,
>                              const void *name,
>                              void *opaque)
>   {
>     ...
>     char *uuidstr = name
>     ...
> 
>     dom = closeDef->cb(data->driver, dom, data->conn);
>     if (dom)
>         virObjectUnlock(dom);
> 
>     virHashRemoveEntry(data->driver->closeCallbacks, uuidstr);
>   }
> 
> The closeDef->cb function may well cause the current callback
> to be removed, if it shuts down 'dom'. As such the use of
> 'uuidstr' in virHashRemoveEntry is accessing free'd memory.
> We must make a copy of the uuid str before invoking the
> callback to be safe.
> 
> Signed-off-by: Daniel P. Berrange <berrange redhat com>
> ---
>  src/qemu/qemu_conf.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
> index b21392e..ee48333 100644
> --- a/src/qemu/qemu_conf.c
> +++ b/src/qemu/qemu_conf.c
> @@ -510,20 +510,25 @@ qemuDriverCloseCallbackRun(void *payload,
>  {
>      struct qemuDriverCloseCallbackData *data = opaque;
>      qemuDriverCloseDefPtr closeDef = payload;
> -    const char *uuidstr = name;
>      unsigned char uuid[VIR_UUID_BUFLEN];
> +    char uuidstr[VIR_UUID_STRING_BUFLEN];
>      virDomainObjPtr dom;
>  
>      VIR_DEBUG("conn=%p, thisconn=%p, uuid=%s, cb=%p",
> -              closeDef->conn, data->conn, uuidstr, closeDef->cb);
> +              closeDef->conn, data->conn, (const char *)name, closeDef->cb);
>  
>      if (data->conn != closeDef->conn || !closeDef->cb)
>          return;
>  
> -    if (virUUIDParse(uuidstr, uuid) < 0) {
> -        VIR_WARN("Failed to parse %s", uuidstr);
> +    if (virUUIDParse(name, uuid) < 0) {
> +        VIR_WARN("Failed to parse %s", (const char *)name);
>          return;
>      }
> +    /* We need to reformat uuidstr, because closeDef->cb
> +     * might cause the current hash entry to be removed,
> +     * which means 'name' will have been free()d
> +     */
> +    virUUIDFormat(uuid, uuidstr);
>  
>      if (!(dom = virDomainFindByUUID(&data->driver->domains, uuid))) {
>          VIR_DEBUG("No domain object with UUID %s", uuidstr);
> -- 
> 1.8.1

Looks good, ACK.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]