|
 |
9119d9 |
From 64d3b1546dc6c96afd2d06403f0c93308e0b34b6 Mon Sep 17 00:00:00 2001
|
|
|
9119d9 |
Message-Id: <64d3b1546dc6c96afd2d06403f0c93308e0b34b6@dist-git>
|
|
|
9119d9 |
From: Peter Krempa <pkrempa@redhat.com>
|
|
|
9119d9 |
Date: Tue, 23 Dec 2014 15:54:35 -0700
|
|
|
9119d9 |
Subject: [PATCH] qemu: migration: Unlock vm on failed ACL check in protocol v2
|
|
|
9119d9 |
APIs
|
|
|
9119d9 |
|
|
|
9119d9 |
CVE-2014-8136 (RHEL 7.0.z, 7.1)
|
|
|
9119d9 |
|
|
|
9119d9 |
Avoid leaving the domain locked on a failed ACL check in
|
|
|
9119d9 |
qemuDomainMigratePerform() and qemuDomainMigrateFinish2().
|
|
|
9119d9 |
|
|
|
9119d9 |
Introduced in commit abf75aea247e (Add ACL checks into the QEMU driver).
|
|
|
9119d9 |
|
|
|
9119d9 |
(cherry picked from commit 2bdcd29c713dfedd813c89f56ae98f6f3898313d)
|
|
|
9119d9 |
|
|
|
9119d9 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
9119d9 |
---
|
|
|
9119d9 |
src/qemu/qemu_driver.c | 8 ++++++--
|
|
|
9119d9 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
9119d9 |
|
|
|
9119d9 |
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
|
|
9119d9 |
index 619f2d6..1b08cc4 100644
|
|
|
9119d9 |
--- a/src/qemu/qemu_driver.c
|
|
|
9119d9 |
+++ b/src/qemu/qemu_driver.c
|
|
|
9119d9 |
@@ -11343,8 +11343,10 @@ qemuDomainMigratePerform(virDomainPtr dom,
|
|
|
9119d9 |
if (!(vm = qemuDomObjFromDomain(dom)))
|
|
|
9119d9 |
goto cleanup;
|
|
|
9119d9 |
|
|
|
9119d9 |
- if (virDomainMigratePerformEnsureACL(dom->conn, vm->def) < 0)
|
|
|
9119d9 |
+ if (virDomainMigratePerformEnsureACL(dom->conn, vm->def) < 0) {
|
|
|
9119d9 |
+ virObjectUnlock(vm);
|
|
|
9119d9 |
goto cleanup;
|
|
|
9119d9 |
+ }
|
|
|
9119d9 |
|
|
|
9119d9 |
if (flags & VIR_MIGRATE_PEER2PEER) {
|
|
|
9119d9 |
dconnuri = uri;
|
|
|
9119d9 |
@@ -11391,8 +11393,10 @@ qemuDomainMigrateFinish2(virConnectPtr dconn,
|
|
|
9119d9 |
goto cleanup;
|
|
|
9119d9 |
}
|
|
|
9119d9 |
|
|
|
9119d9 |
- if (virDomainMigrateFinish2EnsureACL(dconn, vm->def) < 0)
|
|
|
9119d9 |
+ if (virDomainMigrateFinish2EnsureACL(dconn, vm->def) < 0) {
|
|
|
9119d9 |
+ virObjectUnlock(vm);
|
|
|
9119d9 |
goto cleanup;
|
|
|
9119d9 |
+ }
|
|
|
9119d9 |
|
|
|
9119d9 |
/* Do not use cookies in v2 protocol, since the cookie
|
|
|
9119d9 |
* length was not sufficiently large, causing failures
|
|
|
9119d9 |
--
|
|
|
9119d9 |
2.2.1
|
|
|
9119d9 |
|