|
 |
51d9a2 |
From 51be47223840c917b0a98782c214d6b8e031b658 Mon Sep 17 00:00:00 2001
|
|
|
51d9a2 |
Message-Id: <51be47223840c917b0a98782c214d6b8e031b658@dist-git>
|
|
|
51d9a2 |
From: Jiri Denemark <jdenemar@redhat.com>
|
|
|
51d9a2 |
Date: Thu, 2 Aug 2018 16:56:02 +0200
|
|
|
51d9a2 |
Subject: [PATCH] qemu_migration: Avoid writing to freed memory
|
|
|
51d9a2 |
MIME-Version: 1.0
|
|
|
51d9a2 |
Content-Type: text/plain; charset=UTF-8
|
|
|
51d9a2 |
Content-Transfer-Encoding: 8bit
|
|
|
51d9a2 |
|
|
|
51d9a2 |
When a domain is killed on the source host while it is being migrated
|
|
|
51d9a2 |
and libvirtd is waiting for the migration to finish (waiting for the
|
|
|
51d9a2 |
domain condition in qemuMigrationSrcWaitForCompletion), the run-time
|
|
|
51d9a2 |
state including priv->job.current may already be freed once
|
|
|
51d9a2 |
virDomainObjWait returns with -1. Thus the priv->job.current pointer
|
|
|
51d9a2 |
cached in jobInfo is no longer valid and setting jobInfo->status may
|
|
|
51d9a2 |
crash the daemon.
|
|
|
51d9a2 |
|
|
|
51d9a2 |
https://bugzilla.redhat.com/show_bug.cgi?id=1593137
|
|
|
51d9a2 |
|
|
|
51d9a2 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
51d9a2 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
51d9a2 |
(cherry picked from commit dddcb601ebf97ef222a03bb27b2357e831e8a0cc)
|
|
|
51d9a2 |
|
|
|
51d9a2 |
https://bugzilla.redhat.com/show_bug.cgi?id=1615854
|
|
|
51d9a2 |
|
|
|
51d9a2 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
51d9a2 |
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
|
51d9a2 |
---
|
|
|
51d9a2 |
src/qemu/qemu_migration.c | 3 ++-
|
|
|
51d9a2 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
51d9a2 |
|
|
|
51d9a2 |
diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
|
|
|
51d9a2 |
index 435cd174af..825a9d399b 100644
|
|
|
51d9a2 |
--- a/src/qemu/qemu_migration.c
|
|
|
51d9a2 |
+++ b/src/qemu/qemu_migration.c
|
|
|
51d9a2 |
@@ -1584,7 +1584,8 @@ qemuMigrationSrcWaitForCompletion(virQEMUDriverPtr driver,
|
|
|
51d9a2 |
|
|
|
51d9a2 |
if (events) {
|
|
|
51d9a2 |
if (virDomainObjWait(vm) < 0) {
|
|
|
51d9a2 |
- jobInfo->status = QEMU_DOMAIN_JOB_STATUS_FAILED;
|
|
|
51d9a2 |
+ if (virDomainObjIsActive(vm))
|
|
|
51d9a2 |
+ jobInfo->status = QEMU_DOMAIN_JOB_STATUS_FAILED;
|
|
|
51d9a2 |
return -2;
|
|
|
51d9a2 |
}
|
|
|
51d9a2 |
} else {
|
|
|
51d9a2 |
--
|
|
|
51d9a2 |
2.18.0
|
|
|
51d9a2 |
|