[PATCH/RFC] remote driver uses already freed dom

[Guido Günther <agx@xxxxxxxxxxx>]

Hi,
when trying to undefine a running qemu domain the domain name gets
corrupted:

$  ./virsh undefine system1
Name: /�em1
libvir: QEMU error /�em1: internal error cannot delete active domain
error: Failed to undefine domain system1

the reaseon is that in qemud/remote.c the domain is freed after failure:

remoteDispatchDomainUndefine (struct qemud_server *server ATTRIBUTE_UNUSED,
...
{
...
    if (virDomainUndefine (dom) == -1) {
        virDomainFree(dom);
        return -1;
    }
...
}

This doesn't work out since remoteDispatchClient accesses the dom
structure that was stored in the virtErrorPtr structure to report the
error back to the client (This is just an example and hits any error
path of functions in remote_dispatch_proc_switch.h that reference dom).
There are two possible solutions I see: move the virtDomainFree down to
the bottom of remoteDispatchClient or deep copy the dom structure in
virDefaultErrorFunc. A patch for the later is attached since similar
things seem to be possible in other drivers too.
 -- Guido

--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list