[PATCH v2] qemu: Fix crash in qemucapsprobe

[Jiri Denemark <jdenemar@xxxxxxxxxx>]

The qemucapsprobe helper calls virQEMUCapsNewForBinaryInternal with
caps == NULL, causing the following crash:

    Program received signal SIGSEGV, Segmentation fault.
    #0  0x00007ffff788775f in virQEMUCapsInitHostCPUModel
        (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at
        src/qemu/qemu_capabilities.c:2969
    #1  0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal
        (caps=caps@entry=0x0, binary=<optimized out>,
        libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0,
        runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295,
        qmpOnly=true) at src/qemu/qemu_capabilities.c:4039
    #2  0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at
        tests/qemucapsprobe.c:73

Caused by v2.2.0-182-g68c7011.

Signed-off-by: Jiri Denemark <jdenemar@xxxxxxxxxx>
---
 src/qemu/qemu_capabilities.c | 15 +++++++++------
 src/qemu/qemu_capspriv.h     |  2 +-
 tests/qemuxml2argvtest.c     |  2 +-
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index 4d859c4..cc8ec58 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -2962,14 +2962,17 @@ virQEMUCapsCPUFilterFeatures(const char *name,
 
 void
 virQEMUCapsInitHostCPUModel(virQEMUCapsPtr qemuCaps,
-                            virCapsHostPtr host)
+                            virCapsPtr caps)
 {
     virCPUDefPtr cpu = NULL;
 
-    if (!virQEMUCapsGuestIsNative(host->arch, qemuCaps->arch))
+    if (!caps)
+        return;
+
+    if (!virQEMUCapsGuestIsNative(caps->host.arch, qemuCaps->arch))
         goto error;
 
-    if (host->cpu && host->cpu->model) {
+    if (caps->host.cpu && caps->host.cpu->model) {
         if (VIR_ALLOC(cpu) < 0)
             goto error;
 
@@ -2978,7 +2981,7 @@ virQEMUCapsInitHostCPUModel(virQEMUCapsPtr qemuCaps,
         cpu->mode = VIR_CPU_MODE_CUSTOM;
         cpu->match = VIR_CPU_MATCH_EXACT;
 
-        if (virCPUDefCopyModelFilter(cpu, host->cpu, true,
+        if (virCPUDefCopyModelFilter(cpu, caps->host.cpu, true,
                                      virQEMUCapsCPUFilterFeatures, NULL) < 0)
             goto error;
     }
@@ -3248,7 +3251,7 @@ virQEMUCapsLoadCache(virCapsPtr caps,
     }
     VIR_FREE(nodes);
 
-    virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host);
+    virQEMUCapsInitHostCPUModel(qemuCaps, caps);
 
     ret = 0;
  cleanup:
@@ -4036,7 +4039,7 @@ virQEMUCapsNewForBinaryInternal(virCapsPtr caps,
             virQEMUCapsRememberCached(qemuCaps, cacheDir) < 0)
             goto error;
 
-        virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host);
+        virQEMUCapsInitHostCPUModel(qemuCaps, caps);
     }
 
  cleanup:
diff --git a/src/qemu/qemu_capspriv.h b/src/qemu/qemu_capspriv.h
index 22c5a8a..fab2c2a 100644
--- a/src/qemu/qemu_capspriv.h
+++ b/src/qemu/qemu_capspriv.h
@@ -64,5 +64,5 @@ virQEMUCapsSetArch(virQEMUCapsPtr qemuCaps,
 
 void
 virQEMUCapsInitHostCPUModel(virQEMUCapsPtr qemuCaps,
-                            virCapsHostPtr host);
+                            virCapsPtr caps);
 #endif
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 0af71a1..4b9ecb8 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -357,7 +357,7 @@ testUpdateQEMUCaps(const struct testInfo *info,
     if (testAddCPUModels(info->qemuCaps, info->skipLegacyCPUs) < 0)
         goto cleanup;
 
-    virQEMUCapsInitHostCPUModel(info->qemuCaps, &caps->host);
+    virQEMUCapsInitHostCPUModel(info->qemuCaps, caps);
 
     virQEMUCapsFilterByMachineType(info->qemuCaps, vm->def->os.machine);
 
-- 
2.10.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list