At 05/11/2011 07:12 PM, Markus Groß Write:
> When modifying the disk devices of a live domain and the domain
> configuration, the function qemuDomainAttachDeviceConfig
> first sets dev->data->disk to NULL. Later qemuDomainAttachDeviceLive
> accesses dev->data.disk and causes a segfault.
> ---
> src/qemu/qemu_driver.c | 14 ++++++++++----
> 1 files changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
> index b8d9c92..55e6314 100644
> --- a/src/qemu/qemu_driver.c
> +++ b/src/qemu/qemu_driver.c
> @@ -4278,12 +4278,13 @@ qemuDomainModifyDeviceFlags(virDomainPtr dom, const char *xml,
> "%s", _("cannot modify device on transient domain"));
> goto endjob;
> }
> - dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
> - VIR_DOMAIN_XML_INACTIVE);
> - if (dev == NULL)
> - goto endjob;
>
> if (flags & VIR_DOMAIN_DEVICE_MODIFY_CONFIG) {
> + dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
> + VIR_DOMAIN_XML_INACTIVE);
> + if (dev == NULL)
> + goto endjob;
> +
> /* Make a copy for updated domain. */
> vmdef = virDomainObjCopyPersistentDef(driver->caps, vm);
> if (!vmdef)
> @@ -4307,6 +4308,11 @@ qemuDomainModifyDeviceFlags(virDomainPtr dom, const char *xml,
> ret = 0;
>
> if (!ret && (flags & VIR_DOMAIN_DEVICE_MODIFY_LIVE)) {
We should free dev before calling virDomainDeviceDefParse().
> + dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
> + VIR_DOMAIN_XML_INACTIVE);
> + if (dev == NULL)
> + goto endjob;
> +
> switch (action) {
> case QEMU_DEVICE_ATTACH:
> ret = qemuDomainAttachDeviceLive(vm, dev, dom);
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list