Bug introduced in commit 35abced. On an inactive domain,
$ virsh snapshot-create-as dom snap
$ virsh snapshot-create dom
$ virsh snapshot-create dom
$ virsh snapshot-delete --children dom snap
could crash libvirtd, due to a use-after-free that results
when the callback freed the current element in the iteration.
* src/conf/domain_conf.c (virDomainSnapshotForEachChild)
(virDomainSnapshotActOnDescendant): Allow iteration to delete
current child.
---
src/conf/domain_conf.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index f8d0a4c..da00830 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -13325,8 +13325,9 @@ virDomainSnapshotForEachChild(virDomainSnapshotObjPtr snapshot,
virDomainSnapshotObjPtr child = snapshot->first_child;
while (child) {
+ virDomainSnapshotObjPtr next = child->sibling;
(iter)(child, child->def->name, data);
- child = child->sibling;
+ child = next;
}
return snapshot->nchildren;
@@ -13346,10 +13347,10 @@ virDomainSnapshotActOnDescendant(void *payload,
virDomainSnapshotObjPtr obj = payload;
struct snapshot_act_on_descendant *curr = data;
- (curr->iter)(payload, name, curr->data);
curr->number += 1 + virDomainSnapshotForEachDescendant(obj,
curr->iter,
curr->data);
+ (curr->iter)(payload, name, curr->data);
}
/* Run iter(data) on all descendants of snapshot, while ignoring all
--
1.7.7.6
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list