On 12/20/2013 02:36 PM, Jiri Denemark wrote: > https://bugzilla.redhat.com/show_bug.cgi?id=1043069 > > When virDomainDetachDeviceFlags is called concurrently to > virDomainBlockStats: libvirtd may crash because qemuDomainBlockStats > finds a disk in vm->def before getting a job on a domain and uses the > disk pointer after getting the job. However, the domain in unlocked > while waiting on a job condition and thus data behind the disk pointer > may disappear. This happens when thread 1 runs > virDomainDetachDeviceFlags and enters monitor to actually remove the > disk. Then another thread starts running virDomainBlockStats, finds the > disk in vm->def, and while it's waiting on the job condition (owned by > the first thread), the first thread finishes the disk removal. When the > second thread gets the job, the memory pointed to be the disk pointer is > already gone. > > That said, every API that is going to begin a job should do that before > fetching data from vm->def. Bummer, we'll need a CVE for this. It's been present since at least 0.9.x days. ACK. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list