86 lines
2.5 KiB
Diff
86 lines
2.5 KiB
Diff
|
From f06f903d5cb3c14853a7213b6a70c078380b7a62 Mon Sep 17 00:00:00 2001
|
||
|
|
Message-Id: <f06f903d5cb3c14853a7213b6a70c078380b7a62@dist-git>
|
||
|
|
From: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Date: Fri, 24 Jan 2020 15:05:50 +0100
|
||
|
|
Subject: [PATCH] qemu_conf: Avoid dereferencing NULL in
|
||
|
|
virQEMUDriverGetHost{NUMACaps, CPU}
|
||
|
|
|
||
|
|
When fixing [1] I've ran attached reproducer and had it spawn
|
||
|
|
1024 threads and query capabilities XML in each one of them. This
|
||
|
|
lead libvirtd to hit the RLIMIT_NOFILE limit which was kind of
|
||
|
|
expected. What wasn't expected was a subsequent segfault. It
|
||
|
|
happened because virCPUProbeHost failed and returned NULL. We've
|
||
|
|
taken the NULL and passed it to virCapabilitiesHostNUMARef()
|
||
|
|
which dereferenced it. Code inspection showed the same flas in
|
||
|
|
virQEMUDriverGetHostNUMACaps(), so I'm fixing both places.
|
||
|
|
|
||
|
|
1: https://bugzilla.redhat.com/show_bug.cgi?id=1791790
|
||
|
|
|
||
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
|
||
|
|
(cherry picked from commit cc361a34c53210d682dbc5f2d506b4a23b71e399)
|
||
|
|
|
||
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1794691
|
||
|
|
|
||
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Message-Id: <5de22b27463cd2803b3910d7ef45a0e4bc08ad47.1579874719.git.mprivozn@redhat.com>
|
||
|
|
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
||
|
|
---
|
||
|
|
src/qemu/qemu_conf.c | 18 ++++++++++++++----
|
||
|
|
1 file changed, 14 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
|
||
|
|
index 3d2f0e7bbb..e33ef4895e 100644
|
||
|
|
--- a/src/qemu/qemu_conf.c
|
||
|
|
+++ b/src/qemu/qemu_conf.c
|
||
|
|
@@ -1201,32 +1201,42 @@ virQEMUDriverCreateXMLConf(virQEMUDriverPtr driver,
|
||
|
|
virCapsHostNUMAPtr
|
||
|
|
virQEMUDriverGetHostNUMACaps(virQEMUDriverPtr driver)
|
||
|
|
{
|
||
|
|
+ virCapsHostNUMAPtr hostnuma;
|
||
|
|
+
|
||
|
|
qemuDriverLock(driver);
|
||
|
|
|
||
|
|
if (!driver->hostnuma)
|
||
|
|
driver->hostnuma = virCapabilitiesHostNUMANewHost();
|
||
|
|
|
||
|
|
+ hostnuma = driver->hostnuma;
|
||
|
|
+
|
||
|
|
qemuDriverUnlock(driver);
|
||
|
|
|
||
|
|
- virCapabilitiesHostNUMARef(driver->hostnuma);
|
||
|
|
+ if (hostnuma)
|
||
|
|
+ virCapabilitiesHostNUMARef(hostnuma);
|
||
|
|
|
||
|
|
- return driver->hostnuma;
|
||
|
|
+ return hostnuma;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
virCPUDefPtr
|
||
|
|
virQEMUDriverGetHostCPU(virQEMUDriverPtr driver)
|
||
|
|
{
|
||
|
|
+ virCPUDefPtr hostcpu;
|
||
|
|
+
|
||
|
|
qemuDriverLock(driver);
|
||
|
|
|
||
|
|
if (!driver->hostcpu)
|
||
|
|
driver->hostcpu = virCPUProbeHost(virArchFromHost());
|
||
|
|
|
||
|
|
+ hostcpu = driver->hostcpu;
|
||
|
|
+
|
||
|
|
qemuDriverUnlock(driver);
|
||
|
|
|
||
|
|
- virCPUDefRef(driver->hostcpu);
|
||
|
|
+ if (hostcpu)
|
||
|
|
+ virCPUDefRef(hostcpu);
|
||
|
|
|
||
|
|
- return driver->hostcpu;
|
||
|
|
+ return hostcpu;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
2.25.0
|
||
|
|
|