45 lines
1.8 KiB
Diff
45 lines
1.8 KiB
Diff
From b794a0e4e657defe9a491eb20adf61eafa443ca3 Mon Sep 17 00:00:00 2001
|
|
Message-Id: <b794a0e4e657defe9a491eb20adf61eafa443ca3@dist-git>
|
|
From: Peter Krempa <pkrempa@redhat.com>
|
|
Date: Wed, 28 Jul 2021 14:59:01 +0200
|
|
Subject: [PATCH] storage_driver: Unlock object on ACL fail in
|
|
storagePoolLookupByTargetPath
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
'virStoragePoolObjListSearch' returns a locked and refed object, thus we
|
|
must release it on ACL permission failure.
|
|
|
|
Fixes: 7aa0e8c0cb8
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318
|
|
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
|
|
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
(cherry picked from commit 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87)
|
|
CVE-2021-3667
|
|
Message-Id: <a398ad51fa2db3697d91711134d28d3e07536bfc.1627476632.git.pkrempa@redhat.com>
|
|
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
---
|
|
src/storage/storage_driver.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
|
|
index 0bb116cf08..4f0b8c1218 100644
|
|
--- a/src/storage/storage_driver.c
|
|
+++ b/src/storage/storage_driver.c
|
|
@@ -1733,8 +1733,10 @@ storagePoolLookupByTargetPath(virConnectPtr conn,
|
|
storagePoolLookupByTargetPathCallback,
|
|
cleanpath))) {
|
|
def = virStoragePoolObjGetDef(obj);
|
|
- if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0)
|
|
+ if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) {
|
|
+ virStoragePoolObjEndAPI(&obj);
|
|
return NULL;
|
|
+ }
|
|
|
|
pool = virGetStoragePool(conn, def->name, def->uuid, NULL, NULL);
|
|
virStoragePoolObjEndAPI(&obj);
|
|
--
|
|
2.32.0
|
|
|