[libvirt] [PATCH] qemu_driver: avoid NULL dereference

[Jim Meyering]

The following theoretical possibility of a NULL dereference
has been in the code since April 1
(commit 6e41f30efcac08e50b21d9c943d6d27e90555951).
It's theoretical, because if that vm = NULL
statement is ever executed, the very next one,
calling virDomainObjUnlock would dereference that now-NULL "vm".
Hence, I think we can conclude the vm = NULL statement is
effectively dead code.  That conclusion is in line with the
"should" in the preceding comment.

At first, it seemed like it would deserve an sa_assert.
But without the assert, "n_refs" would be unused,
(so this first patch is solely FYI -- not proposed)
I solved it differently in the 2nd patch.

>From 524aec3ebed613f86b64584d2f461f4a18d2e618 Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering at redhat.com>
Date: Mon, 17 May 2010 12:10:52 +0200
Subject: [PATCH] qemu_driver: avoid NULL dereference

* src/qemu/qemu_driver.c (qemudDomainStart): Rather than trying to
handle a "can't happen" case, simply sa_assert that it won't happen.
---
 src/qemu/qemu_driver.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 8f69b5a..819ea17 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6489,8 +6489,9 @@ static int qemudDomainStart(virDomainPtr dom) {
          * We should still have a reference left to vm but
          * one should check for 0 anyway
          */
-        if (qemuDomainObjEndJob(vm) == 0)
-            vm = NULL;
+        int n_refs = qemuDomainObjEndJob(vm);
+        sa_assert (n_refs);
+
         virDomainObjUnlock(vm);
         qemuDriverUnlock(driver);
         ret = qemudDomainRestore(dom->conn, managed_save);
--
1.7.1.250.g7d1e8



>From f88969b986a1c88985671c9d6fa9cb1dc449ed74 Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering at redhat.com>
Date: Mon, 17 May 2010 12:10:52 +0200
Subject: [PATCH] qemu_driver: avoid NULL dereference

* src/qemu/qemu_driver.c (qemudDomainStart): After setting vm to NULL,
goto cleanup, rather than dereferencing the NULL pointer.
---
 src/qemu/qemu_driver.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 8f69b5a..3559e36 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6489,8 +6489,11 @@ static int qemudDomainStart(virDomainPtr dom) {
          * We should still have a reference left to vm but
          * one should check for 0 anyway
          */
-        if (qemuDomainObjEndJob(vm) == 0)
+        if (qemuDomainObjEndJob(vm) = 0) {
             vm = NULL;
+            goto cleanup;
+        }
+
         virDomainObjUnlock(vm);
         qemuDriverUnlock(driver);
         ret = qemudDomainRestore(dom->conn, managed_save);
--
1.7.1.250.g7d1e8