[libvirt] [PATCH 1/5] qemu: Do not access stale data in virDomainBlockStats

[Eric Blake]

On 12/20/2013 02:36 PM, Jiri Denemark wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id=1043069
> 
> When virDomainDetachDeviceFlags is called concurrently to
> virDomainBlockStats: libvirtd may crash because qemuDomainBlockStats
> finds a disk in vm->def before getting a job on a domain and uses the
> disk pointer after getting the job. However, the domain in unlocked
> while waiting on a job condition and thus data behind the disk pointer
> may disappear. This happens when thread 1 runs
> virDomainDetachDeviceFlags and enters monitor to actually remove the
> disk. Then another thread starts running virDomainBlockStats, finds the
> disk in vm->def, and while it's waiting on the job condition (owned by
> the first thread), the first thread finishes the disk removal. When the
> second thread gets the job, the memory pointed to be the disk pointer is
> already gone.
> 
> That said, every API that is going to begin a job should do that before
> fetching data from vm->def.

Bummer, we'll need a CVE for this.  It's been present since at least
0.9.x days.

ACK.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20131220/19ae29ee/attachment-0001.sig>