The following theoretical possibility of a NULL dereference has been in the code since April 1 (commit 6e41f30efcac08e50b21d9c943d6d27e90555951). It's theoretical, because if that vm = NULL statement is ever executed, the very next one, calling virDomainObjUnlock would dereference that now-NULL "vm". Hence, I think we can conclude the vm = NULL statement is effectively dead code. That conclusion is in line with the "should" in the preceding comment. At first, it seemed like it would deserve an sa_assert. But without the assert, "n_refs" would be unused, (so this first patch is solely FYI -- not proposed) I solved it differently in the 2nd patch. From: Jim Meyering <meyering(a)redhat.com&gt; Date: Mon, 17 May 2010 12:10:52 +0200 Subject: [PATCH] qemu_driver: avoid NULL dereference * src/qemu/qemu_driver.c (qemudDomainStart): Rather than trying to handle a "can't happen" case, simply sa_assert that it won't happen. --- src/qemu/qemu_driver.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8f69b5a..819ea17 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6489,8 +6489,9 @@ static int qemudDomainStart(virDomainPtr dom) { * We should still have a reference left to vm but * one should check for 0 anyway */ - if (qemuDomainObjEndJob(vm) == 0) - vm = NULL; + int n_refs = qemuDomainObjEndJob(vm); + sa_assert (n_refs); + virDomainObjUnlock(vm); qemuDriverUnlock(driver); ret = qemudDomainRestore(dom->conn, managed_save); -- 1.7.1.250.g7d1e8 From: Jim Meyering <meyering(a)redhat.com&gt; Date: Mon, 17 May 2010 12:10:52 +0200 Subject: [PATCH] qemu_driver: avoid NULL dereference * src/qemu/qemu_driver.c (qemudDomainStart): After setting vm to NULL, goto cleanup, rather than dereferencing the NULL pointer. --- src/qemu/qemu_driver.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8f69b5a..3559e36 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6489,8 +6489,11 @@ static int qemudDomainStart(virDomainPtr dom) { * We should still have a reference left to vm but * one should check for 0 anyway */ - if (qemuDomainObjEndJob(vm) == 0) + if (qemuDomainObjEndJob(vm) = 0) { vm = NULL; + goto cleanup; + } + virDomainObjUnlock(vm); qemuDriverUnlock(driver); ret = qemudDomainRestore(dom->conn, managed_save); -- 1.7.1.250.g7d1e8