On 09/27/2016 07:47 AM, Jiri Denemark wrote:
The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with caps == NULL, causing the following crash:
Program received signal SIGSEGV, Segmentation fault. #0 0x00007ffff788775f in virQEMUCapsInitHostCPUModel (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at src/qemu/qemu_capabilities.c:2969 #1 0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal (caps=caps@entry=0x0, binary=<optimized out>, libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0, runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295, qmpOnly=true) at src/qemu/qemu_capabilities.c:4039 #2 0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at tests/qemucapsprobe.c:73
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/qemu/qemu_capabilities.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Earlier in this function there's: if (!cacheDir) rv = 0; else if ((rv = virQEMUCapsInitCached(caps, qemuCaps, cacheDir)) < 0) goto error; virQEMUCapsInitCached will call virQEMUCapsLoadCache which will call virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); as well. So wouldn't it better to have virQEMUCapsInitHostCPUModel take "caps" as the parameter and then return "silently" if !caps->host ? John
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 4d859c4..73a7fd4 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -4036,7 +4036,8 @@ virQEMUCapsNewForBinaryInternal(virCapsPtr caps, virQEMUCapsRememberCached(qemuCaps, cacheDir) < 0) goto error;
- virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); + if (caps) + virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); }
cleanup: