[libvirt] [PATCH] qemu: Fix crash in qemucapsprobe
The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with caps == NULL, causing the following crash: Program received signal SIGSEGV, Segmentation fault. #0 0x00007ffff788775f in virQEMUCapsInitHostCPUModel (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at src/qemu/qemu_capabilities.c:2969 #1 0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal (caps=caps@entry=0x0, binary=<optimized out>, libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0, runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295, qmpOnly=true) at src/qemu/qemu_capabilities.c:4039 #2 0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at tests/qemucapsprobe.c:73 Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/qemu/qemu_capabilities.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 4d859c4..73a7fd4 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -4036,7 +4036,8 @@ virQEMUCapsNewForBinaryInternal(virCapsPtr caps, virQEMUCapsRememberCached(qemuCaps, cacheDir) < 0) goto error; - virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); + if (caps) + virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); } cleanup: -- 2.10.0
On 09/27/2016 07:47 AM, Jiri Denemark wrote:
The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with caps == NULL, causing the following crash:
Program received signal SIGSEGV, Segmentation fault. #0 0x00007ffff788775f in virQEMUCapsInitHostCPUModel (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at src/qemu/qemu_capabilities.c:2969 #1 0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal (caps=caps@entry=0x0, binary=<optimized out>, libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0, runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295, qmpOnly=true) at src/qemu/qemu_capabilities.c:4039 #2 0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at tests/qemucapsprobe.c:73
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/qemu/qemu_capabilities.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Earlier in this function there's: if (!cacheDir) rv = 0; else if ((rv = virQEMUCapsInitCached(caps, qemuCaps, cacheDir)) < 0) goto error; virQEMUCapsInitCached will call virQEMUCapsLoadCache which will call virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); as well. So wouldn't it better to have virQEMUCapsInitHostCPUModel take "caps" as the parameter and then return "silently" if !caps->host ? John
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 4d859c4..73a7fd4 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -4036,7 +4036,8 @@ virQEMUCapsNewForBinaryInternal(virCapsPtr caps, virQEMUCapsRememberCached(qemuCaps, cacheDir) < 0) goto error;
- virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); + if (caps) + virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); }
cleanup:
On Tue, Sep 27, 2016 at 08:25:05 -0400, John Ferlan wrote:
On 09/27/2016 07:47 AM, Jiri Denemark wrote:
The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with caps == NULL, causing the following crash:
Program received signal SIGSEGV, Segmentation fault. #0 0x00007ffff788775f in virQEMUCapsInitHostCPUModel (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at src/qemu/qemu_capabilities.c:2969 #1 0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal (caps=caps@entry=0x0, binary=<optimized out>, libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0, runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295, qmpOnly=true) at src/qemu/qemu_capabilities.c:4039 #2 0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at tests/qemucapsprobe.c:73
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/qemu/qemu_capabilities.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Earlier in this function there's:
if (!cacheDir) rv = 0; else if ((rv = virQEMUCapsInitCached(caps, qemuCaps, cacheDir)) < 0) goto error;
virQEMUCapsInitCached will call virQEMUCapsLoadCache which will call virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); as well.
Well, this cannot happen if caps == NULL.
So wouldn't it better to have virQEMUCapsInitHostCPUModel take "caps" as the parameter and then return "silently" if !caps->host ?
But this is the way I should have fixed it, since it will work better with future changes. Jirka
On Tue, Sep 27, 2016 at 01:47:10PM +0200, Jiri Denemark wrote:
The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with caps == NULL, causing the following crash:
Program received signal SIGSEGV, Segmentation fault. #0 0x00007ffff788775f in virQEMUCapsInitHostCPUModel (qemuCaps=qemuCaps@entry=0x649680, host=host@entry=0x10) at src/qemu/qemu_capabilities.c:2969 #1 0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal (caps=caps@entry=0x0, binary=<optimized out>, libDir=libDir@entry=0x4033f6 "/tmp", cacheDir=cacheDir@entry=0x0, runUid=runUid@entry=4294967295, runGid=runGid@entry=4294967295, qmpOnly=true) at src/qemu/qemu_capabilities.c:4039 #2 0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at tests/qemucapsprobe.c:73
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> ---
Some would say that you should put the causing commit (68c7011856ad0033dff55a1b2c7b9749ce98e439) in the message, but I'm not one of them. So just ACK.
participants (3)
-
Jiri Denemark -
John Ferlan -
Martin Kletzander