[Libvir] [PATCH/RFC] remote driver uses already freed dom

Hi, when trying to undefine a running qemu domain the domain name gets corrupted: $ ./virsh undefine system1 Name: /�em1 libvir: QEMU error /�em1: internal error cannot delete active domain error: Failed to undefine domain system1 the reaseon is that in qemud/remote.c the domain is freed after failure: remoteDispatchDomainUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, ... { ... if (virDomainUndefine (dom) == -1) { virDomainFree(dom); return -1; } ... } This doesn't work out since remoteDispatchClient accesses the dom structure that was stored in the virtErrorPtr structure to report the error back to the client (This is just an example and hits any error path of functions in remote_dispatch_proc_switch.h that reference dom). There are two possible solutions I see: move the virtDomainFree down to the bottom of remoteDispatchClient or deep copy the dom structure in virDefaultErrorFunc. A patch for the later is attached since similar things seem to be possible in other drivers too. -- Guido

...and here's the patch attached again. It seems mailman stripped the attachment and the original mail into two parts because of the git headers. -- Guido

On Fri, Mar 28, 2008 at 05:00:03PM +0100, Guido Günther wrote:
...and here's the patch attached again. It seems mailman stripped the attachment and the original mail into two parts because of the git headers.
This patch is wrong for the same reason as in the earlier thread. However the bug is real -- how hard is it to move virDomainFree later in the function? Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top
participants (2)
-
Guido Günther
-
Richard W.M. Jones