[libvirt] [PATCH] Really don't crash if a connection closes early
https://bugzilla.redhat.com/show_bug.cgi?id=1047577 When writing commit 173c291, I missed the fact virNetServerClientClose unlocks the client object before actually clearing client->sock and thus it is possible to hit a window when client->keepalive is NULL while client->sock is not NULL. I was thinking client->sock == NULL was a better check for a closed connection but apparently we have to go with client->keepalive == NULL to actually fix the crash. Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/rpc/virnetserverclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c index 7830b7f..52b4941 100644 --- a/src/rpc/virnetserverclient.c +++ b/src/rpc/virnetserverclient.c @@ -1546,7 +1546,7 @@ virNetServerClientStartKeepAlive(virNetServerClientPtr client) /* The connection might have been closed before we got here and thus the * keepalive object could have been removed too. */ - if (!client->sock) { + if (!client->keepalive) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("connection not open")); goto cleanup; -- 1.8.5.2
On 01/13/2014 08:24 AM, Jiri Denemark wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1047577
When writing commit 173c291, I missed the fact virNetServerClientClose unlocks the client object before actually clearing client->sock and thus it is possible to hit a window when client->keepalive is NULL while client->sock is not NULL. I was thinking client->sock == NULL was a better check for a closed connection but apparently we have to go with client->keepalive == NULL to actually fix the crash.
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/rpc/virnetserverclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ACK.
diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c index 7830b7f..52b4941 100644 --- a/src/rpc/virnetserverclient.c +++ b/src/rpc/virnetserverclient.c @@ -1546,7 +1546,7 @@ virNetServerClientStartKeepAlive(virNetServerClientPtr client) /* The connection might have been closed before we got here and thus the * keepalive object could have been removed too. */ - if (!client->sock) { + if (!client->keepalive) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("connection not open")); goto cleanup;
-- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On Mon, Jan 13, 2014 at 12:46:44 -0700, Eric Blake wrote:
On 01/13/2014 08:24 AM, Jiri Denemark wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1047577
When writing commit 173c291, I missed the fact virNetServerClientClose unlocks the client object before actually clearing client->sock and thus it is possible to hit a window when client->keepalive is NULL while client->sock is not NULL. I was thinking client->sock == NULL was a better check for a closed connection but apparently we have to go with client->keepalive == NULL to actually fix the crash.
Signed-off-by: Jiri Denemark <jdenemar@redhat.com> --- src/rpc/virnetserverclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ACK.
Pushed, thanks. Jirka
On 01/13/2014 08:24 AM, Jiri Denemark wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1047577
When writing commit 173c291, I missed the fact virNetServerClientClose unlocks the client object before actually clearing client->sock and thus it is possible to hit a window when client->keepalive is NULL while client->sock is not NULL. I was thinking client->sock == NULL was a better check for a closed connection but apparently we have to go with client->keepalive == NULL to actually fix the crash.
By the way, commit 173c291 and this commit together fix CVE-2014-1447. I'll be working on backporting it to appropriate branches. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
participants (2)
-
Eric Blake -
Jiri Denemark