Bug introduced in commit 35abced. On an inactive domain, $ virsh snapshot-create-as dom snap $ virsh snapshot-create dom $ virsh snapshot-create dom $ virsh snapshot-delete --children dom snap could crash libvirtd, due to a use-after-free that results when the callback freed the current element in the iteration. * src/conf/domain_conf.c (virDomainSnapshotForEachChild) (virDomainSnapshotActOnDescendant): Allow iteration to delete current child. --- src/conf/domain_conf.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index f8d0a4c..da00830 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13325,8 +13325,9 @@ virDomainSnapshotForEachChild(virDomainSnapshotObjPtr snapshot, virDomainSnapshotObjPtr child = snapshot->first_child; while (child) { + virDomainSnapshotObjPtr next = child->sibling; (iter)(child, child->def->name, data); - child = child->sibling; + child = next; } return snapshot->nchildren; @@ -13346,10 +13347,10 @@ virDomainSnapshotActOnDescendant(void *payload, virDomainSnapshotObjPtr obj = payload; struct snapshot_act_on_descendant *curr = data; - (curr->iter)(payload, name, curr->data); curr->number += 1 + virDomainSnapshotForEachDescendant(obj, curr->iter, curr->data); + (curr->iter)(payload, name, curr->data); } /* Run iter(data) on all descendants of snapshot, while ignoring all -- 1.7.7.6