From nobody Thu Apr 25 15:53:08 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1552926481108417.6069935754766; Mon, 18 Mar 2019 09:28:01 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 2BCCF88AA7; Mon, 18 Mar 2019 16:27:59 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AFADD19C78; Mon, 18 Mar 2019 16:27:58 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 9DB9C247E0; Mon, 18 Mar 2019 16:27:57 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x2IGRuEd032456 for ; Mon, 18 Mar 2019 12:27:56 -0400 Received: by smtp.corp.redhat.com (Postfix) id 097DC600C7; Mon, 18 Mar 2019 16:27:56 +0000 (UTC) Received: from moe.brq.redhat.com (unknown [10.43.2.30]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8588F601A4 for ; Mon, 18 Mar 2019 16:27:53 +0000 (UTC) From: Michal Privoznik To: libvir-list@redhat.com Date: Mon, 18 Mar 2019 17:27:39 +0100 Message-Id: <5d88f12178fed08389b43900cd71b0b6b515129a.1552926459.git.mprivozn@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH] nwfilter: Don't crash when trying to add an nwfilter that's already being removed X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Mon, 18 Mar 2019 16:27:59 +0000 (UTC) Content-Type: text/plain; charset="utf-8" https://bugzilla.redhat.com/show_bug.cgi?id=3D1686927 When trying to create a nwfilter binding via nwfilterBindingCreateXML() we may encounter a crash. The sequence of functions called is as follows: 1) nwfilterBindingCreateXML() parses the XML and calls virNWFilterBindingObjListAdd() which calls virNWFilterBindingObjListAddLocked() 2) Here, @binding is not found because binding->remove is set. 3) Therefore, controls continue with creating new @binding, setting its def to the one from 1) and adding it to the hash table. 4) This fails, because the binding is still in the hash table (duplicate key is detected). 5) The control jumps to 'error' label where virNWFilterBindingObjEndAPI() is called which frees the binding definition passed. 6) Error is propagated to the caller, which calls virNWFilterBindingDefFree() over the definition again. Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- src/conf/virnwfilterbindingobjlist.c | 11 ++++++----- src/conf/virnwfilterbindingobjlist.h | 2 +- src/nwfilter/nwfilter_driver.c | 5 ++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/conf/virnwfilterbindingobjlist.c b/src/conf/virnwfilterbin= dingobjlist.c index 06ccbf53af..87189da642 100644 --- a/src/conf/virnwfilterbindingobjlist.c +++ b/src/conf/virnwfilterbindingobjlist.c @@ -164,23 +164,24 @@ virNWFilterBindingObjListAddObjLocked(virNWFilterBind= ingObjListPtr bindings, */ static virNWFilterBindingObjPtr virNWFilterBindingObjListAddLocked(virNWFilterBindingObjListPtr bindings, - virNWFilterBindingDefPtr def) + virNWFilterBindingDefPtr *def) { virNWFilterBindingObjPtr binding; =20 /* See if a binding with matching portdev already exists */ if ((binding =3D virNWFilterBindingObjListFindByPortDevLocked( - bindings, def->portdevname))) { + bindings, (*def)->portdevname))) { virReportError(VIR_ERR_OPERATION_FAILED, _("binding '%s' already exists"), - def->portdevname); + (*def)->portdevname); goto error; } =20 if (!(binding =3D virNWFilterBindingObjNew())) goto error; =20 - virNWFilterBindingObjSetDef(binding, def); + virNWFilterBindingObjSetDef(binding, *def); + *def =3D NULL; =20 if (virNWFilterBindingObjListAddObjLocked(bindings, binding) < 0) goto error; @@ -195,7 +196,7 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingOb= jListPtr bindings, =20 virNWFilterBindingObjPtr virNWFilterBindingObjListAdd(virNWFilterBindingObjListPtr bindings, - virNWFilterBindingDefPtr def) + virNWFilterBindingDefPtr *def) { virNWFilterBindingObjPtr ret; =20 diff --git a/src/conf/virnwfilterbindingobjlist.h b/src/conf/virnwfilterbin= dingobjlist.h index b0fb90f667..4047453634 100644 --- a/src/conf/virnwfilterbindingobjlist.h +++ b/src/conf/virnwfilterbindingobjlist.h @@ -35,7 +35,7 @@ virNWFilterBindingObjListFindByPortDev(virNWFilterBinding= ObjListPtr bindings, =20 virNWFilterBindingObjPtr virNWFilterBindingObjListAdd(virNWFilterBindingObjListPtr bindings, - virNWFilterBindingDefPtr def); + virNWFilterBindingDefPtr *def); =20 void virNWFilterBindingObjListRemove(virNWFilterBindingObjListPtr bindings, diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index fdfc6f48fa..8c2e987b5d 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -759,7 +759,7 @@ nwfilterBindingCreateXML(virConnectPtr conn, goto cleanup; =20 obj =3D virNWFilterBindingObjListAdd(driver->bindings, - def); + &def); if (!obj) goto cleanup; =20 @@ -775,8 +775,7 @@ nwfilterBindingCreateXML(virConnectPtr conn, virNWFilterBindingObjSave(obj, driver->bindingDir); =20 cleanup: - if (!obj) - virNWFilterBindingDefFree(def); + virNWFilterBindingDefFree(def); virNWFilterBindingObjEndAPI(&obj); =20 return ret; --=20 2.19.2 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list