From nobody Thu Nov 12 15:08:52 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1794321753; cv=none; d=zohomail.com; s=zohoarc; b=B4ZuM+W4LCQ4OYQpOBEyaH+uKex5uAM9E30Gmbv7QdiT0ogjL4QzEkXJVFzpF7H/0N0CaBBPZ+8AXeninuiyL075vSXK/6BTWPU1xJtwuzuxf/PIuwsNyLzQxdMJdvHl35F/RwtmTxerPZKc5Jr3Z6pcCob/FiWErSJUCwefuqY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1794321753; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=K75Z8MAxFBLMp8x2jIRy6f8IYOcfisUac6i3zaNYzGA=; b=L4sGY0pK8HYgZM6g/BRDgmPGcyL85jQsr2ph4jPErfyfiE2TKaXdPs2m4ZifMl5AicrtLYC+IHauZIHO0yEqlSc6omgy1D97lhUyZ01FhKV2vH7c/9cD+eahk0x8f966Nu6A8VyARWgRM5t1H1TfbT1WasggVB3ax5TcoC7nX4U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1794321753023681.7103999910147; Tue, 10 Nov 2026 06:42:33 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 6710641B1C; Tue, 10 Nov 2026 09:42:28 -0500 (EST) Received: from [172.19.199.22] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 2B0AA41BF6; Tue, 10 Nov 2026 09:41:18 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 922B03F290; Tue, 10 Nov 2026 09:41:08 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 7C16B3F290 for ; Tue, 10 Nov 2026 09:41:07 -0500 (EST) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-546-k9wc3P3KNhqq9MYt7tpXXg-1; Tue, 10 Nov 2026 09:41:03 -0500 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9F9361800259 for ; Tue, 10 Nov 2026 14:41:02 +0000 (UTC) Received: from speedmetal.openshiftapps.com (unknown [10.44.22.3]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E432A1800347 for ; Tue, 10 Nov 2026 14:41:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1794321667; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=K75Z8MAxFBLMp8x2jIRy6f8IYOcfisUac6i3zaNYzGA=; b=QDQLVi5VunqtUfPGpddRVgMcot+62DahZgYSLRTiz9n8nBDYqZYaSQivRUjX32PBWBdkgU iW8xyI4LbVgJz7zeejGhGFHsCCR86DbLrN1P1r/T+ON1s+T/SQnVKdc8IEyrcJqvChg1Uw AzG09Xg+Ixom/51oNEtwTHS165IgQyo= X-MC-Unique: k9wc3P3KNhqq9MYt7tpXXg-1 X-Mimecast-MFC-AGG-ID: k9wc3P3KNhqq9MYt7tpXXg_1794321662 To: devel@lists.libvirt.org Subject: [PATCH] remote: Consistently clear out virStream internal variables after dispose Date: Tue, 10 Nov 2026 15:41:00 +0100 Message-ID: <83824e9cc12ef874cd8d0c29345d08a07f653f70.1794321660.git.pkrempa@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: n3gwyD7DxSTsh6um8zB5_4EG5-WZs7clI4AiSRMwSkA_1794321662 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 3RUGTS6JVFNR3MDBC5XKHK6SANMO3OR2 X-Message-ID-Hash: 3RUGTS6JVFNR3MDBC5XKHK6SANMO3OR2 X-MailFrom: pkrempa@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Peter Krempa via Devel Reply-To: Peter Krempa X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1794321756200158500 Content-Type: text/plain; charset="utf-8" From: Peter Krempa On failure during the preparation step of migration protocol v3 the client (potentially running inside the source daemon) can crash as the remote driver frees internal data of the virStream but doesn't clear out the pointer. The private data freeing function then tries to unref the internal data again. When 'remoteDomainMigratePrepareTunnel3' was introduced in commit d59e14a1a2 it used the code the RPC generator generated as inspiration, which didn't clean out the code. This was later addressed by commit be5ec76630 which added the clearing to the generator but didn't fix the one instance that was manually implemented. Later when 'remoteDomainMigratePrepareTunnel3Params' in cca4d10d82 it copied the un-fixed manual implementation. This only became a problem once commit fbcb7386 introduced a freeing function for the 'privateData' field. In addition to synchronize the clearing of the 'privateData' of the stream in the hand-written code, this patch also clears out the 'ff' function pointer so that the clearing function is not called even on NULL data. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/939 Signed-off-by: Peter Krempa Reviewed-by: J=C3=A1n Tomko --- src/remote/remote_driver.c | 6 ++++++ src/rpc/gendispatch.pl | 1 + 2 files changed, 7 insertions(+) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 5c358d58c4..7fb32dce97 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -5868,6 +5868,9 @@ remoteDomainMigratePrepareTunnel3(virConnectPtr dconn, (xdrproc_t) xdr_remote_domain_migrate_prepare_tunnel3_ret, (c= har *) &ret) =3D=3D -1) { virNetClientRemoveStream(priv->client, netst); virObjectUnref(netst); + st->driver =3D NULL; + st->privateData =3D NULL; + st->ff =3D NULL; return -1; } @@ -6629,6 +6632,9 @@ remoteDomainMigratePrepareTunnel3Params(virConnectPtr= dconn, (char *) &ret) =3D=3D -1) { virNetClientRemoveStream(priv->client, netst); virObjectUnref(netst); + st->driver =3D NULL; + st->privateData =3D NULL; + st->ff =3D NULL; goto cleanup; } diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index 252562ccfd..a57340d856 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -1904,6 +1904,7 @@ elsif ($mode eq "client") { print " virObjectUnref(netst);\n"; print " st->driver =3D NULL;\n"; print " st->privateData =3D NULL;\n"; + print " st->ff =3D NULL;\n"; } print " goto cleanup;\n"; --=20 2.56.0