From nobody Thu Apr 25 23:39:34 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1553077929873671.3912191332275; Wed, 20 Mar 2019 03:32:09 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 3E02130832E3; Wed, 20 Mar 2019 10:32:07 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6A57860461; Wed, 20 Mar 2019 10:32:06 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id F000E1803389; Wed, 20 Mar 2019 10:32:03 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x2KAW2eN002675 for ; Wed, 20 Mar 2019 06:32:02 -0400 Received: by smtp.corp.redhat.com (Postfix) id 872BE1974C; Wed, 20 Mar 2019 10:32:02 +0000 (UTC) Received: from moe.brq.redhat.com (unknown [10.43.2.30]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0C0D51779C for ; Wed, 20 Mar 2019 10:31:59 +0000 (UTC) From: Michal Privoznik To: libvir-list@redhat.com Date: Wed, 20 Mar 2019 11:31:57 +0100 Message-Id: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH] virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 20 Mar 2019 10:32:08 +0000 (UTC) Content-Type: text/plain; charset="utf-8" https://bugzilla.redhat.com/show_bug.cgi?id=3D1686927 When trying to create a nwfilter binding via nwfilterBindingCreateXML() we may encounter a crash. The sequence of functions called is as follows: 1) nwfilterBindingCreateXML() parses the XML and calls virNWFilterBindingObjListAdd() which calls virNWFilterBindingObjListAddLocked() 2) Here, @binding is not found because binding->remove is set. 3) Therefore, controls continue with creating new @binding, setting its def to the one from 1) and adding it to the hash table. 4) This fails, because the binding is still in the hash table (duplicate key is detected). 5) The control jumps to 'error' label where virNWFilterBindingObjEndAPI() is called which frees the binding definition passed. 6) Error is propagated to the caller, which calls virNWFilterBindingDefFree() over the definition again. The solution is to unset binding->def in case of failure so it's not freed in step 5). Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- Technically, this is a v2 of: https://www.redhat.com/archives/libvir-list/2019-March/msg01209.html But since this one implements different approach than v1 I'm not marking it as such. src/conf/virnwfilterbindingobj.c | 10 ++++++++++ src/conf/virnwfilterbindingobj.h | 3 +++ src/conf/virnwfilterbindingobjlist.c | 4 ++++ src/libvirt_private.syms | 1 + 4 files changed, 18 insertions(+) diff --git a/src/conf/virnwfilterbindingobj.c b/src/conf/virnwfilterbinding= obj.c index 23978d4207..68afb9c434 100644 --- a/src/conf/virnwfilterbindingobj.c +++ b/src/conf/virnwfilterbindingobj.c @@ -88,6 +88,16 @@ virNWFilterBindingObjSetDef(virNWFilterBindingObjPtr obj, } =20 =20 +virNWFilterBindingDefPtr +virNWFilterBindingObjStealDef(virNWFilterBindingObjPtr obj) +{ + virNWFilterBindingDefPtr def; + + VIR_STEAL_PTR(def, obj->def); + return def; +} + + bool virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj) { diff --git a/src/conf/virnwfilterbindingobj.h b/src/conf/virnwfilterbinding= obj.h index 8e5fbee35f..b26bb3c8ec 100644 --- a/src/conf/virnwfilterbindingobj.h +++ b/src/conf/virnwfilterbindingobj.h @@ -39,6 +39,9 @@ void virNWFilterBindingObjSetDef(virNWFilterBindingObjPtr obj, virNWFilterBindingDefPtr def); =20 +virNWFilterBindingDefPtr +virNWFilterBindingObjStealDef(virNWFilterBindingObjPtr obj); + bool virNWFilterBindingObjGetRemoving(virNWFilterBindingObjPtr obj); =20 diff --git a/src/conf/virnwfilterbindingobjlist.c b/src/conf/virnwfilterbin= dingobjlist.c index 06ccbf53af..4ee2c1b194 100644 --- a/src/conf/virnwfilterbindingobjlist.c +++ b/src/conf/virnwfilterbindingobjlist.c @@ -167,6 +167,7 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingOb= jListPtr bindings, virNWFilterBindingDefPtr def) { virNWFilterBindingObjPtr binding; + bool stealDef =3D false; =20 /* See if a binding with matching portdev already exists */ if ((binding =3D virNWFilterBindingObjListFindByPortDevLocked( @@ -181,6 +182,7 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingOb= jListPtr bindings, goto error; =20 virNWFilterBindingObjSetDef(binding, def); + stealDef =3D true; =20 if (virNWFilterBindingObjListAddObjLocked(bindings, binding) < 0) goto error; @@ -188,6 +190,8 @@ virNWFilterBindingObjListAddLocked(virNWFilterBindingOb= jListPtr bindings, return binding; =20 error: + if (stealDef) + virNWFilterBindingObjStealDef(binding); virNWFilterBindingObjEndAPI(&binding); return NULL; } diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 26f10bd47f..a33f9e61b1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1101,6 +1101,7 @@ virNWFilterBindingObjParseFile; virNWFilterBindingObjSave; virNWFilterBindingObjSetDef; virNWFilterBindingObjSetRemoving; +virNWFilterBindingObjStealDef; =20 =20 # conf/virnwfilterbindingobjlist.h --=20 2.19.2 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list