提交 04d2a7f2 编写于 作者: E Eric Blake

lxc: avoid use-after-free

I got this weird failure:

error: Failed to start domain simple
error: internal error cannot mix caller fds with blocking execution

and tracked it down to a use-after-free - virCommandSetOutputFD
was storing the address of a stack-local variable, which then
went out of scope before the virCommandRun that dereferenced it.

Bug introduced in commit 451cfd05 (0.9.2).

* src/lxc/lxc_driver.c (lxcBuildControllerCmd): Move log fd
registration...
(lxcVmStart): ...to caller.
上级 26ff8996
...@@ -1449,7 +1449,6 @@ lxcBuildControllerCmd(lxc_driver_t *driver, ...@@ -1449,7 +1449,6 @@ lxcBuildControllerCmd(lxc_driver_t *driver,
char **veths, char **veths,
int *ttyFDs, int *ttyFDs,
size_t nttyFDs, size_t nttyFDs,
int logfile,
int handshakefd) int handshakefd)
{ {
size_t i; size_t i;
...@@ -1524,8 +1523,6 @@ lxcBuildControllerCmd(lxc_driver_t *driver, ...@@ -1524,8 +1523,6 @@ lxcBuildControllerCmd(lxc_driver_t *driver,
} }
virCommandPreserveFD(cmd, handshakefd); virCommandPreserveFD(cmd, handshakefd);
virCommandSetOutputFD(cmd, &logfile);
virCommandSetErrorFD(cmd, &logfile);
return cmd; return cmd;
cleanup: cleanup:
...@@ -1747,8 +1744,10 @@ static int lxcVmStart(virConnectPtr conn, ...@@ -1747,8 +1744,10 @@ static int lxcVmStart(virConnectPtr conn,
vm, vm,
nveths, veths, nveths, veths,
ttyFDs, nttyFDs, ttyFDs, nttyFDs,
logfd, handshakefds[1]))) handshakefds[1])))
goto cleanup; goto cleanup;
virCommandSetOutputFD(cmd, &logfd);
virCommandSetErrorFD(cmd, &logfd);
/* Log timestamp */ /* Log timestamp */
if ((timestamp = virTimestamp()) == NULL) { if ((timestamp = virTimestamp()) == NULL) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册