提交 75028002 编写于 作者: P Peter Krempa 提交者: Eric Blake

CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk

Live definition was used to look up the disk index while persistent one
was indexed leading to a crash in qemuDomainGetBlockIoTune. Use the
correct def and report a nice error.

Unfortunately it's accessible via read-only connection, though it can
only crash libvirtd in the cases where the guest is hot-plugging disks
without reflecting those changes to the persistent definition.  So
avoiding hotplug, or doing hotplug where persistent is always modified
alongside live definition, will avoid the out-of-bounds access.

Introduced in: eca96694a (v0.9.8)
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1140724Reported-by: NLuyao Huang <lhuang@redhat.com>
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>

(cherry picked from commit 3e745e8f)

Conflicts:
	src/qemu/qemu_driver.c - context due to fewer functions
上级 022b34ce
......@@ -12179,9 +12179,13 @@ qemuDomainGetBlockIoTune(virDomainPtr dom,
}
if (flags & VIR_DOMAIN_AFFECT_CONFIG) {
int idx = virDomainDiskIndexByName(vm->def, disk, true);
if (idx < 0)
int idx = virDomainDiskIndexByName(persistentDef, disk, true);
if (idx < 0) {
virReportError(VIR_ERR_INVALID_ARG,
_("disk '%s' was not found in the domain config"),
disk);
goto endjob;
}
reply = persistentDef->disks[idx]->blkdeviotune;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册