From 9ce671c2415d50ae14e5c0bc47dd7bb5a3025d05 Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Fri, 30 Jan 2015 10:37:10 +0100 Subject: [PATCH] xend: Don't crash in virDomainXMLDevID The function is called from all {Attach,Update,Detach}Device APIs to create config strings that are later passed to the xend to perform the desired action. The function is intended to handle all supported devices. However, as of 5b05358abacb1029fa0d61f72decacf0d4fd8ffb we are trying to get disk driver of the device without checking if the device really is a disk. This leads to an segmentation fault: #0 0x00007ffff7571815 in virDomainDiskGetDriver () from /usr/lib/libvirt.so.0 #1 0x00007fffeb9ad471 in ?? () from /usr/lib/libvirt/connection-driver/libvirt_driver_xen.so #2 0x00007fffeb9b1062 in xenDaemonAttachDeviceFlags () from /usr/lib/libvirt/connection-driver/libvirt_driver_xen.so #3 0x00007fffeb9a8a86 in ?? () from /usr/lib/libvirt/connection-driver/libvirt_driver_xen.so #4 0x00007ffff7609266 in virDomainAttachDevice () from /usr/lib/libvirt.so.0 #5 0x0000555555593c9d in ?? () #6 0x00007ffff76743c9 in virNetServerProgramDispatch () from /usr/lib/libvirt.so.0 #7 0x00005555555a678d in ?? () #8 0x00007ffff755460e in ?? () from /usr/lib/libvirt.so.0 #9 0x00007ffff7553b06 in ?? () from /usr/lib/libvirt.so.0 #10 0x00007ffff4998b50 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #11 0x00007ffff46e30ed in clone () from /lib/x86_64-linux-gnu/libc.so.6 #12 0x0000000000000000 in ?? () Reported-by: Xiaolin Su Signed-off-by: Michal Privoznik (cherry picked from commit cd7702d4561bc100f291be7a1f6fa8f358440558) --- src/xen/xend_internal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c index c30b136ef2..0390c710e6 100644 --- a/src/xen/xend_internal.c +++ b/src/xen/xend_internal.c @@ -3338,9 +3338,10 @@ virDomainXMLDevID(virConnectPtr conn, xenUnifiedPrivatePtr priv = conn->privateData; char *xref; char *tmp; - const char *driver = virDomainDiskGetDriver(dev->data.disk); if (dev->type == VIR_DOMAIN_DEVICE_DISK) { + const char *driver = virDomainDiskGetDriver(dev->data.disk); + if (STREQ_NULLABLE(driver, "tap") || STREQ_NULLABLE(driver, "tap2")) strcpy(class, driver); else -- GitLab