1. 11 7月, 2017 2 次提交
  2. 27 6月, 2017 2 次提交
  3. 25 6月, 2017 1 次提交
    • J
      events: Avoid double free possibility on remote call failure · 2065499b
      John Ferlan 提交于
      If a remote call fails during event registration (more than likely from
      a network failure or remote libvirtd restart timed just right), then when
      calling the virObjectEventStateDeregisterID we don't want to call the
      registered @freecb function because that breaks our contract that we
      would only call it after succesfully returning.  If the @freecb routine
      were called, it could result in a double free from properly coded
      applications that free their opaque data on failure to register, as seen
      in the following details:
      
          Program terminated with signal 6, Aborted.
          #0  0x00007fc45cba15d7 in raise
          #1  0x00007fc45cba2cc8 in abort
          #2  0x00007fc45cbe12f7 in __libc_message
          #3  0x00007fc45cbe86d3 in _int_free
          #4  0x00007fc45d8d292c in PyDict_Fini
          #5  0x00007fc45d94f46a in Py_Finalize
          #6  0x00007fc45d960735 in Py_Main
          #7  0x00007fc45cb8daf5 in __libc_start_main
          #8  0x0000000000400721 in _start
      
      The double dereference of 'pyobj_cbData' is triggered in the following way:
      
          (1) libvirt_virConnectDomainEventRegisterAny is invoked.
          (2) the event is successfully added to the event callback list
              (virDomainEventStateRegisterClient in
              remoteConnectDomainEventRegisterAny returns 1 which means ok).
          (3) when function remoteConnectDomainEventRegisterAny is hit,
              network connection disconnected coincidently (or libvirtd is
              restarted) in the context of function 'call' then the connection
              is lost and the function 'call' failed, the branch
              virObjectEventStateDeregisterID is therefore taken.
          (4) 'pyobj_conn' is dereferenced the 1st time in
              libvirt_virConnectDomainEventFreeFunc.
          (5) 'pyobj_cbData' (refered to pyobj_conn) is dereferenced the
               2nd time in libvirt_virConnectDomainEventRegisterAny.
          (6) the double free error is triggered.
      
      Resolve this by adding a @doFreeCb boolean in order to avoid calling the
      freeCb in virObjectEventStateDeregisterID for any remote call failure in
      a remoteConnect*EventRegister* API. For remoteConnect*EventDeregister* calls,
      the passed value would be true indicating they should run the freecb if it
      exists; whereas, it's false for the remote call failure path.
      
      Patch based on the investigation and initial patch posted by
      fangying <fangying1@huawei.com>.
      2065499b
  4. 23 6月, 2017 1 次提交
  5. 20 6月, 2017 1 次提交
  6. 16 6月, 2017 2 次提交
  7. 13 6月, 2017 1 次提交
  8. 08 6月, 2017 12 次提交
  9. 07 6月, 2017 10 次提交
  10. 05 6月, 2017 6 次提交
  11. 03 6月, 2017 2 次提交