From nobody Fri Apr 26 08:33:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1539827657937719.0309002682442; Wed, 17 Oct 2018 18:54:17 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E95593082A26; Thu, 18 Oct 2018 01:54:14 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AE7E15DD7D; Thu, 18 Oct 2018 01:54:13 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 6AFF64BB79; Thu, 18 Oct 2018 01:54:10 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w9I1jcPd031904 for ; Wed, 17 Oct 2018 21:45:38 -0400 Received: by smtp.corp.redhat.com (Postfix) id 1E40C62926; Thu, 18 Oct 2018 01:45:38 +0000 (UTC) Received: from red.redhat.com (ovpn-122-161.rdu2.redhat.com [10.10.122.161]) by smtp.corp.redhat.com (Postfix) with ESMTP id A07705B687 for ; Thu, 18 Oct 2018 01:45:35 +0000 (UTC) From: Eric Blake To: libvir-list@redhat.com Date: Wed, 17 Oct 2018 20:45:35 -0500 Message-Id: <20181018014535.259884-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2] snapshot: Don't hose list on deletion failure X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Thu, 18 Oct 2018 01:54:16 +0000 (UTC) X-ZohoMail: RDMRC_0 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" If qemuDomainSnapshotDiscard() fails for any reason (rare, but possible with an ill-timed ENOMEM or if qemuDomainSnapshotForEachQcow2() has problems talking to the qemu guest monitor), then an attempt to retry the snapshot deletion API will crash because we didn't undo the effects of virDomainSnapshotDropParent() temporarily rearranging the internal list structures, and the second attempt to drop parents will dereference NULL. Fix it by instead noting that there are only two callers to qemuDomainSnapshotDiscard(), and only one of the two callers wants the parent to be updated; thus we can move the call to virDomainSnapshotDropParent() into a code path that only gets executed on success. Signed-off-by: Eric Blake --- v2: avoid use-after-free --- src/qemu/qemu_domain.c | 6 ++++-- src/qemu/qemu_driver.c | 1 - 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index f00f1b3fdb..dd67be5e2a 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8246,7 +8246,7 @@ int qemuDomainSnapshotDiscard(virQEMUDriverPtr driver, virDomainObjPtr vm, virDomainSnapshotObjPtr snap, - bool update_current, + bool update_parent, bool metadata_only) { char *snapFile =3D NULL; @@ -8275,7 +8275,7 @@ qemuDomainSnapshotDiscard(virQEMUDriverPtr driver, goto cleanup; if (snap =3D=3D vm->current_snapshot) { - if (update_current && snap->def->parent) { + if (update_parent && snap->def->parent) { parentsnap =3D virDomainSnapshotFindByName(vm->snapshots, snap->def->parent); if (!parentsnap) { @@ -8298,6 +8298,8 @@ qemuDomainSnapshotDiscard(virQEMUDriverPtr driver, if (unlink(snapFile) < 0) VIR_WARN("Failed to unlink %s", snapFile); + if (update_parent) + virDomainSnapshotDropParent(snap); virDomainSnapshotObjListRemove(vm->snapshots, snap); ret =3D 0; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a52e2495d5..9f71641dfa 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16526,7 +16526,6 @@ qemuDomainSnapshotDelete(virDomainSnapshotPtr snaps= hot, snap->first_child =3D NULL; ret =3D 0; } else { - virDomainSnapshotDropParent(snap); ret =3D qemuDomainSnapshotDiscard(driver, vm, snap, true, metadata= _only); } --=20 2.17.2 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list