From nobody Wed Feb 11 10:09:38 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1490193840236215.43948214186196; Wed, 22 Mar 2017 07:44:00 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6E99A81241; Wed, 22 Mar 2017 14:43:59 +0000 (UTC) Received: from colo-mx.corp.redhat.com (unknown [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 41E81179C4; Wed, 22 Mar 2017 14:43:59 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id EEF805EC67; Wed, 22 Mar 2017 14:43:58 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v2MEhuGm029943 for ; Wed, 22 Mar 2017 10:43:56 -0400 Received: by smtp.corp.redhat.com (Postfix) id 3BCCD7E63B; Wed, 22 Mar 2017 14:43:56 +0000 (UTC) Received: from moe.brq.redhat.com (dhcp129-131.brq.redhat.com [10.34.129.131]) by smtp.corp.redhat.com (Postfix) with ESMTP id B83AF17A75 for ; Wed, 22 Mar 2017 14:43:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 6E99A81241 Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=libvir-list-bounces@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 6E99A81241 From: Michal Privoznik To: libvir-list@redhat.com Date: Wed, 22 Mar 2017 15:43:17 +0100 Message-Id: <28617acf7f005383d34c351e2e142fbb8792e05d.1490193665.git.mprivozn@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 2/2] network: Don't crash on domain destroy X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 22 Mar 2017 14:44:00 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" https://bugzilla.redhat.com/show_bug.cgi?id=3D1434882 Imagine the following scenario: 1) virsh net-start default 2) virsh start myFavouriteDomain 3) virsh net-destroy default 4) virsh destroy myFavouriteDomain (assuming myFavouriteDomain has an interface from default network) Regardless of how unlikely this scenario looks like, we should not crash. The problem is, on net-destroy in networkShutdownNetworkVirtual() the virMacMap module is unrefed, but the stale pointer is kept around. Thus when the domain destroy procedure comes in, networkReleaseActualDevice() and subsequently networkMacMgrDel() is called. This function sees the stale pointer and starts calling the virMacMap module APIs which work over freed memory. Signed-off-by: Michal Privoznik --- src/network/bridge_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 0ea8e2348..3fcdd702e 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2488,7 +2488,8 @@ networkShutdownNetworkVirtual(virNetworkDriverStatePt= r driver, if (network->def->bandwidth) virNetDevBandwidthClear(network->def->bridge); =20 - virObjectUnref(network->macmap); + if (!virObjectUnref(network->macmap)) + network->macmap =3D NULL; =20 if (network->radvdPid > 0) { char *radvdpidbase; --=20 2.11.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list