rpms
/
libvirt
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* Thu Oct 29 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-14 

- Fix xen driver recounting (#531429)
- Fix crash on virsh error (#531429)
- Fix segfault where XML parsing fails in qemu disk hotplug
- Fix segfault where interface target device name is ommitted (#523418)
This commit is contained in:
Mark McLoughlin 2009-10-29 10:40:45 +00:00
parent 39bacac57d
commit 21a9f1ec41
5 changed files with 2088 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1901
libvirt-double-free-on-virsh-error.patch Normal file
View File

File diff suppressed because it is too large Load Diff

31
libvirt-fix-crash-on-device-hotplug-parse-error.patch Normal file
View File

@ -0,0 +1,31 @@
From a5fa9f63fcffbf70465386672f24edac439866b9 Mon Sep 17 00:00:00 2001
From: Daniel P. Berrange <berrange@redhat.com>
Date: Thu, 24 Sep 2009 15:42:25 +0100
Subject: [PATCH] Fix crash in device hotplug cleanup code
* src/qemu/qemu_driver.c: Fix crash in scenario where XML
parsing of hotplugged device failed & thus 'dev' is NULL
(cherry picked from commit 879cd8cc2ba00f795913f296556e05f25afa7877)
Fedora-patch: libvirt-fix-crash-on-device-hotplug-parse-error.patch
---
src/qemu_driver.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index 0ce403c..c956258 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -5912,7 +5912,7 @@ cleanup:
if (cgroup)
virCgroupFree(&cgroup);
- if (ret < 0) {
+ if (ret < 0 && dev != NULL) {
if (qemuDomainSetDeviceOwnership(dom->conn, driver, dev, 1) < 0)
VIR_WARN0("Fail to restore disk device ownership");
virDomainDeviceDefFree(dev);
--
1.6.2.5

33
libvirt-fix-crash-on-missing-iface-target-dev.patch Normal file
View File

@ -0,0 +1,33 @@
From 7bc1491deba6338e514504d1b68fe097e7f2bf19 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Thu, 1 Oct 2009 11:54:38 +0200
Subject: [PATCH] Avoid a libvirtd crash on broken input 523418
* src/conf/domain_conf.c: a simple typo in an XML domain file could lead
to a crash, because we called STRPREFIX() on the looked up value without
checking it was non-null.
(cherry picked from commit 79d233b5ca62f86ab22d271d1f08ec20060eee88)
Fedora-patch: libvirt-fix-crash-on-missing-iface-target-dev.patch
---
src/domain_conf.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/domain_conf.c b/src/domain_conf.c
index c424c67..476cdd7 100644
--- a/src/domain_conf.c
+++ b/src/domain_conf.c
@@ -1031,7 +1031,8 @@ virDomainNetDefParseXML(virConnectPtr conn,
} else if ((ifname == NULL) &&
xmlStrEqual(cur->name, BAD_CAST "target")) {
ifname = virXMLPropString(cur, "dev");
- if (STRPREFIX((const char*)ifname, "vnet")) {
+ if ((ifname != NULL) &&
+ (STRPREFIX((const char*)ifname, "vnet"))) {
/* An auto-generated target name, blank it out */
VIR_FREE(ifname);
}
--
1.6.2.5

103
libvirt-fix-xen-driver-refcounting.patch Normal file
View File

@ -0,0 +1,103 @@
From cab81502320d97dac4c5c12e7496f30896709c49 Mon Sep 17 00:00:00 2001
From: Matthias Bolte <matthias.bolte@googlemail.com>
Date: Tue, 22 Sep 2009 15:12:48 +0200
Subject: [PATCH] Fix xen driver refcounting.
The commit cb51aa48a777ddae6997faa9f28350cb62655ffd "Fix up connection
reference counting." changed the driver closing and virConnectPtr
unref-logic in virConnectClose().
Before this commit virConnectClose() closed all drivers of the given
virConnectPtr and virUnrefConnect()'ed it afterwards. After this
commit the driver-closing is done in virUnrefConnect() if and only if
the ref-count of the virConnectPtr dropped to zero.
This change in execution order leads to a virConnectPtr leak, at least
for connections to Xen.
The relevant call sequences:
virConnectOpen() -> xenUnifiedOpen() ...
... xenInotifyOpen() -> virConnectRef(conn)
... xenStoreOpen() -> xenStoreAddWatch() -> conn->refs++
virConnectClose() -> xenUnifiedClose() ...
... xenInotifyClose() -> virUnrefConnect(conn)
... xenStoreClose() -> xenStoreRemoveWatch() -> virUnrefConnect(conn)
Before the commit this additional virConnectRef/virUnrefConnect calls
where no problem, because virConnectClose() closed the drivers
explicitly and the additional refs added by the Xen subdrivers were
removed properly. After the commit this additional refs result in a
virConnectPtr leak (including a leak of the hypercall file handle;
that's how I noticed this problem), because now the drivers are only
close if and only if the ref-count drops to zero, but this cannot
happen anymore, because the additional refs from the Xen subdrivers
would only be removed if the drivers get closed, but that doesn't
happen because the ref-count cannot drop to zero.
The fix for this problem is simple: remove the
virConnectRef/virUnrefConnect calls from the Xen subdrivers (see
attached patch). Maybe someone could explain why the Xen Inotify and
Xen Store driver do this extra ref-counting, but none of the other Xen
subdrivers. It seems unnecessary to me and can be removed without
problems.
Signed-off-by: Chris Lalancette <clalance@redhat.com>
(cherry picked from commit 6ed7374c5a6c6a2b1b1801d7d041dc7f09748592)
Fedora-patch: libvirt-fix-xen-driver-refcounting.patch
---
src/xen_inotify.c | 2 --
src/xs_internal.c | 3 ---
2 files changed, 0 insertions(+), 5 deletions(-)
diff --git a/src/xen_inotify.c b/src/xen_inotify.c
index e312b9e..ecaefaf 100644
--- a/src/xen_inotify.c
+++ b/src/xen_inotify.c
@@ -463,7 +463,6 @@ xenInotifyOpen(virConnectPtr conn ATTRIBUTE_UNUSED,
DEBUG0("Failed to add inotify handle, disabling events");
}
- virConnectRef(conn);
return 0;
}
@@ -486,7 +485,6 @@ xenInotifyClose(virConnectPtr conn)
if (priv->inotifyWatch != -1)
virEventRemoveHandle(priv->inotifyWatch);
close(priv->inotifyFD);
- virUnrefConnect(conn);
return 0;
}
diff --git a/src/xs_internal.c b/src/xs_internal.c
index 1f54b1f..a18dcad 100644
--- a/src/xs_internal.c
+++ b/src/xs_internal.c
@@ -1139,8 +1139,6 @@ int xenStoreAddWatch(virConnectPtr conn,
list->watches[n] = watch;
list->count++;
- conn->refs++;
-
return xs_watch(priv->xshandle, watch->path, watch->token);
}
@@ -1190,7 +1188,6 @@ int xenStoreRemoveWatch(virConnectPtr conn,
; /* Failure to reduce memory allocation isn't fatal */
}
list->count--;
- virUnrefConnect(conn);
return 0;
}
}
--
1.6.2.5

20
libvirt.spec
View File

@ -199,6 +199,18 @@ Patch17: libvirt-qemu-machine-type-fixes2.patch
Patch18: libvirt-storage-iscsi-auth-xml-formatting.patch
Patch19: libvirt-network-delay-attribute-formatting.patch
# Fix xen driver recounting (#531429)
Patch20: libvirt-fix-xen-driver-refcounting.patch
# Fix crash on virsh error (#531429)
Patch21: libvirt-double-free-on-virsh-error.patch
# Fix segfault where XML parsing fails in qemu disk hotplug
Patch22: libvirt-fix-crash-on-device-hotplug-parse-error.patch
# Fix segfault where interface target device name is ommitted (#523418)
Patch23: libvirt-fix-crash-on-missing-iface-target-dev.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
URL: http://libvirt.org/
BuildRequires: python-devel
@ -433,6 +445,10 @@ of recent versions of Linux (and other OSes).
%patch17 -p1
%patch18 -p1
%patch19 -p1
%patch20 -p1
%patch21 -p1
%patch22 -p1
%patch23 -p1
%build
# Needed for libvirt-logrotate-create-lxc-uml-dirs.patch
@ -829,6 +845,10 @@ fi
%changelog
* Thu Oct 29 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-14
- Make libvirt-devel require libvirt-client, not libvirt
- Fix xen driver recounting (#531429)
- Fix crash on virsh error (#531429)
- Fix segfault where XML parsing fails in qemu disk hotplug
- Fix segfault where interface target device name is ommitted (#523418)
* Mon Oct 19 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-13
- Misc fixes to qemu machine types handling