From 2fe93123bfb6e3bc373b3cc70c60522235c9c931 Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Wed, 22 Mar 2017 13:07:14 +0100 Subject: [PATCH] network: Don't crash on domain destroy https://bugzilla.redhat.com/show_bug.cgi?id=1434882 Imagine the following scenario: 1) virsh net-start default 2) virsh start myFavouriteDomain 3) virsh net-destroy default 4) virsh destroy myFavouriteDomain (assuming myFavouriteDomain has an interface from default network) Regardless of how unlikely this scenario looks like, we should not crash. The problem is, on net-destroy in networkShutdownNetworkVirtual() the virMacMap module is unrefed, but the stale pointer is kept around. Thus when the domain destroy procedure comes in, networkReleaseActualDevice() and subsequently networkMacMgrDel() is called. This function sees the stale pointer and starts calling the virMacMap module APIs which work over freed memory. Signed-off-by: Michal Privoznik --- src/network/bridge_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 3270dc5007..ef982363b4 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2490,7 +2490,8 @@ networkShutdownNetworkVirtual(virNetworkDriverStatePtr driver, if (network->def->bandwidth) virNetDevBandwidthClear(network->def->bridge); - virObjectUnref(network->macmap); + if (!virObjectUnref(network->macmap)) + network->macmap = NULL; if (network->radvdPid > 0) { char *radvdpidbase;