From 69977ff10560a80bcf5bf93f1a3f819a2d1623ca Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Fri, 22 Jan 2021 10:25:45 +0100 Subject: [PATCH] qemu: Avoid crash in qemuStateShutdownPrepare() and qemuStateShutdownWait() If QEMU driver fails to initialize for whatever reason (it can be as trivial as a typo on qemu.conf), the control jumps to error label in qemuStateInitialize() where qemuStateCleanup() is called which frees the driver. But the daemon then asks drivers to prepare for shutdown, which in case of QEMU driver is implemented in qemuStateShutdownPrepare(). In here, the driver is dereferenced but since it was freed earlier, the pointer is NULL which leads to instant crash. Solution is simple - just check if qemu_driver is not NULL. But doing so only in qemuStateShutdownPrepare() would push the problem down to virStateShutdownWait(), well qemuStateShutdownWait(). Therefore, duplicate the trick there too. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1895359#c14 Signed-off-by: Michal Privoznik Reviewed-by: Jiri Denemark --- src/qemu/qemu_driver.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b3e663c9d5..85f230e5d5 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1075,6 +1075,9 @@ qemuStateStop(void) static int qemuStateShutdownPrepare(void) { + if (!qemu_driver) + return 0; + virThreadPoolStop(qemu_driver->workerPool); return 0; } @@ -1094,6 +1097,9 @@ qemuDomainObjStopWorkerIter(virDomainObjPtr vm, static int qemuStateShutdownWait(void) { + if (!qemu_driver) + return 0; + virDomainObjListForEach(qemu_driver->domains, false, qemuDomainObjStopWorkerIter, NULL); virThreadPoolDrain(qemu_driver->workerPool);