b158f13b17
Backport the source patches from the version 7.0.0-3+deb11u3. [https://sources.debian.org/src/libvirt/7.0.0-3%2Bdeb11u3/debian/patches/] Refer to: CVE-2021-3631: https://nvd.nist.gov/vuln/detail/CVE-2021-3631 CVE-2021-3667: https://nvd.nist.gov/vuln/detail/CVE-2021-3667 CVE-2021-3975: https://nvd.nist.gov/vuln/detail/CVE-2021-3975 CVE-2021-4147: https://nvd.nist.gov/vuln/detail/CVE-2021-4147 CVE-2022-0897: https://nvd.nist.gov/vuln/detail/CVE-2022-0897 CVE-2024-1441: https://nvd.nist.gov/vuln/detail/CVE-2024-1441 CVE-2024-2494: https://nvd.nist.gov/vuln/detail/CVE-2024-2494 CVE-2024-2496: https://nvd.nist.gov/vuln/detail/CVE-2024-2496 Test Plan: Pass: downloader Pass: build-pkgs --clean --all Pass: build-image Pass: Debian AIO jenkins installation Closes-Bug: 2078664 Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Change-Id: Ic2c0d6a8208b18ec4d1db2c07fc1fb2508cef183
38 lines
1.5 KiB
Diff
38 lines
1.5 KiB
Diff
From: Peng Liang <liangpeng10@huawei.com>
|
|
Date: Wed, 24 Feb 2021 19:28:23 +0800
|
|
Subject: qemu: Add missing lock in qemuProcessHandleMonitorEOF
|
|
|
|
qemuMonitorUnregister will be called in multiple threads (e.g. threads
|
|
in rpc worker pool and the vm event thread). In some cases, it isn't
|
|
protected by the monitor lock, which may lead to call g_source_unref
|
|
more than one time and a use-after-free problem eventually.
|
|
|
|
Add the missing lock in qemuProcessHandleMonitorEOF (which is the only
|
|
position missing lock of monitor I found).
|
|
|
|
Suggested-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Origin: https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7
|
|
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2024326
|
|
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2021-3975
|
|
---
|
|
src/qemu/qemu_process.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
index 202d867..3f7355f 100644
|
|
--- a/src/qemu/qemu_process.c
|
|
+++ b/src/qemu/qemu_process.c
|
|
@@ -317,7 +317,9 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon,
|
|
/* We don't want this EOF handler to be called over and over while the
|
|
* thread is waiting for a job.
|
|
*/
|
|
+ virObjectLock(mon);
|
|
qemuMonitorUnregister(mon);
|
|
+ virObjectUnlock(mon);
|
|
|
|
/* We don't want any cleanup from EOF handler (or any other
|
|
* thread) to enter qemu namespace. */
|