Fix modifying disk devices in qemu driver

When modifying the disk devices of a live domain and the domain
configuration, the function qemuDomainAttachDeviceConfig
first sets dev->data->disk to NULL. Later qemuDomainAttachDeviceLive
accesses dev->data.disk and causes a segfault.
* src/qemu/qemu_driver.c: fix qemuDomainModifyDeviceFlags() accordingly

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 6511ffd9764b4d8764c37df8a6d28cbb35241906..c5394749442fa9215ac0bf12bcc513aef37fc6e0 100644 (file)
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -4418,12 +4418,13 @@ qemuDomainModifyDeviceFlags(virDomainPtr dom, const char *xml,
                          "%s", _("cannot modify device on transient domain"));
          goto endjob;
     }
-    dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
-                                  VIR_DOMAIN_XML_INACTIVE);
-    if (dev == NULL)
-        goto endjob;
 
     if (flags & VIR_DOMAIN_DEVICE_MODIFY_CONFIG) {
+        dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
+                                      VIR_DOMAIN_XML_INACTIVE);
+        if (dev == NULL)
+            goto endjob;
+
         /* Make a copy for updated domain. */
         vmdef = virDomainObjCopyPersistentDef(driver->caps, vm);
         if (!vmdef)
@@ -4447,6 +4448,13 @@ qemuDomainModifyDeviceFlags(virDomainPtr dom, const char *xml,
         ret = 0;
 
     if (!ret && (flags & VIR_DOMAIN_DEVICE_MODIFY_LIVE)) {
+        /* If dev exists it was created to modify the domain config. Free it. */
+        virDomainDeviceDefFree(dev);
+        dev = virDomainDeviceDefParse(driver->caps, vm->def, xml,
+                                      VIR_DOMAIN_XML_INACTIVE);
+        if (dev == NULL)
+            goto endjob;
+
         switch (action) {
         case QEMU_DEVICE_ATTACH:
             ret = qemuDomainAttachDeviceLive(vm, dev, dom);