From: Michal Privoznik Date: Fri, 24 May 2019 14:35:38 +0000 (+0200) Subject: virStoragePoolObjListForEach: Grab a reference for pool object X-Git-Tag: v5.7.0-rc1~113 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1cb98b4e999e099e35a532512d886b3778f23af;p=thirdparty%2Flibvirt.git virStoragePoolObjListForEach: Grab a reference for pool object Turns out there's one callback that might remove a storage pool during its run: storagePoolUpdateAllState() call storagePoolUpdateStateCallback() which may call virStoragePoolUpdateInactive() which in turn may call virStoragePoolObjRemove(). Problem is that the UpdateStateCallback() sees a storage pool object with just two references: one for each hash table holding the object. If the function ends up calling ObjRemove() then upon removing the object from hash tables those references are gone and thus any subsequent call touching the object is invalid. The solution to this problem is to grab reference for the object we are running iterator with. Signed-off-by: Michal Privoznik Reviewed-by: Ján Tomko --- diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c index 0b83c2d2de..5e64467515 100644 --- a/src/conf/virstorageobj.c +++ b/src/conf/virstorageobj.c @@ -411,9 +411,13 @@ virStoragePoolObjListForEachCb(void *payload, virStoragePoolObjPtr obj = payload; struct _virStoragePoolObjListForEachData *data = opaque; + /* Grab a reference so that we don't rely only on references grabbed by + * hash table earlier. Remember, an iterator can remove object from the + * hash table. */ + virObjectRef(obj); virObjectLock(obj); data->iter(obj, data->opaque); - virObjectUnlock(obj); + virStoragePoolObjEndAPI(&obj); return 0; }