From: Martin Kletzander <mkletzan@redhat.com>
Date: Wed, 20 Jul 2016 07:23:03 +0000 (+0200)
Subject: lxc: Don't crash by forgetting to ref transient domains
X-Git-Tag: v2.1.0-rc1~61
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4200bbb9d9bbc58a51ca55c6073146126447afb;p=thirdparty%2Flibvirt.git

lxc: Don't crash by forgetting to ref transient domains

So commit 306b3a8504 tried mimicking behaviour of commit 540c339a25, but
added a virObjectRef(vm) only after virDomainObjListAdd() in
lxcDomainDefineXMLFlags() and not in lxcDomainCreateXMLWithFiles().
That way undefining a domain that was started with different XML than
defined will leave the domain object in a state with not enough
references to then remove it.  Hence any lxcDomainDestroyFlags() called
afterwards crashes the daemon.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1351057

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
---

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 46af05d439..2e6788af09 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -1247,6 +1247,7 @@ lxcDomainCreateXMLWithFiles(virConnectPtr conn,
                                    VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE,
                                    NULL)))
         goto cleanup;
+    virObjectRef(vm);
     def = NULL;
 
     if (virLXCDomainObjBeginJob(driver, vm, LXC_JOB_MODIFY) < 0) {