From: Osier Yang <jyang@redhat.com>
Date: Wed, 21 Nov 2012 03:22:39 +0000 (+0800)
Subject: storage: Fix bug of fs pool destroying
X-Git-Tag: CVE-2012-3411~93
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f4ac06569a8ffce24fb8c07a0fc01574e38de6e4;p=thirdparty%2Flibvirt.git

storage: Fix bug of fs pool destroying

Regression introduced by commit 258e06c85b7, "ret" could be set to 1
or 0 by virStorageBackendFileSystemIsMounted before goto cleanup.
This could mislead the callers (up to the public API
virStoragePoolDestroy) to return success even the underlying umount
command fails.
---

diff --git a/src/storage/storage_backend_fs.c b/src/storage/storage_backend_fs.c
index 332267759f..2d175ba844 100644
--- a/src/storage/storage_backend_fs.c
+++ b/src/storage/storage_backend_fs.c
@@ -449,6 +449,7 @@ static int
 virStorageBackendFileSystemUnmount(virStoragePoolObjPtr pool) {
     virCommandPtr cmd = NULL;
     int ret = -1;
+    int rc;
 
     if (pool->def->type == VIR_STORAGE_POOL_NETFS) {
         if (pool->def->source.nhost != 1) {
@@ -475,12 +476,8 @@ virStorageBackendFileSystemUnmount(virStoragePoolObjPtr pool) {
     }
 
     /* Short-circuit if already unmounted */
-    if ((ret = virStorageBackendFileSystemIsMounted(pool)) != 1) {
-        if (ret < 0)
-            return -1;
-        else
-            return 0;
-    }
+    if ((rc = virStorageBackendFileSystemIsMounted(pool)) != 1)
+        return rc;
 
     cmd = virCommandNewArgList(UMOUNT,
                                pool->def->target.path,