]> git.ipfire.org Git - thirdparty/libvirt.git/commit
remote: fix stale status snapshot in daemonStreamHandleWrite master
authorDenis V. Lunev via Devel <devel@lists.libvirt.org>
Wed, 22 Jul 2026 08:36:31 +0000 (10:36 +0200)
committerMichal Privoznik <mprivozn@redhat.com>
Mon, 10 Aug 2026 13:00:05 +0000 (15:00 +0200)
commite791c090ea75956aeb0663cee75d02cd3adfbeca
tree9158302c1c0258f779c095f0064b3fe092638e03
parente3da3cf552513e7253294b40f634228918902635
remote: fix stale status snapshot in daemonStreamHandleWrite

daemonStreamHandleWrite() snapshots status from msg->header.status
before dispatching to the per-type handler, then reuses that stale
snapshot afterwards to decide whether to send a fake release reply.
A stale snapshot lets it send that reply twice for the same 'msg',
linking the message to itself and deadlooping the event loop thread
in virNetMessageQueuePush()'s tail-walk loop.

Remove the 'status' variable and read msg->header.status directly
at the point of use instead. Commit 411cbe7199c ("remote: fix
stream use-after-free") introduced it alongside its real fix: it
also moved virNetMessageQueueServe() to dequeue 'msg' from
stream->rx before dispatch instead of after, which is what actually
prevents corrupting stream->rx's linkage and remains unchanged
here. The variable itself was never load-bearing: no dispatch
handler frees 'msg' on the path that reaches this check, so reading
msg->header.status straight from 'msg' cannot go stale.

Fixes: 411cbe7199ce ("remote: fix stream use-after-free")
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
src/remote/remote_daemon_stream.c