On 7/22/26 10:36, Denis V. Lunev via Devel wrote:
> daemonStreamHandleWrite() snapshots status from msg->header.status
> before dispatching to the per-type handler, then reuses that stale
> snapshot afterwards to decide whether to send a fake release reply.
> A stale snapshot lets it send that reply twice for the same 'msg',
> linking the message to itself and deadlooping the event loop thread
> in virNetMessageQueuePush()'s tail-walk loop.
>
> Remove the 'status' variable and read msg->header.status directly
> at the point of use instead. Commit 411cbe7199c ("remote: fix
> stream use-after-free") introduced it alongside its real fix: it
> also moved virNetMessageQueueServe() to dequeue 'msg' from
> stream->rx before dispatch instead of after, which is what actually
> prevents corrupting stream->rx's linkage and remains unchanged
> here. The variable itself was never load-bearing: no dispatch
> handler frees 'msg' on the path that reaches this check, so reading
> msg->header.status straight from 'msg' cannot go stale.
>
> Fixes: 411cbe7199ce ("remote: fix stream use-after-free")
> Signed-off-by: Denis V. Lunev <[email protected]>
> ---
> src/remote/remote_daemon_stream.c | 7 ++-----
> 1 file changed, 2 insertions(+), 5 deletions(-)
Reviewed-by: Michal Privoznik <[email protected]>
Michal
