On Sun, Aug 02, 2026 at 08:42:06PM +0700, Ross Golder wrote: > virNetMessageQueuePush() appends by walking to the tail of the queue. If > it is handed a message which is already in that queue, and that message > happens to be the tail, it links the message to itself. The cycle then > makes virNetMessageQueueServe() return the same pointer on consecutive > calls, and callers which free what they are served - such as > virNetServerClientDispatchWrite() - free it twice, aborting the process > with "free(): invalid pointer". > > Refuse such a push and warn instead, so that a caller bug shows up as a > diagnosable log message rather than as heap corruption some time later. > > The check has to walk the queue rather than just test msg->next, because > virNetMessageClear() memsets the whole message: a queued message which > has been cleared appears unlinked while still being referenced. > > Also break the cycle in virNetMessageQueueServe() if one is somehow > already present, rather than handing out the same message indefinitely, > and clear msg->next in virNetMessageFree() so a stale reference held by a > queue is detectable instead of dangling. > > The accompanying test reproduces the self-cycle deterministically: with > the check removed it fails with "Message linked to itself". > > Signed-off-by: Ross Golder <[email protected]> > --- > src/rpc/virnetmessage.c | 43 +++++++++++++++++++ > tests/virnetmessagetest.c | 87 +++++++++++++++++++++++++++++++++++++++ > 2 files changed, 130 insertions(+)
Reviewed-by: Daniel P. Berrangé <[email protected]> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
