check whether qemuMonitorJSONHMP() failed

If qemu quited unexpectedly when we call qemuMonitorJSONHMP(),
libvirt will crash.
Steps to reproduce this bug:
1. use gdb to attach libvirtd, and set a breakpoint in the function
   qemuMonitorSetCapabilities()
2. start a vm
3. let the libvirtd to run until qemuMonitorJSONSetCapabilities() returns.
4. kill the qemu process
5. continue running libvirtd

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>

diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
index e35906c3cb5ab2382e83620af6a135e576cc2c61..2d28f8d2c8e6a354de1f641a055a455fd4f0a90e 100644 (file)
--- a/src/qemu/qemu_monitor.c
+++ b/src/qemu/qemu_monitor.c
@@ -908,7 +908,16 @@ int qemuMonitorSetCapabilities(qemuMonitorPtr mon)
 
     if (mon->json) {
         ret = qemuMonitorJSONSetCapabilities(mon);
-        mon->json_hmp = qemuMonitorJSONCheckHMP(mon);
+        if (ret == 0) {
+            int hmp = qemuMonitorJSONCheckHMP(mon);
+            if (hmp < 0) {
+                /* qemu may quited unexpectedly when we call
+                 * qemuMonitorJSONCheckHMP() */
+                ret = -1;
+            } else {
+                mon->json_hmp = hmp > 0;
+            }
+        }
     } else {
         ret = 0;
     }

diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
index 6bd03d6cfaee10a28a3fa6aeafb1c6bba4c836a9..20a78e14456d790539d3ecc95e20bc9b3bb42cb0 100644 (file)
--- a/src/qemu/qemu_monitor_json.c
+++ b/src/qemu/qemu_monitor_json.c
@@ -746,10 +746,14 @@ qemuMonitorJSONSetCapabilities(qemuMonitorPtr mon)
 }
 
 
+/*
+ * Returns: 0 if human-monitor-command is not supported, +1 if
+ * human-monitor-command worked or -1 on failure
+ */
 int
 qemuMonitorJSONCheckHMP(qemuMonitorPtr mon)
 {
-    int ret = 0;
+    int ret = -1;
     virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("query-commands", NULL);
     virJSONValuePtr reply = NULL;
     virJSONValuePtr data;
@@ -781,6 +785,9 @@ qemuMonitorJSONCheckHMP(qemuMonitorPtr mon)
         }
     }
 
+    /* human-monitor-command is not supported */
+    ret = 0;
+
 cleanup:
     virJSONValueFree(cmd);
     virJSONValueFree(reply);