Fix race in starting transient VMs

When starting a transient VM the first thing done is to check
for duplicates. The check looks if there are any running VMs
with the matching name/uuid. It explicitly allows there to
be inactive VMs, so that a persistent VM can be temporarily
booted with a different config.

There is a race condition, however, where 2 or more clients
try to create the same transient VM. The first client will
cause a virDomainObjPtr to be added to the domain list, and
it is inactive at this stage. The second client may then
come along and see this inactive VM, and mistake it for a
persistent VM.

If the first VM fails to start its transient guest for any
reason, then it'll remove the virDomainObjPtr from the list.
The second client now has a virDomainObjPtr that it can try
to boot, which libvirt no longer has a record of. The result
can be a running QEMU process that is orphaned.

It was also, however, possible for the virDomainObjPtr to be
completely free'd which will cause libvirtd to crash in some
scenarios.

The fix is to only allow an existing inactive VM if it is
marked as persistent.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 51c4e29ba73c6165c64c59159593b85cbf2fb4a5..78496937d49a696351479484af34169975d228fa 100644 (file)
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -2167,7 +2167,13 @@ virDomainObjListAddLocked(virDomainObjListPtr doms,
             /* UUID & name match, but if VM is already active, refuse it */
             if (virDomainObjIsActive(vm)) {
                 virReportError(VIR_ERR_OPERATION_INVALID,
-                               _("domain is already active as '%s'"),
+                               _("domain '%s' is already active"),
+                               vm->def->name);
+                goto error;
+            }
+            if (!vm->persistent) {
+                virReportError(VIR_ERR_OPERATION_INVALID,
+                               _("domain '%s' is already being started"),
                                vm->def->name);
                 goto error;
             }