On 04/28/2012 07:01 AM, Alex Jia wrote:
In fact, the 'tapfd' is always NULL, the function
'virNetDevTapCreate()' hasn't
assign 'fd' to 'tapfd', when the function 'virNetDevSetMAC()' is
failed then
goto 'error' lable, finally, the VIR_FORCE_CLOSE() will deref a NULL
'tapfd'.
--- a/src/util/virnetdevtap.c
+++ b/src/util/virnetdevtap.c
@@ -341,7 +341,8 @@ int virNetDevTapCreateInBridgePort(const char *brname,
return 0;
error:
- VIR_FORCE_CLOSE(*tapfd);
+ if (tapfd)
+ VIR_FORCE_CLOSE(*tapfd);
return errno;
}
ACK