[libvirt] [PATCH] BZ1072677: Avoid freeing of 0 file descriptor

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; Avoid the freeing of an array of zero file descriptors in case of error. Introduce a macro VIR_INIT_N_FD to initialize such an array's elements to -1. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; --- src/qemu/qemu_hotplug.c | 14 +++++++++++--- src/util/virfile.h | 12 ++++++++++++ 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 6703c92..b295db2 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -874,9 +874,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, tapfdSize = vhostfdSize = net->driver.virtio.queues; if (!tapfdSize) tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC_N(tapfd, tapfdSize) < 0 || - VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + if (VIR_ALLOC_N(tapfd, tapfdSize) < 0) goto cleanup; + VIR_INIT_N_FD(tapfd, tapfdSize); + if (VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + goto cleanup; + VIR_INIT_N_FD(vhostfd, vhostfdSize); if (qemuNetworkIfaceConnect(vm->def, conn, driver, net, priv->qemuCaps, tapfd, &tapfdSize) < 0) goto cleanup; @@ -885,8 +888,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, goto cleanup; } else if (actualType == VIR_DOMAIN_NET_TYPE_DIRECT) { tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC(tapfd) < 0 || VIR_ALLOC(vhostfd) < 0) + if (VIR_ALLOC(tapfd) < 0) + goto cleanup; + *tapfd = -1; + if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if ((tapfd[0] = qemuPhysIfaceConnect(vm->def, driver, net, priv->qemuCaps, VIR_NETDEV_VPORT_PROFILE_OP_CREATE)) < 0) @@ -898,6 +905,7 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, vhostfdSize = 1; if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if (qemuOpenVhostNet(vm->def, net, priv->qemuCaps, vhostfd, &vhostfdSize) < 0) goto cleanup; } diff --git a/src/util/virfile.h b/src/util/virfile.h index 20baf6f..802cf01 100644 --- a/src/util/virfile.h +++ b/src/util/virfile.h @@ -75,6 +75,18 @@ FILE *virFileFdopen(int *fdptr, const char *mode) ATTRIBUTE_RETURN_CHECK; VIR_FILE_CLOSE_PRESERVE_ERRNO | \ VIR_FILE_CLOSE_DONT_LOG)) +static inline void vir_init_n_int(int *ptr, int count, int value) +{ + int i; + + for (i = 0; i < count; i++) + ptr[i] = value; +} + +/* Initialize an array of file descriptors to -1 */ +# define VIR_INIT_N_FD(ptr, count) \ + vir_init_n_int(ptr, count, -1) + /* Opaque type for managing a wrapper around a fd. */ struct _virFileWrapperFd; -- 1.8.1.4