If vm->def->cputune.nvcpupin is 0 in libxlDomainSetVcpuAffinities (as
seems to be the case on arm) then the VIR_FREE after cleanup: would be
operating on an uninitialised pointer in map.map.
Fix this by using libxl_bitmap_init and libxl_bitmap_dispose in the
appropriate places (like VIR_FREE libxl_bitmap_dispose is also
idempotent, so there is no double free on exit from the loop).
libxl_bitmap_dispose is slightly preferable since it also sets
map.size back to 0, avoiding a potential source of confusion.
This fixes the crashes we've been seeing in the Xen automated tests on
ARM.
I had a glance at the handful of other users of libxl_bitmap and none
of them looked to have a similar issue.
Signed-off-by: Ian Campbell <ian.campbell(a)citrix.com>
---
src/libxl/libxl_domain.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c
index 0652270..0904b78 100644
--- a/src/libxl/libxl_domain.c
+++ b/src/libxl/libxl_domain.c
@@ -789,6 +789,8 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr driver,
virDomainObjPtr vm)
size_t i;
int ret = -1;
+ libxl_bitmap_init(&map);
+
for (i = 0; i < vm->def->cputune.nvcpupin; ++i) {
pin = vm->def->cputune.vcpupin[i];
cpumask = pin->cpumask;
@@ -802,13 +804,13 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr driver,
virDomainObjPtr vm)
goto cleanup;
}
- VIR_FREE(map.map);
+ libxl_bitmap_dispose(&map); /* Also returns to freshly-init'd state */
}
ret = 0;
cleanup:
- VIR_FREE(map.map);
+ libxl_bitmap_dispose(&map);
virObjectUnref(cfg);
return ret;
}
--
1.7.10.4