On Wed, Jun 02, 2010 at 10:55:17AM -0400, Cole Robinson wrote: > If VM startup fails early enough (can't find a referenced USB device), > libvirtd will crash trying to clear the VNC port bit, since port = 0, > which overflows us out of the bitmap bounds. > > Fix this by being more defensive in the bitmap operations, and only > clearing a previously set VNC port. > > v2: Add safety check to all relevant bitmap ops. > > Signed-off-by: Cole Robinson <crobinso(a)redhat.com&gt; > --- > src/qemu/qemu_driver.c | 2 +- > src/util/bitmap.c | 6 +++--- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c > index c8cd50a..f5a1310 100644 > --- a/src/qemu/qemu_driver.c > +++ b/src/qemu/qemu_driver.c > @@ -3741,7 +3741,7 @@ retry: > if ((vm->def->ngraphics == 1) && > vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && > vm->def->graphics[0]->data.vnc.autoport && > - vm->def->graphics[0]->data.vnc.port != -1) { > + vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) { > if (virBitmapClearBit(driver->reservedVNCPorts, > vm->def->graphics[0]->data.vnc.port - \ > QEMU_VNC_PORT_MIN) < 0) { > diff --git a/src/util/bitmap.c b/src/util/bitmap.c > index 69094a5..cef3fc4 100644 > --- a/src/util/bitmap.c > +++ b/src/util/bitmap.c > @@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap) > */ > int virBitmapSetBit(virBitmapPtr bitmap, size_t b) > { > - if (b > bitmap->size - 1) > + if (bitmap->size <= b) > return -1; > > bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b)); > @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b) > */ > int virBitmapClearBit(virBitmapPtr bitmap, size_t b) > { > - if (b > bitmap->size - 1) > + if (bitmap->size <= b) > return -1; > > bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b)); > @@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) > { > uint32_t bit; > > - if (b > bitmap->size - 1) > + if (bitmap->size <= b) > return -1; > > bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & ACK, this patch doesn't seem to have ever been pushed - current GIT still crashes on abort of VM startup Daniel