From b07f3d821dfb11a118ee75ea275fd6ab737d9500 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 18 Dec 2014 16:34:39 +0000
Subject: [PATCH] Don't setup fake CPU pids for old QEMU

The code assumes that def->vcpus == nvcpupids, so when we setup
fake CPU pids for old QEMU with nvcpupids == 1, we cause the
later code to read off the end of the array. This has fun results
like sche_setaffinity(0, ...) which changes libvirtd's own CPU
affinity, or even better sched_setaffinity($RANDOM, ...) which
changes the affinity of a random OS process.
---
 src/qemu/qemu_process.c | 9 ++++-----
 src/util/virprocess.c   | 1 +
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index d683918e9a..b067f1846a 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -2240,10 +2240,8 @@ qemuProcessDetectVcpuPIDs(virQEMUDriverPtr driver,
         qemuDomainObjExitMonitor(driver, vm);
         virResetLastError();
 
-        priv->nvcpupids = 1;
-        if (VIR_ALLOC_N(priv->vcpupids, priv->nvcpupids) < 0)
-            return -1;
-        priv->vcpupids[0] = vm->pid;
+        priv->nvcpupids = 0;
+        priv->vcpupids = NULL;
         return 0;
     }
     qemuDomainObjExitMonitor(driver, vm);
@@ -2462,7 +2460,8 @@ qemuProcessSetVcpuAffinities(virDomainObjPtr vm)
     virDomainVcpuPinDefPtr pininfo;
     int n;
     int ret = -1;
-
+    VIR_DEBUG("Setting affinity on CPUs nvcpupin=%zu nvcpus=%d nvcpupids=%d",
+              def->cputune.nvcpupin, def->vcpus, priv->nvcpupids);
     if (!def->cputune.nvcpupin)
         return 0;
 
diff --git a/src/util/virprocess.c b/src/util/virprocess.c
index 0c8a32f373..d0a1500cf2 100644
--- a/src/util/virprocess.c
+++ b/src/util/virprocess.c
@@ -399,6 +399,7 @@ int virProcessSetAffinity(pid_t pid, virBitmapPtr map)
 {
     size_t i;
     bool set = false;
+    VIR_DEBUG("Set process affinity on %lld\n", (long long)pid);
 # ifdef CPU_ALLOC
     /* New method dynamically allocates cpu mask, allowing unlimted cpus */
     int numcpus = 1024;