From cc99d240f5e71209c887f8be7a3561a539704bed Mon Sep 17 00:00:00 2001 From: Ian Campbell Date: Fri, 19 Jun 2015 17:33:30 +0100 Subject: [PATCH] libxl: avoid freeing an uninitialised bitmap If vm->def->cputune.nvcpupin is 0 in libxlDomainSetVcpuAffinities (as seems to be the case on arm) then the VIR_FREE after cleanup: would be operating on an uninitialised pointer in map.map. Fix this by using libxl_bitmap_init and libxl_bitmap_dispose in the appropriate places (like VIR_FREE, libxl_bitmap_dispose is also idempotent, so there is no double free on exit from the loop). libxl_bitmap_dispose is slightly preferable since it also sets map.size back to 0, avoiding a potential source of confusion. This fixes the crashes we've been seeing in the Xen automated tests on ARM. I had a glance at the handful of other users of libxl_bitmap and none of them looked to have a similar issue. Signed-off-by: Ian Campbell --- src/libxl/libxl_domain.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c index ebd7964198..8e8a29216f 100644 --- a/src/libxl/libxl_domain.c +++ b/src/libxl/libxl_domain.c @@ -791,6 +791,8 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr driver, virDomainObjPtr vm) size_t i; int ret = -1; + libxl_bitmap_init(&map); + for (i = 0; i < vm->def->cputune.nvcpupin; ++i) { pin = vm->def->cputune.vcpupin[i]; cpumask = pin->cpumask; @@ -804,13 +806,13 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr driver, virDomainObjPtr vm) goto cleanup; } - VIR_FREE(map.map); + libxl_bitmap_dispose(&map); /* Also returns to freshly-init'd state */ } ret = 0; cleanup: - VIR_FREE(map.map); + libxl_bitmap_dispose(&map); virObjectUnref(cfg); return ret; }