[Xen-devel] [PATCH libvirt] libxl: avoid freeing an uninitialised bitmap

[Ian Campbell <ian.campbell@xxxxxxxxxx>]

If vm->def->cputune.nvcpupin is 0 in libxlDomainSetVcpuAffinities (as
seems to be the case on arm) then the VIR_FREE after cleanup: would be
operating on an uninitialised pointer in map.map.

Fix this by using libxl_bitmap_init and libxl_bitmap_dispose in the
appropriate places (like VIR_FREE libxl_bitmap_dispose is also
idempotent, so there is no double free on exit from the loop).

libxl_bitmap_dispose is slightly preferable since it also sets
map.size back to 0, avoiding a potential source of confusion.

This fixes the crashes we've been seeing in the Xen automated tests on
ARM.

I had a glance at the handful of other users of libxl_bitmap and none
of them looked to have a similar issue.

Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 src/libxl/libxl_domain.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c
index 0652270..0904b78 100644
--- a/src/libxl/libxl_domain.c
+++ b/src/libxl/libxl_domain.c
@@ -789,6 +789,8 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr driver, 
virDomainObjPtr vm)
     size_t i;
     int ret = -1;
 
+    libxl_bitmap_init(&map);
+
     for (i = 0; i < vm->def->cputune.nvcpupin; ++i) {
         pin = vm->def->cputune.vcpupin[i];
         cpumask = pin->cpumask;
@@ -802,13 +804,13 @@ libxlDomainSetVcpuAffinities(libxlDriverPrivatePtr 
driver, virDomainObjPtr vm)
             goto cleanup;
         }
 
-        VIR_FREE(map.map);
+        libxl_bitmap_dispose(&map); /* Also returns to freshly-init'd state */
     }
 
     ret = 0;
 
  cleanup:
-    VIR_FREE(map.map);
+    libxl_bitmap_dispose(&map);
     virObjectUnref(cfg);
     return ret;
 }
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel