[PATCH v2] qemu: Fix crash on failed VM startup

[Cole Robinson <crobinso@xxxxxxxxxx>]

If VM startup fails early enough (can't find a referenced USB device),
libvirtd will crash trying to clear the VNC port bit, since port = 0,
which overflows us out of the bitmap bounds.

Fix this by being more defensive in the bitmap operations, and only
clearing a previously set VNC port.

v2: Add safety check to all relevant bitmap ops.

Signed-off-by: Cole Robinson <crobinso@xxxxxxxxxx>
---
 src/qemu/qemu_driver.c |    2 +-
 src/util/bitmap.c      |    6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index c8cd50a..f5a1310 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3741,7 +3741,7 @@ retry:
     if ((vm->def->ngraphics == 1) &&
         vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
         vm->def->graphics[0]->data.vnc.autoport &&
-        vm->def->graphics[0]->data.vnc.port != -1) {
+        vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) {
         if (virBitmapClearBit(driver->reservedVNCPorts,
                               vm->def->graphics[0]->data.vnc.port - \
                               QEMU_VNC_PORT_MIN) < 0) {
diff --git a/src/util/bitmap.c b/src/util/bitmap.c
index 69094a5..cef3fc4 100644
--- a/src/util/bitmap.c
+++ b/src/util/bitmap.c
@@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap)
  */
 int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
 {
-    if (b > bitmap->size - 1)
+    if (bitmap->size <= b)
         return -1;
 
     bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b));
@@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
  */
 int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
 {
-    if (b > bitmap->size - 1)
+    if (bitmap->size <= b)
         return -1;
 
     bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b));
@@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result)
 {
     uint32_t bit;
 
-    if (b > bitmap->size - 1)
+    if (bitmap->size <= b)
         return -1;
 
     bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &
-- 
1.6.6.1

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list