On Wed, Jun 02, 2010 at 10:55:17AM -0400, Cole Robinson wrote:
> If VM startup fails early enough (can't find a referenced USB device),
> libvirtd will crash trying to clear the VNC port bit, since port = 0,
> which overflows us out of the bitmap bounds.
>
> Fix this by being more defensive in the bitmap operations, and only
> clearing a previously set VNC port.
>
> v2: Add safety check to all relevant bitmap ops.
>
> Signed-off-by: Cole Robinson <crobinso@xxxxxxxxxx>
> ---
> src/qemu/qemu_driver.c | 2 +-
> src/util/bitmap.c | 6 +++---
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
> index c8cd50a..f5a1310 100644
> --- a/src/qemu/qemu_driver.c
> +++ b/src/qemu/qemu_driver.c
> @@ -3741,7 +3741,7 @@ retry:
> if ((vm->def->ngraphics == 1) &&
> vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
> vm->def->graphics[0]->data.vnc.autoport &&
> - vm->def->graphics[0]->data.vnc.port != -1) {
> + vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) {
> if (virBitmapClearBit(driver->reservedVNCPorts,
> vm->def->graphics[0]->data.vnc.port - \
> QEMU_VNC_PORT_MIN) < 0) {
> diff --git a/src/util/bitmap.c b/src/util/bitmap.c
> index 69094a5..cef3fc4 100644
> --- a/src/util/bitmap.c
> +++ b/src/util/bitmap.c
> @@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap)
> */
> int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
> {
> - if (b > bitmap->size - 1)
> + if (bitmap->size <= b)
> return -1;
>
> bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b));
> @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
> */
> int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
> {
> - if (b > bitmap->size - 1)
> + if (bitmap->size <= b)
> return -1;
>
> bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b));
> @@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result)
> {
> uint32_t bit;
>
> - if (b > bitmap->size - 1)
> + if (bitmap->size <= b)
> return -1;
>
> bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &
ACK, this patch doesn't seem to have ever been pushed - current GIT still
crashes on abort of VM startup
Daniel
--
|: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list