virNetworkAssignDef was allocating a new network object, initing and grabbing its lock, then potentially freeing it without unlocking or destroying the lock. In practice 1) this will probably never happen, and 2) even if it did, the lock implementation used on most (all?) platforms doesn't actually hold any resources for an initialized or held lock, but it still bothered me, so I moved the realloc that could lead to this bad situation earlier in the function, and now the mutex isn't inited or locked until we are assured of complete success. --- src/conf/network_conf.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index d916427..88e1492 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -245,6 +245,11 @@ virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets, return network; } + if (VIR_REALLOC_N(nets->objs, nets->count + 1) < 0) { + virReportOOMError(); + return NULL; + } + if (VIR_ALLOC(network) < 0) { virReportOOMError(); return NULL; @@ -258,12 +263,6 @@ virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets, virNetworkObjLock(network); network->def = def; - if (VIR_REALLOC_N(nets->objs, nets->count + 1) < 0) { - virReportOOMError(); - VIR_FREE(network); - return NULL; - } - nets->objs[nets->count] = network; nets->count++; -- 1.7.11.4 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list