On Mon, Aug 5, 2013 at 12:28 PM, Jim Fehlig <jfehlig@xxxxxxxx> wrote: > Eric Blake wrote: >> On 08/05/2013 10:39 AM, Jim Fehlig wrote: >> >>> Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains >>> by starting to populate the names array at index -1, causing all sorts >>> of havoc in libvirtd such as aborts like the following >>> >>> *** Error in `/usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20 *** >>> ======= Backtrace: ========= >>> /lib64/libc.so.6(+0x7abf6)[0x7ffff3fa0bf6] >>> /lib64/libc.so.6(+0x7b973)[0x7ffff3fa1973] >>> /lib64/libc.so.6(xdr_array+0xde)[0x7ffff403cbae] >>> /usr/sbin/libvirtd(+0x50251)[0x5555555a4251] >>> /lib64/libc.so.6(xdr_free+0x15)[0x7ffff403ccd5] >>> /usr/lib64/libvirt.so.0(+0x1fad34)[0x7ffff76b1d34] >>> /usr/lib64/libvirt.so.0(virNetServerProgramDispatch+0x1fc)[0x7ffff76b16f1] >>> /usr/lib64/libvirt.so.0(+0x1f214a)[0x7ffff76a914a] >>> /usr/lib64/libvirt.so.0(+0x1f222d)[0x7ffff76a922d] >>> /usr/lib64/libvirt.so.0(+0xbcc4f)[0x7ffff7573c4f] >>> /usr/lib64/libvirt.so.0(+0xbc5e5)[0x7ffff75735e5] >>> /lib64/libpthread.so.0(+0x7e0f)[0x7ffff48f7e0f] >>> /lib64/libc.so.6(clone+0x6d)[0x7ffff400e7dd] >>> >>> Fix by initializing ret to 0 and only setting to error on failure path. >>> --- >>> src/xen/xend_internal.c | 7 +++---- >>> 1 file changed, 3 insertions(+), 4 deletions(-) >>> >> >> ACK. >> > > Pushed now, thanks. > > Regards, > Jim > I pushed this to v1.1.1-maint as well. -- Doug Goldstein -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list