[PATCH 1/2] bhyve: fix crash in bhyveBuildNetArgStr

[Roman Bogorodskiy <bogorodskiy@xxxxxxxxx>]

bhyveBuildNetArgStr() calls virNetDevTapCreateInBridgePort() and
passes tapfd = NULL, but tapfdSize = 1. That is wrong, because
if virNetDevTapCreateInBridgePort() crashes after successfully
creating a TAP device, it'll jump to 'error' label, that
loops over tapfd and calls VIR_FORCE_CLOSE:

   for (i = 0; i < tapfdSize && tapfd[i] >= 0; i++)

In that case we get a segfault.

As the bhyve code doesn't use tapfd, pass NULL and set tapfdSize to 0.
---
 src/bhyve/bhyve_command.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c
index d3b3f69..f1862fe 100644
--- a/src/bhyve/bhyve_command.c
+++ b/src/bhyve/bhyve_command.c
@@ -46,7 +46,6 @@ bhyveBuildNetArgStr(const virDomainDef *def,
 {
     char macaddr[VIR_MAC_STRING_BUFLEN];
     char *realifname = NULL;
-    int *tapfd = NULL;
     char *brname = NULL;
     int actualType = virDomainNetGetActualType(net);
 
@@ -72,7 +71,7 @@ bhyveBuildNetArgStr(const virDomainDef *def,
 
     if (!dryRun) {
         if (virNetDevTapCreateInBridgePort(brname, &net->ifname, &net->mac,
-                                           def->uuid, tapfd, 1,
+                                           def->uuid, NULL, 0,
                                            virDomainNetGetActualVirtPortProfile(net),
                                            virDomainNetGetActualVlan(net),
                                            VIR_NETDEV_TAP_CREATE_IFUP | VIR_NETDEV_TAP_CREATE_PERSIST) < 0) {
-- 
1.9.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list