From 16d9a3df94f21039a9f01d948ba327f36f3c63ab Mon Sep 17 00:00:00 2001
From: Laine Stump <laine@laine.org>
Date: Fri, 14 Sep 2012 04:53:54 -0400
Subject: [PATCH] conf: avoid freeing network object with undestroyed mutex

virNetworkAssignDef was allocating a new network object, initing and
grabbing its lock, then potentially freeing it without unlocking or
destroying the lock. In practice 1) this will probably never happen,
and 2) even if it did, the lock implementation used on most (all?)
platforms doesn't actually hold any resources for an initialized or
held lock, but it still bothered me, so I moved the realloc that could
lead to this bad situation earlier in the function, and now the mutex
isn't inited or locked until we are assured of complete success.
---
 src/conf/network_conf.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index d916427b99..88e1492f57 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -245,6 +245,11 @@ virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets,
         return network;
     }
 
+    if (VIR_REALLOC_N(nets->objs, nets->count + 1) < 0) {
+        virReportOOMError();
+        return NULL;
+    }
+
     if (VIR_ALLOC(network) < 0) {
         virReportOOMError();
         return NULL;
@@ -258,12 +263,6 @@ virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets,
     virNetworkObjLock(network);
     network->def = def;
 
-    if (VIR_REALLOC_N(nets->objs, nets->count + 1) < 0) {
-        virReportOOMError();
-        VIR_FREE(network);
-        return NULL;
-    }
-
     nets->objs[nets->count] = network;
     nets->count++;