From 529100d9f724e164a5c73608986aaedfea0be4de Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Mon, 6 Jan 2020 15:06:20 +0100 Subject: [PATCH] vircgroupv2devices: Avoid double close on map FD When allowing/denying a device in devices CGroupV2 we have to write a BPF program for it. The program we put there is merely static and all it does it looks up a device in a hash table (also known as map in BPF terminology). A map is referenced via an FD which can be acquired via virBPFCreateMap() and like any other FD it should be closed when no longer needed. However, we close it twice: the first time in virCgroupV2DevicesAttachProg() which closes it unconditionally, and the second time in either virCgroupV2DevicesCreateProg() or virCgroupV2DevicesPrepareProg(). Remove the second close. Signed-off-by: Michal Privoznik Reviewed-by: Pavel Hrdina --- src/util/vircgroupv2devices.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/src/util/vircgroupv2devices.c b/src/util/vircgroupv2devices.c index 7ea3c70efb..402ce3f86f 100644 --- a/src/util/vircgroupv2devices.c +++ b/src/util/vircgroupv2devices.c @@ -494,7 +494,7 @@ virCgroupV2DevicesReallocMap(int mapfd, int virCgroupV2DevicesCreateProg(virCgroupPtr group) { - VIR_AUTOCLOSE mapfd = -1; + int mapfd = -1; if (group->unified.devices.progfd > 0 && group->unified.devices.mapfd > 0) return 0; @@ -503,13 +503,8 @@ virCgroupV2DevicesCreateProg(virCgroupPtr group) if (mapfd < 0) return -1; - if (virCgroupV2DevicesAttachProg(group, mapfd, - VIR_CGROUP_V2_INITIAL_BPF_MAP_SIZE) < 0) { - return -1; - } - - mapfd = -1; - return 0; + return virCgroupV2DevicesAttachProg(group, mapfd, + VIR_CGROUP_V2_INITIAL_BPF_MAP_SIZE); } @@ -530,10 +525,8 @@ virCgroupV2DevicesPrepareProg(virCgroupPtr group) if (newmapfd < 0) return -1; - if (virCgroupV2DevicesAttachProg(group, newmapfd, max) < 0) { - VIR_FORCE_CLOSE(newmapfd); + if (virCgroupV2DevicesAttachProg(group, newmapfd, max) < 0) return -1; - } } return 0;