qemu: Fix handling of passed FDs in remoteDispatchDomainFdAssociate

To ensure same behaviour when remote driver is or is not used we must
not steal the FDs and array holding them passed to qemuDomainFDAssociate
but rather duplicate them. At the same time the remote driver must close
and free them to prevent leak.

Pointed out by Coverity as FD leak on error path:

 *** CID 404348:  Resource leaks  (RESOURCE_LEAK)
 /src/remote/remote_daemon_dispatch.c: 7484 in remoteDispatchDomainFdAssociate()
 7478         rv = 0;
 7479
 7480      cleanup:
 7481         if (rv < 0)
 7482             virNetMessageSaveError(rerr);
 7483         virObjectUnref(dom);
 >>>     CID 404348:  Resource leaks  (RESOURCE_LEAK)
 >>>     Variable "fds" going out of scope leaks the storage it points to.
 7484         return rv;

Fixes: abd9025c2f
Fixes: f762f87534
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
Peter Krempa 2023-01-10 14:31:27 +01:00
parent 8f93d546d1
commit d7e9093502
2 changed files with 15 additions and 3 deletions

View File

@ -20442,7 +20442,8 @@ qemuDomainFDAssociate(virDomainPtr domain,
{
virDomainObj *vm = NULL;
qemuDomainObjPrivate *priv;
virStorageSourceFDTuple *new;
g_autoptr(virStorageSourceFDTuple) new = NULL;
size_t i;
int ret = -1;
virCheckFlags(VIR_DOMAIN_FD_ASSOCIATE_SECLABEL_RESTORE |
@ -20460,8 +20461,16 @@ qemuDomainFDAssociate(virDomainPtr domain,
priv = vm->privateData;
new = virStorageSourceFDTupleNew();
new->fds = fds;
new->nfds = nfds;
new->fds = g_new0(int, new->nfds);
for (i = 0; i < new->nfds; i++) {
if ((new->fds[i] = dup(fds[i])) < 0) {
virReportSystemError(errno,
_("failed to duplicate passed fd with index '%zu'"),
i);
goto cleanup;
}
}
new->conn = domain->conn;
new->writable = flags & VIR_DOMAIN_FD_ASSOCIATE_SECLABEL_WRITABLE;
@ -20469,7 +20478,7 @@ qemuDomainFDAssociate(virDomainPtr domain,
virCloseCallbacksDomainAdd(vm, domain->conn, qemuDomainFDHashCloseConnect);
g_hash_table_insert(priv->fds, g_strdup(name), new);
g_hash_table_insert(priv->fds, g_strdup(name), g_steal_pointer(&new));
ret = 0;

View File

@ -7478,6 +7478,9 @@ remoteDispatchDomainFdAssociate(virNetServer *server G_GNUC_UNUSED,
rv = 0;
cleanup:
for (i = 0; i < nfds; i++)
VIR_FORCE_CLOSE(fds[i]);
g_free(fds);
if (rv < 0)
virNetMessageSaveError(rerr);
virObjectUnref(dom);