External/libvirt
1
0
Fork 0
Code

network: fix crash during cleanup from failure to allocate port

Browse Source 
During networkPortCreateXML, if networkAllocatePort() failed,
networkReleasePort() would be called, which would (in the case of
network pools of macvtap passthrough devices) attempt to find the
allocated device by comparing port->plug.direct.linkdev to each device
in the pool. Since port->plug.direct.linkdev was still NULL, the
attempted strcmp would result in a SEGV.

Calling networkReleasePort() during error cleanup is something that
should only be done if networkAllocatePort() has already succeeded. It
turns out there is one other possible error exit from
networkPortCreateXML() that happens after networkAllocatePort() has
succeeded, so the code to call networkReleasePort() was just moved
down to there.

Resolves: https://bugzilla.redhat.com/1741390

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Laine Stump 2019-08-15 21:52:28 -04:00
parent 8d6eaf5e09
commit dac697e8d7
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/network/bridge_driver.c
View File

@ -5592,17 +5592,17 @@ networkPortCreateXML(virNetworkPtr net,
rc = networkNotifyPort(obj, portdef);
else
rc = networkAllocatePort(obj, portdef);
if (rc < 0) {
virErrorPtr saved;
saved = virSaveLastError();
ignore_value(networkReleasePort(obj, portdef));
virSetError(saved);
virFreeError(saved);
if (rc < 0)
goto cleanup;
}
if (virNetworkObjAddPort(obj, portdef, driver->stateDir) < 0) {
virErrorPtr saved;
saved = virSaveLastError();
ignore_value(networkReleasePort(obj, portdef));
virNetworkPortDefFree(portdef);
virSetError(saved);
virFreeError(saved);
goto cleanup;
}