[libvirt] [PATCH] qemu: Fix crash on failed VM startup

Jim Fehlig jfehlig at novell.com
Tue Jun 1 20:40:07 UTC 2010


Eric Blake wrote:
> On 06/01/2010 01:10 PM, Cole Robinson wrote:
>   
>> If VM startup fails early enough (can't find a referenced USB device),
>> libvirtd will crash trying to clear the VNC port bit, since port = 0,
>> which overflows us out of the bitmap bounds.
>>
>> Fix this by being more defensive in the bitmap operations, and only
>> clearing a previously set VNC port.
>>
>> +++ b/src/util/bitmap.c
>> @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
>>   */
>>  int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
>>  {
>> -    if (b > bitmap->size - 1)
>> +    if (bitmap->size != 0 && b > bitmap->size - 1)
>>     
>
> I think this could use a v2: virBitmapSetBit and virBitmapGetBit should
> get the same treatment for bounds checking.
>
> Meanwhile, we already reject attempts to create a bitmap with SIZE_MAX
> bits.  Therefore, since b is unsigned, we can safely avoid the && and
> instead do the computation via a single comparison:
>
> if (bitmap->size <= b)
>     return -1;
>
> For that matter, should virBitmapAlloc(0) return NULL, instead of it's
> current behavior of allocating an (empty) bitmap?
>   

Yes, you are right - especially since there is no grow operation :-).  I 
should have returned NULL for size 0 request in the original version.

Regards,
Jim




More information about the libvir-list mailing list