<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 05/12/2014 01:57 PM, Wangrui (K) wrote: </div> <blockquote cite="mid:92984A2DD667AD43AADA1E474DC5E5965C0A9C56@szxema505-mbx.china.huawei.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style></style> <div class="WordSection1"> 1.<o:p></o:p> As shown in the definition of nl_recv, its return value is of INT type.<o:p></o:p> <o:p> </o:p> int nl_recv(struct nl_handle *handle, struct sockaddr_nl *nla,<o:p></o:p> unsigned char **buf, struct ucred **creds)<o:p></o:p> <o:p> </o:p> However, in function virNetlinkCommand, it uses an unsigned int param,<o:p></o:p> respbuflen, to receive its return value. Thus, the branch "*respbuflen < 0"<o:p></o:p> is unreachable, negative return values are handled incorrectly. <o:p></o:p> <o:p> </o:p> 2.<o:p></o:p> It's said in nl_recv's description that "The caller is responsible for<o:p></o:p> freeing the buffer allocated * in \c *buf if a positive value is returned."<o:p></o:p> which means, we needn't to free it in case it fails.<o:p></o:p> Additionally, nl_recv has a BUG in handling buf: in the error branch, it frees<o:p></o:p> the buf, but didn't set it to NULL. Freeing it outside in the caller function<o:p></o:p> will cause double free.<o:p></o:p> Thus, we set but(resp) to NULL if nl_recv fails. </div> </blockquote> Thanks for finding this! It was a good catch, and your patch corrects the problem you describe, but I think maybe we should take this opportunity to clean up the function further: 1) the first error return from the function returns -EINVAL, implying that the return value will contain -errno, which is almost never the case. 2) for either of the first 2 error conditions, the function returns with garbage in *resp. for the next 5 (!) error conditions, *resp not only contains garbage, but we then "goto error" which attempts to VIR_FREE(*resp). 3) "rc" defaults to 0, and is set to -1 on error, while usually our code follows the style of calling it "ret", defaulting to -1, then setting to 0 just after the last opportunity for error. 4) as you pointed out in a separate patch, the code below the "error" label is not only executed when there is an error, but for all return paths, and in that case it's our convention to call it "cleanup". I'm preparing a separate patch which will address all 4 of these problems. I'll Cc you when it is ready (should be within a few hours). <blockquote cite="mid:92984A2DD667AD43AADA1E474DC5E5965C0A9C56@szxema505-mbx.china.huawei.com" type="cite"> <div class="WordSection1"> <o:p></o:p> <o:p> </o:p> Signed-off-by: Zhang Bo <a class="moz-txt-link-rfc2396E" href="mailto:oscar.zhangbo@huawei.com"><oscar.zhangbo@huawei.com></a><o:p></o:p> ---<o:p></o:p> src/util/virnetlink.c | 8 ++++++--<o:p></o:p> 1 file changed, 6 insertions(+), 2 deletions(-)<o:p></o:p> <o:p> </o:p> diff --git a/src/util/virnetlink.c b/src/util/virnetlink.c<o:p></o:p> index 0cf18f2..1a09567 100644<o:p></o:p> --- a/src/util/virnetlink.c<o:p></o:p> +++ b/src/util/virnetlink.c<o:p></o:p> @@ -192,6 +192,7 @@ int virNetlinkCommand(struct nl_msg *nl_msg,<o:p></o:p> int n;<o:p></o:p> struct nlmsghdr *nlmsg = nlmsg_hdr(nl_msg);<o:p></o:p> virNetlinkHandle *nlhandle = NULL;<o:p></o:p> + int length = 0;<o:p></o:p> <o:p></o:p> if (protocol >= MAX_LINKS) {<o:p></o:p> virReportSystemError(EINVAL,<o:p></o:p> @@ -257,12 +258,15 @@ int virNetlinkCommand(struct nl_msg *nl_msg,<o:p></o:p> goto error;<o:p></o:p> }<o:p></o:p> <o:p></o:p> - *respbuflen = nl_recv(nlhandle, &nladdr,<o:p></o:p> - (unsigned char **)resp, NULL);<o:p></o:p> + length = nl_recv(nlhandle, &nladdr,<o:p></o:p> + (unsigned char **)resp, NULL);<o:p></o:p> <o:p> </o:p> - if (*respbuflen <= 0) {<o:p></o:p> + if (length <= 0) {<o:p></o:p> virReportSystemError(errno,<o:p></o:p> "%s", _("nl_recv failed"));<o:p></o:p> + *resp = NULL;<o:p></o:p> rc = -1;<o:p></o:p> + } else {<o:p></o:p> + *respbuflen = length;<o:p></o:p> }<o:p></o:p> error:<o:p></o:p> if (rc == -1) {<o:p></o:p> -- <o:p></o:p> 1.7.12.4<o:p></o:p> <o:p> </o:p> </div> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">-- libvir-list mailing list <a class="moz-txt-link-abbreviated" href="mailto:libvir-list@redhat.com">libvir-list@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/libvir-list">https://www.redhat.com/mailman/listinfo/libvir-list</a></pre> </blockquote> </body> </html>