[libvirt] [PATCH v2] qemu: Fix crash on failed VM startup

[Cole Robinson]

On 06/18/2010 06:44 AM, Daniel P. Berrange wrote:
> On Wed, Jun 02, 2010 at 10:55:17AM -0400, Cole Robinson wrote:
>> If VM startup fails early enough (can't find a referenced USB device),
>> libvirtd will crash trying to clear the VNC port bit, since port = 0,
>> which overflows us out of the bitmap bounds.
>>
>> Fix this by being more defensive in the bitmap operations, and only
>> clearing a previously set VNC port.
>>
>> v2: Add safety check to all relevant bitmap ops.
>>
>> Signed-off-by: Cole Robinson <crobinso at redhat.com>
>> ---
>>  src/qemu/qemu_driver.c |    2 +-
>>  src/util/bitmap.c      |    6 +++---
>>  2 files changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
>> index c8cd50a..f5a1310 100644
>> --- a/src/qemu/qemu_driver.c
>> +++ b/src/qemu/qemu_driver.c
>> @@ -3741,7 +3741,7 @@ retry:
>>      if ((vm->def->ngraphics == 1) &&
>>          vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
>>          vm->def->graphics[0]->data.vnc.autoport &&
>> -        vm->def->graphics[0]->data.vnc.port != -1) {
>> +        vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) {
>>          if (virBitmapClearBit(driver->reservedVNCPorts,
>>                                vm->def->graphics[0]->data.vnc.port - \
>>                                QEMU_VNC_PORT_MIN) < 0) {
>> diff --git a/src/util/bitmap.c b/src/util/bitmap.c
>> index 69094a5..cef3fc4 100644
>> --- a/src/util/bitmap.c
>> +++ b/src/util/bitmap.c
>> @@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap)
>>   */
>>  int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
>>  {
>> -    if (b > bitmap->size - 1)
>> +    if (bitmap->size <= b)
>>          return -1;
>>  
>>      bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b));
>> @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
>>   */
>>  int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
>>  {
>> -    if (b > bitmap->size - 1)
>> +    if (bitmap->size <= b)
>>          return -1;
>>  
>>      bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b));
>> @@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result)
>>  {
>>      uint32_t bit;
>>  
>> -    if (b > bitmap->size - 1)
>> +    if (bitmap->size <= b)
>>          return -1;
>>  
>>      bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &
> 
> ACK, this patch doesn't seem to have ever been pushed - current GIT still
> crashes on abort of VM startup
> 
> Daniel

Pushed now, accidentally in 2 commits though, since I pushed v1 first.

Thanks,
Cole