]> git.ipfire.org Git - thirdparty/libvirt.git/commit
util: Avoid libvirtd crash in virNetDevTapCreate
authorAlex Jia <ajia@redhat.com>
Sat, 28 Apr 2012 11:01:40 +0000 (19:01 +0800)
committerCole Robinson <crobinso@redhat.com>
Thu, 7 Jun 2012 22:05:14 +0000 (18:05 -0400)
commit6bbfd92d229e71e25181776c691ccc32dc0c1f22
tree3687ab354f7fb57219c7d85c2732a041fa960b33
parentd070e1d1bce4ff9272bce8575f39070f7c330895
util: Avoid libvirtd crash in virNetDevTapCreate

In fact, the 'tapfd' is always NULL, the function 'virNetDevTapCreate()' hasn't
assign 'fd' to 'tapfd', when the function 'virNetDevSetMAC()' is failed then
goto 'error' label, finally, the VIR_FORCE_CLOSE() will deref a NULL 'tapfd'.

* util/virnetdevtap.c (virNetDevTapCreateInBridgePort): fix a NULL pointer derefing.

* How to reproduce?

$ cat > /tmp/net.xml <<EOF
<network>
  <name>test</name>
  <forward mode='nat'/>
  <bridge name='br1' stp='off' delay='1' />
  <mac address='00:00:00:00:00:00'/>
  <ip address='192.168.100.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.100.2' end='192.168.100.254' />
    </dhcp>
  </ip>
</network>
EOF

$ virsh net-define /tmp/net.xml

$ virsh net-start test
error: Failed to start network brTest
error: End of file while reading data: Input/output error

Signed-off-by: Alex Jia <ajia@redhat.com>
(cherry picked from commit 5ee18aaa578768893918d67e0dc36fe72b73b736)
src/util/virnetdevtap.c