From: Luyao Huang Date: Tue, 12 May 2015 13:55:05 +0000 (+0800) Subject: qemu: fix double free when RNG cold-plug fails X-Git-Tag: v1.2.16-rc1~93 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5f6fe84d5731a45fa3fe08701f0d553818dd3e12;p=thirdparty%2Flibvirt.git qemu: fix double free when RNG cold-plug fails https://bugzilla.redhat.com/show_bug.cgi?id=1220809 When cold-plugging an RNG device but something fails in qemuDomainAssignAddresses, we will double free the RNG device. Once a device is plugged into the domain, we should set the device pointer to NULL to fix this issue. ... 5 0x00007fb7d180ac8a in virFree at util/viralloc.c:582 6 0x00007fb7d1895cdd in virDomainRNGDefFree at conf/domain_conf.c:19786 7 0x00007fb7d1895d99 in virDomainDeviceDefFree at conf/domain_conf.c:2022 8 0x00007fb7b92b8baf in qemuDomainAttachDeviceFlags at qemu/qemu_driver.c:8785 9 0x00007fb7d190c5d7 in virDomainAttachDeviceFlags at libvirt-domain.c:8488 10 0x00007fb7d23af9d2 in remoteDispatchDomainAttachDeviceFlags at remote_dispatch.h:2842 ... Signed-off-by: Luyao Huang --- diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 33c1cfd4cd..f922a2893c 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -8359,11 +8359,10 @@ qemuDomainAttachDeviceConfig(virQEMUCapsPtr qemuCaps, if (virDomainRNGInsert(vmdef, dev->data.rng, false) < 0) return -1; + dev->data.rng = NULL; if (qemuDomainAssignAddresses(vmdef, qemuCaps, NULL) < 0) return -1; - - dev->data.rng = NULL; break; case VIR_DOMAIN_DEVICE_MEMORY: