60 lines
2.1 KiB
Diff
60 lines
2.1 KiB
Diff
|
If VM startup fails early enough (can't find a referenced USB device),
|
||
|
|
libvirtd will crash trying to clear the VNC port bit, since port = 0,
|
||
|
|
which overflows us out of the bitmap bounds.
|
||
|
|
|
||
|
|
Fix this by being more defensive in the bitmap operations, and only
|
||
|
|
clearing a previously set VNC port.
|
||
|
|
|
||
|
|
v2: Add safety check to all relevant bitmap ops.
|
||
|
|
|
||
|
|
Signed-off-by: Cole Robinson <crobinso@redhat.com>
|
||
|
|
---
|
||
|
|
src/qemu/qemu_driver.c | 2 +-
|
||
|
|
src/util/bitmap.c | 6 +++---
|
||
|
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
Index: libvirt-0.8.1/src/qemu/qemu_driver.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-0.8.1.orig/src/qemu/qemu_driver.c
|
||
|
|
+++ libvirt-0.8.1/src/qemu/qemu_driver.c
|
||
|
|
@@ -3635,7 +3635,7 @@ retry:
|
||
|
|
if ((vm->def->ngraphics == 1) &&
|
||
|
|
vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
|
||
|
|
vm->def->graphics[0]->data.vnc.autoport &&
|
||
|
|
- vm->def->graphics[0]->data.vnc.port != -1) {
|
||
|
|
+ vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) {
|
||
|
|
if (virBitmapClearBit(driver->reservedVNCPorts,
|
||
|
|
vm->def->graphics[0]->data.vnc.port - \
|
||
|
|
QEMU_VNC_PORT_MIN) < 0) {
|
||
|
|
Index: libvirt-0.8.1/src/util/bitmap.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-0.8.1.orig/src/util/bitmap.c
|
||
|
|
+++ libvirt-0.8.1/src/util/bitmap.c
|
||
|
|
@@ -101,7 +101,7 @@ void virBitmapFree(virBitmapPtr bitmap)
|
||
|
|
*/
|
||
|
|
int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
|
||
|
|
{
|
||
|
|
- if (b > bitmap->size - 1)
|
||
|
|
+ if (bitmap->size <= b)
|
||
|
|
return -1;
|
||
|
|
|
||
|
|
bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b));
|
||
|
|
@@ -119,7 +119,7 @@ int virBitmapSetBit(virBitmapPtr bitmap,
|
||
|
|
*/
|
||
|
|
int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
|
||
|
|
{
|
||
|
|
- if (b > bitmap->size - 1)
|
||
|
|
+ if (bitmap->size <= b)
|
||
|
|
return -1;
|
||
|
|
|
||
|
|
bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b));
|
||
|
|
@@ -141,7 +141,7 @@ int virBitmapGetBit(virBitmapPtr bitmap,
|
||
|
|
{
|
||
|
|
uint32_t bit;
|
||
|
|
|
||
|
|
- if (b > bitmap->size - 1)
|
||
|
|
+ if (bitmap->size <= b)
|
||
|
|
return -1;
|
||
|
|
|
||
|
|
bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &
|