xen/23685-libxl-segfault-fix.patch

66 lines
2.4 KiB
Diff

# HG changeset patch
# User Stefano Stabellini <stefano.stabellini@eu.citrix.com>
# Date 1310654989 -3600
# Node ID 5239811f92e1ffb185a50172fdcf47372e71ba7e
# Parent 98701b1276c034b2bbbc8c7a975cf4c361caaa63
libxl: Fix segfault in get_all_assigned_devices
pcidevs is an array of ndev elements (ndev is the number of pci devices
assigend to a specific domain), but we access pcidevs + *num
where *num is the global number of pci devices assigned so far to all
domains in the system.
Fix the issue removing pcidevs and just realloc'ing *list every time we
want to add a new pci device to the array.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Index: xen-4.1.1-testing/tools/libxl/libxl_pci.c
===================================================================
--- xen-4.1.1-testing.orig/tools/libxl/libxl_pci.c
+++ xen-4.1.1-testing/tools/libxl/libxl_pci.c
@@ -434,7 +434,6 @@ retry_transaction2:
static int get_all_assigned_devices(libxl__gc *gc, libxl_device_pci **list, int *num)
{
- libxl_device_pci *pcidevs = NULL;
char **domlist;
unsigned int nd = 0, i;
@@ -451,8 +450,7 @@ static int get_all_assigned_devices(libx
int ndev = atoi(num_devs), j;
char *devpath, *bdf;
- pcidevs = libxl__calloc(gc, sizeof(*pcidevs), ndev);
- for(j = (pcidevs) ? 0 : ndev; j < ndev; j++) {
+ for(j = 0; j < ndev; j++) {
devpath = libxl__sprintf(gc, "/local/domain/0/backend/pci/%s/0/dev-%u",
domlist[i], j);
bdf = libxl__xs_read(gc, XBT_NULL, devpath);
@@ -461,19 +459,16 @@ static int get_all_assigned_devices(libx
if ( sscanf(bdf, PCI_BDF, &dom, &bus, &dev, &func) != 4 )
continue;
- pcidev_init(pcidevs + *num, dom, bus, dev, func, 0);
+ *list = realloc(*list, sizeof(libxl_device_pci) * ((*num) + 1));
+ if (*list == NULL)
+ return ERROR_NOMEM;
+ pcidev_init(*list + *num, dom, bus, dev, func, 0);
(*num)++;
}
}
}
}
-
- if ( 0 == *num ) {
- free(pcidevs);
- pcidevs = NULL;
- }else{
- *list = pcidevs;
- }
+ libxl__ptr_add(gc, *list);
return 0;
}