[Xen-changelog] [xen-4.1-testing] libxl: Fix segfault in get_all_assigned_devices

[Xen patchbot-4.1-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
# Date 1317924380 -3600
# Node ID 71712ce9190a66a5a0e112310d678bf1288d1d20
# Parent  1f95ac601974dae3a1b81d907b03a3ee90ec9e01
libxl: Fix segfault in get_all_assigned_devices

pcidevs is an array of ndev elements (ndev is the number of pci devices
assigend to a specific domain), but we access pcidevs + *num
where *num is the global number of pci devices assigned so far to all
domains in the system.

Fix the issue removing pcidevs and just realloc'ing *list every time we
want to add a new pci device to the array.

Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>

xen-unstable changeset: 23685:5239811f92e1
Backport-requested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---


diff -r 1f95ac601974 -r 71712ce9190a tools/libxl/libxl_pci.c
--- a/tools/libxl/libxl_pci.c   Thu Oct 06 12:52:18 2011 +0100
+++ b/tools/libxl/libxl_pci.c   Thu Oct 06 19:06:20 2011 +0100
@@ -434,7 +434,6 @@
 
 static int get_all_assigned_devices(libxl__gc *gc, libxl_device_pci **list, 
int *num)
 {
-    libxl_device_pci *pcidevs = NULL;
     char **domlist;
     unsigned int nd = 0, i;
 
@@ -451,8 +450,7 @@
             int ndev = atoi(num_devs), j;
             char *devpath, *bdf;
 
-            pcidevs = libxl__calloc(gc, sizeof(*pcidevs), ndev);
-            for(j = (pcidevs) ? 0 : ndev; j < ndev; j++) {
+            for(j = 0; j < ndev; j++) {
                 devpath = libxl__sprintf(gc, 
"/local/domain/0/backend/pci/%s/0/dev-%u",
                                         domlist[i], j);
                 bdf = libxl__xs_read(gc, XBT_NULL, devpath);
@@ -461,18 +459,17 @@
                     if ( sscanf(bdf, PCI_BDF, &dom, &bus, &dev, &func) != 4 )
                         continue;
 
-                    pcidev_init(pcidevs + *num, dom, bus, dev, func, 0);
+                    *list = realloc(*list, sizeof(libxl_device_pci) * ((*num) 
+ 1));
+                    if (*list == NULL)
+                        return ERROR_NOMEM;
+                    pcidev_init(*list + *num, dom, bus, dev, func, 0);
                     (*num)++;
                 }
             }
         }
     }
 
-    if ( 0 == *num ) {
-        pcidevs = NULL;
-    }else{
-        *list = pcidevs;
-    }
+    libxl__ptr_add(gc, *list);
 
     return 0;
 }

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog