Currently, if there's an error opening /dev/vhost-net (e.g. because
it doesn't exist) but it's not required we proceed with vhostfd array
filled with -1 and vhostfdSize unchanged. Later, when constructing
the qemu command line only non-negative items within vhostfd array
are taken into account. This means, vhostfdSize may be greater than
the actual count of non-negative items in vhostfd array. This results
in improper command line arguments being generated, e.g.:

-netdev tap,fd=21,id=hostnet0,vhost=on,vhostfd=(null)
---
 src/qemu/qemu_command.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 434f5a7..d969f88 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -486,6 +486,8 @@ qemuOpenVhostNet(virDomainDefPtr def,
                                        "but is unavailable"));
                 goto error;
             }
+            i--;
+            (*vhostfdSize)--;
         }
     }
     virDomainAuditNetDevice(def, net, "/dev/vhost-net", *vhostfdSize);
@@ -6560,12 +6562,10 @@ qemuBuildInterfaceCommandLine(virCommandPtr cmd,
     }
 
     for (i = 0; i < vhostfdSize; i++) {
-        if (vhostfd[i] >= 0) {
-            virCommandTransferFD(cmd, vhostfd[i]);
-            if (virAsprintf(&vhostfdName[i], "%d", vhostfd[i]) < 0) {
-                virReportOOMError();
-                goto cleanup;
-            }
+        virCommandTransferFD(cmd, vhostfd[i]);
+        if (virAsprintf(&vhostfdName[i], "%d", vhostfd[i]) < 0) {
+            virReportOOMError();
+            goto cleanup;
         }
     }
 
-- 
1.8.2.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Reply via email to