From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37845) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wz6Yu-0004Zn-Io for qemu-devel@nongnu.org; Mon, 23 Jun 2014 11:53:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Wz6Yn-0001pE-S2 for qemu-devel@nongnu.org; Mon, 23 Jun 2014 11:53:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:3224) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wz6Yn-0001os-Km for qemu-devel@nongnu.org; Mon, 23 Jun 2014 11:53:33 -0400 Date: Mon, 23 Jun 2014 18:53:55 +0300 From: "Michael S. Tsirkin" Message-ID: <1403538745-18622-15-git-send-email-mst@redhat.com> References: <1403538745-18622-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1403538745-18622-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 14/23] qemu-char: avoid leaking unused fds in tcp_get_msgfds() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Nikolay Nikolaev , Stefan Hajnoczi , Anthony Liguori From: Stefan Hajnoczi Commit c76bf6bb8fbbb233a7d3641e09229d23747d5ee3 ("Add chardev API qemu_chr_fe_get_msgfds") extended the get_msgfds API from one to multiple file descriptors. It forgot to close unused file descriptors before freeing the file descriptor array. This patch prevents a file descriptor leak if the tcp_get_msgfds() callers requests fewer file descriptors than are available. Cc: Nikolay Nikolaev Signed-off-by: Stefan Hajnoczi Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- qemu-char.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/qemu-char.c b/qemu-char.c index d9100a2..e6cbafb 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2481,8 +2481,15 @@ static int tcp_get_msgfds(CharDriverState *chr, int *fds, int num) int to_copy = (s->read_msgfds_num < num) ? s->read_msgfds_num : num; if (to_copy) { + int i; + memcpy(fds, s->read_msgfds, to_copy * sizeof(int)); + /* Close unused fds */ + for (i = to_copy; i < s->read_msgfds_num; i++) { + close(s->read_msgfds[i]); + } + g_free(s->read_msgfds); s->read_msgfds = 0; s->read_msgfds_num = 0; -- MST