[PATCH] migration: Free argv

[Akihiko Odaki <akihiko.odaki@daynix.com>]

exec_start_outgoing_migration() and exec_start_incoming_migration()
leak argv because it uses g_steal_pointer() is used to pass argv
qio_channel_command_new_spawn() while it does not free argv either.

Removing g_steal_pointer() is not sufficient though because argv is
typed g_auto(GStrv), which means the array of strings *and strings* will
be freed. The strings are only borrowed from the caller of
exec_start_outgoing_migration() and exec_start_incoming_migration() so
freeing them result in double-free.

Instead, type argv as g_autofree char **. This ensures only the array
of strings will be freed and the strings won't be freed. Also, remove
unnecessary casts according to the new type.

Fixes: cbab4face57b ("migration: convert exec backend to accept MigrateAddress.")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
---
 migration/exec.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/migration/exec.c b/migration/exec.c
index 47d2f3b8fb02..205675265ea1 100644
--- a/migration/exec.c
+++ b/migration/exec.c
@@ -73,15 +73,15 @@ void exec_start_outgoing_migration(MigrationState *s, strList *command,
     QIOChannel *ioc;
 
     int length = str_list_length(command);
-    g_auto(GStrv) argv = (char **) g_new0(const char *, length + 1);
+    g_autofree char **argv = g_new0(char *, length + 1);
 
     init_exec_array(command, argv, errp);
-    g_autofree char *new_command = g_strjoinv(" ", (char **)argv);
+    g_autofree char *new_command = g_strjoinv(" ", argv);
 
     trace_migration_exec_outgoing(new_command);
     ioc = QIO_CHANNEL(
         qio_channel_command_new_spawn(
-                            (const char * const *) g_steal_pointer(&argv),
+                            (const char * const *) argv,
                             O_RDWR,
                             errp));
     if (!ioc) {
@@ -107,15 +107,15 @@ void exec_start_incoming_migration(strList *command, Error **errp)
     QIOChannel *ioc;
 
     int length = str_list_length(command);
-    g_auto(GStrv) argv = (char **) g_new0(const char *, length + 1);
+    g_autofree char **argv = g_new0(char *, length + 1);
 
     init_exec_array(command, argv, errp);
-    g_autofree char *new_command = g_strjoinv(" ", (char **)argv);
+    g_autofree char *new_command = g_strjoinv(" ", argv);
 
     trace_migration_exec_incoming(new_command);
     ioc = QIO_CHANNEL(
         qio_channel_command_new_spawn(
-                            (const char * const *) g_steal_pointer(&argv),
+                            (const char * const *) argv,
                             O_RDWR,
                             errp));
     if (!ioc) {

---
base-commit: 5005aed8a7e728d028efb40e243ecfc2b4f3df3a
change-id: 20240219-argv-518065e20e87

Best regards,
-- 
Akihiko Odaki <akihiko.odaki@daynix.com>