lxc: avoid null deref on lxcSetupLoopDevices failure

If the function lxcSetupLoopDevices(def, &nloopDevs, &loopDevs) failed,
the variable loopDevs will keep a initial NULL value, however, the
function VIR_FORCE_CLOSE(loopDevs[i]) will directly deref it.

This patch also fixes returning a bogous number of devices from
lxcSetupLoopDevices on an error path.

* rc/lxc/lxc_controller.c: fixed a null pointer dereference.

Signed-off-by: Alex Jia <ajia@redhat.com>

diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
index c4e78325257ef9ae24361827963e17520f880298..7603bc7e892aac87e0544bf741e0470979e5300d 100644 (file)
--- a/src/lxc/lxc_controller.c
+++ b/src/lxc/lxc_controller.c
@@ -208,6 +208,7 @@ static int lxcSetupLoopDevices(virDomainDefPtr def, size_t *nloopDevs, int **loo
 
         VIR_DEBUG("Saving loop fd %d", fd);
         if (VIR_REALLOC_N(*loopDevs, *nloopDevs+1) < 0) {
+            *nloopDevs = 0;
             VIR_FORCE_CLOSE(fd);
             virReportOOMError();
             goto cleanup;
@@ -1017,8 +1018,11 @@ cleanup:
     VIR_FORCE_CLOSE(containerhandshake[0]);
     VIR_FORCE_CLOSE(containerhandshake[1]);
 
-    for (i = 0 ; i < nloopDevs ; i++)
-        VIR_FORCE_CLOSE(loopDevs[i]);
+    if (loopDevs) {
+        for (i = 0 ; i < nloopDevs ; i++)
+            VIR_FORCE_CLOSE(loopDevs[i]);
+    }
+
     VIR_FREE(loopDevs);
 
     if (container > 1) {