vircgroupv2devices: Avoid double close on map FD

When allowing/denying a device in devices CGroupV2 we have to
write a BPF program for it. The program we put there is merely
static and all it does it looks up a device in a hash table (also
known as map in BPF terminology). A map is referenced via an FD
which can be acquired via virBPFCreateMap() and like any other FD
it should be closed when no longer needed. However, we close it
twice: the first time in virCgroupV2DevicesAttachProg() which
closes it unconditionally, and the second time in either
virCgroupV2DevicesCreateProg() or
virCgroupV2DevicesPrepareProg(). Remove the second close.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>

diff --git a/src/util/vircgroupv2devices.c b/src/util/vircgroupv2devices.c
index 7ea3c70efb4b494d98cb85a8aeebab8764a52283..402ce3f86fbf274494d2179968cf9fdeae4ee90a 100644 (file)
--- a/src/util/vircgroupv2devices.c
+++ b/src/util/vircgroupv2devices.c
@@ -494,7 +494,7 @@ virCgroupV2DevicesReallocMap(int mapfd,
 int
 virCgroupV2DevicesCreateProg(virCgroupPtr group)
 {
-    VIR_AUTOCLOSE mapfd = -1;
+    int mapfd = -1;
 
     if (group->unified.devices.progfd > 0 && group->unified.devices.mapfd > 0)
         return 0;
@@ -503,13 +503,8 @@ virCgroupV2DevicesCreateProg(virCgroupPtr group)
     if (mapfd < 0)
         return -1;
 
-    if (virCgroupV2DevicesAttachProg(group, mapfd,
-                                     VIR_CGROUP_V2_INITIAL_BPF_MAP_SIZE) < 0) {
-        return -1;
-    }
-
-    mapfd = -1;
-    return 0;
+    return virCgroupV2DevicesAttachProg(group, mapfd,
+                                        VIR_CGROUP_V2_INITIAL_BPF_MAP_SIZE);
 }
 
 
@@ -530,10 +525,8 @@ virCgroupV2DevicesPrepareProg(virCgroupPtr group)
         if (newmapfd < 0)
             return -1;
 
-        if (virCgroupV2DevicesAttachProg(group, newmapfd, max) < 0) {
-            VIR_FORCE_CLOSE(newmapfd);
+        if (virCgroupV2DevicesAttachProg(group, newmapfd, max) < 0)
             return -1;
-        }
     }
 
     return 0;