qemu: fix double free when RNG cold-plug fails

https://bugzilla.redhat.com/show_bug.cgi?id=1220809

When cold-plugging an RNG device but something fails in
qemuDomainAssignAddresses, we will double free the RNG device.
Once a device is plugged into the domain, we should set the
device pointer to NULL to fix this issue.

...
5  0x00007fb7d180ac8a in virFree at util/viralloc.c:582
6  0x00007fb7d1895cdd in virDomainRNGDefFree at conf/domain_conf.c:19786
7  0x00007fb7d1895d99 in virDomainDeviceDefFree at conf/domain_conf.c:2022
8  0x00007fb7b92b8baf in qemuDomainAttachDeviceFlags at qemu/qemu_driver.c:8785
9  0x00007fb7d190c5d7 in virDomainAttachDeviceFlags at libvirt-domain.c:8488
10 0x00007fb7d23af9d2 in remoteDispatchDomainAttachDeviceFlags at remote_dispatch.h:2842
...

Signed-off-by: Luyao Huang <lhuang@redhat.com>

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 33c1cfd4cd3e10a9d732a9ad544b4f8884030317..f922a2893c706f4571f504b018853cad8eb8ad95 100644 (file)
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -8359,11 +8359,10 @@ qemuDomainAttachDeviceConfig(virQEMUCapsPtr qemuCaps,
 
         if (virDomainRNGInsert(vmdef, dev->data.rng, false) < 0)
             return -1;
+        dev->data.rng = NULL;
 
         if (qemuDomainAssignAddresses(vmdef, qemuCaps, NULL) < 0)
             return -1;
-
-        dev->data.rng = NULL;
         break;
 
     case VIR_DOMAIN_DEVICE_MEMORY: