Funny thing. So when initializing LXC driver's capabilities,
firstly the virLXCDriverGetCapabilities() is called. This creates
new capabilities, stores them under driver->caps, ref() them and
return them. However, the return value is ignored. Secondly, the
function is called yet again and since we have driver->caps set,
they are ref()-ed again an returned. So in the end, driver's
capabilities have refcount of three when in fact they should have
refcount of one.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---
 src/lxc/lxc_driver.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 6eb88b0ba..784edad39 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -1660,7 +1660,7 @@ static int lxcStateInitialize(bool privileged,
     if (!(lxc_driver->hostdevMgr = virHostdevManagerGetDefault()))
         goto cleanup;
 
-    if ((virLXCDriverGetCapabilities(lxc_driver, true)) == NULL)
+    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, true)))
         goto cleanup;
 
     if (!(lxc_driver->xmlopt = lxcDomainXMLConfInit()))
@@ -1669,9 +1669,6 @@ static int lxcStateInitialize(bool privileged,
     if (!(lxc_driver->closeCallbacks = virCloseCallbacksNew()))
         goto cleanup;
 
-    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, false)))
-        goto cleanup;
-
     if (virFileMakePath(cfg->stateDir) < 0) {
         virReportSystemError(errno,
                              _("Failed to mkdir %s"),
@@ -1700,6 +1697,7 @@ static int lxcStateInitialize(bool privileged,
         goto cleanup;
 
     virNWFilterRegisterCallbackDriver(&lxcCallbackDriver);
+    virObjectUnref(caps);
     return 0;
 
  cleanup:
-- 
2.13.5

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Tue, 2017-08-29 at 18:16 +0200, Michal Privoznik wrote:
> Funny thing. So when initializing LXC driver's capabilities,
> firstly the virLXCDriverGetCapabilities() is called. This creates
> new capabilities, stores them under driver->caps, ref() them and
> return them. However, the return value is ignored. Secondly, the
> function is called yet again and since we have driver->caps set,
> they are ref()-ed again an returned. So in the end, driver's
> capabilities have refcount of three when in fact they should have
> refcount of one.
> 
> Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
> ---
>  src/lxc/lxc_driver.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
> index 6eb88b0ba..784edad39 100644
> --- a/src/lxc/lxc_driver.c
> +++ b/src/lxc/lxc_driver.c
> @@ -1660,7 +1660,7 @@ static int lxcStateInitialize(bool privileged,
>      if (!(lxc_driver->hostdevMgr = virHostdevManagerGetDefault()))
>          goto cleanup;
>  
> -    if ((virLXCDriverGetCapabilities(lxc_driver, true)) == NULL)
> +    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, true)))
>          goto cleanup;
>  
>      if (!(lxc_driver->xmlopt = lxcDomainXMLConfInit()))
> @@ -1669,9 +1669,6 @@ static int lxcStateInitialize(bool privileged,
>      if (!(lxc_driver->closeCallbacks = virCloseCallbacksNew()))
>          goto cleanup;
>  
> -    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, false)))
> -        goto cleanup;
> -
>      if (virFileMakePath(cfg->stateDir) < 0) {
>          virReportSystemError(errno,
>                               _("Failed to mkdir %s"),
> @@ -1700,6 +1697,7 @@ static int lxcStateInitialize(bool privileged,
>          goto cleanup;
>  
>      virNWFilterRegisterCallbackDriver(&lxcCallbackDriver);
> +    virObjectUnref(caps);
>      return 0;
>  
>   cleanup:

ACK

--
Cedric

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list