When adding the ACL check and caps getter, we assumed that
the default return value is -1, not 0 as usual.

Fix the return value on error by assigning them explicitly.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/lxc/lxc_driver.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 349783ca7c..d86147cc28 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -1234,11 +1234,15 @@ static int lxcNodeGetSecurityModel(virConnectPtr conn,
 
     memset(secmodel, 0, sizeof(*secmodel));
 
-    if (virNodeGetSecurityModelEnsureACL(conn) < 0)
+    if (virNodeGetSecurityModelEnsureACL(conn) < 0) {
+        ret = -1;
         goto cleanup;
+    }
 
-    if (!(caps = virLXCDriverGetCapabilities(driver, false)))
+    if (!(caps = virLXCDriverGetCapabilities(driver, false))) {
+        ret = -1;
         goto cleanup;
+    }
 
     /* we treat no driver as success, but simply return no data in *secmodel */
     if (caps->host.nsecModels == 0
-- 
2.31.1

On 12/10/21 17:06, Ján Tomko wrote:
> When adding the ACL check and caps getter, we assumed that
> the default return value is -1, not 0 as usual.
> 
> Fix the return value on error by assigning them explicitly.
> 
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/lxc/lxc_driver.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
> index 349783ca7c..d86147cc28 100644
> --- a/src/lxc/lxc_driver.c
> +++ b/src/lxc/lxc_driver.c
> @@ -1234,11 +1234,15 @@ static int lxcNodeGetSecurityModel(virConnectPtr conn,
>  
>      memset(secmodel, 0, sizeof(*secmodel));
>  
> -    if (virNodeGetSecurityModelEnsureACL(conn) < 0)
> +    if (virNodeGetSecurityModelEnsureACL(conn) < 0) {
> +        ret = -1;
>          goto cleanup;
> +    }
>  
> -    if (!(caps = virLXCDriverGetCapabilities(driver, false)))
> +    if (!(caps = virLXCDriverGetCapabilities(driver, false))) {
> +        ret = -1;
>          goto cleanup;
> +    }
>  
>      /* we treat no driver as success, but simply return no data in *secmodel */
>      if (caps->host.nsecModels == 0


Why not initialize ret = -1 and then rewrite it to 0 just above cleanup
label? That's more used pattern than this. looking into the future, it
doesn't matter that much though.

Michal