exec_start_outgoing_migration() and exec_start_incoming_migration()
leak argv because it uses g_steal_pointer() is used to pass argv
qio_channel_command_new_spawn() while it does not free argv either.
Removing g_steal_pointer() is not sufficient though because argv is
typed g_auto(GStrv), which means the array of strings *and strings* will
be freed. The strings are only borrowed from the caller of
exec_start_outgoing_migration() and exec_start_incoming_migration() so
freeing them result in double-free.
Instead, type argv as g_autofree char **. This ensures only the array
of strings will be freed and the strings won't be freed. Also, remove
unnecessary casts according to the new type.
Fixes: cbab4face57b ("migration: convert exec backend to accept
MigrateAddress.")
Signed-off-by: Akihiko Odaki <akihiko.od...@daynix.com>
---
migration/exec.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/migration/exec.c b/migration/exec.c
index 47d2f3b8fb02..205675265ea1 100644
--- a/migration/exec.c
+++ b/migration/exec.c
@@ -73,15 +73,15 @@ void exec_start_outgoing_migration(MigrationState *s,
strList *command,
QIOChannel *ioc;
int length = str_list_length(command);
- g_auto(GStrv) argv = (char **) g_new0(const char *, length + 1);
+ g_autofree char **argv = g_new0(char *, length + 1);
init_exec_array(command, argv, errp);
- g_autofree char *new_command = g_strjoinv(" ", (char **)argv);
+ g_autofree char *new_command = g_strjoinv(" ", argv);
trace_migration_exec_outgoing(new_command);
ioc = QIO_CHANNEL(
qio_channel_command_new_spawn(
- (const char * const *) g_steal_pointer(&argv),
+ (const char * const *) argv,
O_RDWR,
errp));
if (!ioc) {
@@ -107,15 +107,15 @@ void exec_start_incoming_migration(strList *command,
Error **errp)
QIOChannel *ioc;
int length = str_list_length(command);
- g_auto(GStrv) argv = (char **) g_new0(const char *, length + 1);
+ g_autofree char **argv = g_new0(char *, length + 1);
init_exec_array(command, argv, errp);
- g_autofree char *new_command = g_strjoinv(" ", (char **)argv);
+ g_autofree char *new_command = g_strjoinv(" ", argv);
trace_migration_exec_incoming(new_command);
ioc = QIO_CHANNEL(
qio_channel_command_new_spawn(
- (const char * const *) g_steal_pointer(&argv),
+ (const char * const *) argv,
O_RDWR,
errp));
if (!ioc) {
---
base-commit: 5005aed8a7e728d028efb40e243ecfc2b4f3df3a
change-id: 20240219-argv-518065e20e87
Best regards,
--
Akihiko Odaki <akihiko.od...@daynix.com>
