From c1116b1d73fa0cd4346484688ebb22ecd847ec3f Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Tue, 25 Nov 2025 08:05:54 +0100 Subject: [PATCH 1/2] migration: Fix double-free on error path Fixes: ffaa1b50a879 (migration: Use warn_reportf_err() where appropriate) Resolves: Coverity CID 1643463 Signed-off-by: Markus Armbruster Message-ID: <20251125070554.2256181-1-armbru@redhat.com> Acked-by: Peter Xu --- migration/multifd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/migration/multifd.c b/migration/multifd.c index 6210454838..3203dc98e1 100644 --- a/migration/multifd.c +++ b/migration/multifd.c @@ -450,7 +450,7 @@ static void multifd_send_set_error(Error *err) */ static void migration_ioc_shutdown_gracefully(QIOChannel *ioc) { - g_autoptr(Error) local_err = NULL; + Error *local_err = NULL; if (!migration_has_failed(migrate_get_current()) && object_dynamic_cast((Object *)ioc, TYPE_QIO_CHANNEL_TLS)) { From 88be119fb19b8ee04d681ad9048cde9f6a37c631 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 28 Nov 2025 16:20:50 +0100 Subject: [PATCH 2/2] kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These functions wrap ioctl(). When ioctl() fails, it sets @errno. The wrappers then return that @errno negated. Except they call accel_ioctl_end() between calling ioctl() and reading @errno. accel_ioctl_end() can clobber @errno, e.g. when a futex() system call fails. Seems unlikely, but it's a bug all the same. Fix by retrieving @errno before calling accel_ioctl_end(). Fixes: a27dd2de68f3 (KVM: keep track of running ioctls) Signed-off-by: Markus Armbruster Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20251128152050.3417834-1-armbru@redhat.com> --- accel/kvm/kvm-all.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index f9254ae654..28006d73c5 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -3373,10 +3373,10 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...) trace_kvm_vm_ioctl(type, arg); accel_ioctl_begin(); ret = ioctl(s->vmfd, type, arg); - accel_ioctl_end(); if (ret == -1) { ret = -errno; } + accel_ioctl_end(); return ret; } @@ -3413,10 +3413,10 @@ int kvm_device_ioctl(int fd, unsigned long type, ...) trace_kvm_device_ioctl(fd, type, arg); accel_ioctl_begin(); ret = ioctl(fd, type, arg); - accel_ioctl_end(); if (ret == -1) { ret = -errno; } + accel_ioctl_end(); return ret; }