From a52fbab4f76d05c3764dad87333c0cefd0004e8f Mon Sep 17 00:00:00 2001
Message-Id: <a52fbab4f76d05c3764dad87333c0cefd0004e8f@dist-git>
From: Michal Privoznik <mprivozn@redhat.com>
Date: Thu, 22 Dec 2016 14:23:05 +0100
Subject: [PATCH] qemuDomainAttachNetDevice: Avoid @originalError leak

RHEL-7.3.z: https://bugzilla.redhat.com/show_bug.cgi?id=1404186

Coverity identified that this variable might be leaked. And it's
right. If an error occurred and we have to roll back the control
jumps to try_remove label where we save the current error (see
0e82fa4c34 for more info). However, inside the code a jump onto
other label is possible thus leaking the error object.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
(cherry picked from commit ca1ac6643e8b466487597f981fad15abc5f336b4)
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---
 src/qemu/qemu_hotplug.c | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 62e275e94..58d25ca0e 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1279,32 +1279,32 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver,
     if (vlan < 0) {
         if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NETDEV)) {
             char *netdev_name;
-            if (virAsprintf(&netdev_name, "host%s", net->info.alias) < 0)
-                goto cleanup;
-            qemuDomainObjEnterMonitor(driver, vm);
-            if (charDevPlugged &&
-                qemuMonitorDetachCharDev(priv->mon, charDevAlias) < 0)
-                VIR_WARN("Failed to remove associated chardev %s", charDevAlias);
-            if (netdevPlugged &&
-                qemuMonitorRemoveNetdev(priv->mon, netdev_name) < 0)
-                VIR_WARN("Failed to remove network backend for netdev %s",
-                         netdev_name);
-            ignore_value(qemuDomainObjExitMonitor(driver, vm));
-            VIR_FREE(netdev_name);
+            if (virAsprintf(&netdev_name, "host%s", net->info.alias) >= 0) {
+                qemuDomainObjEnterMonitor(driver, vm);
+                if (charDevPlugged &&
+                    qemuMonitorDetachCharDev(priv->mon, charDevAlias) < 0)
+                    VIR_WARN("Failed to remove associated chardev %s", charDevAlias);
+                if (netdevPlugged &&
+                    qemuMonitorRemoveNetdev(priv->mon, netdev_name) < 0)
+                    VIR_WARN("Failed to remove network backend for netdev %s",
+                             netdev_name);
+                ignore_value(qemuDomainObjExitMonitor(driver, vm));
+                VIR_FREE(netdev_name);
+            }
         } else {
             VIR_WARN("Unable to remove network backend");
         }
     } else {
         char *hostnet_name;
-        if (virAsprintf(&hostnet_name, "host%s", net->info.alias) < 0)
-            goto cleanup;
-        qemuDomainObjEnterMonitor(driver, vm);
-        if (hostPlugged &&
-            qemuMonitorRemoveHostNetwork(priv->mon, vlan, hostnet_name) < 0)
-            VIR_WARN("Failed to remove network backend for vlan %d, net %s",
-                     vlan, hostnet_name);
-        ignore_value(qemuDomainObjExitMonitor(driver, vm));
-        VIR_FREE(hostnet_name);
+        if (virAsprintf(&hostnet_name, "host%s", net->info.alias) >= 0) {
+            qemuDomainObjEnterMonitor(driver, vm);
+            if (hostPlugged &&
+                qemuMonitorRemoveHostNetwork(priv->mon, vlan, hostnet_name) < 0)
+                VIR_WARN("Failed to remove network backend for vlan %d, net %s",
+                         vlan, hostnet_name);
+            ignore_value(qemuDomainObjExitMonitor(driver, vm));
+            VIR_FREE(hostnet_name);
+        }
     }
     virSetError(originalError);
     virFreeError(originalError);
-- 
2.11.0