From f1ac0031f54967326c857f35c009fa9620917afe Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc@fedoraproject.org>
Date: Sep 17 2009 14:47:51 +0000
Subject: * Thu Sep 17 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-4%

- A couple of hot-unplug memory handling fixes (#523960)

---

diff --git a/libvirt-0.6.4-svirt-sound.patch b/libvirt-0.6.4-svirt-sound.patch
index 13d42d2..3ad000c 100644
--- a/libvirt-0.6.4-svirt-sound.patch
+++ b/libvirt-0.6.4-svirt-sound.patch
@@ -1,4 +1,4 @@
-From e2106f6db9beb9f48e9f87f8a1eaba821d1a2296 Mon Sep 17 00:00:00 2001
+From 127a39777e9809053bb98a9082e27c73543ccfa2 Mon Sep 17 00:00:00 2001
 From: Daniel P. Berrange <berrange@redhat.com>
 Date: Mon, 17 Aug 2009 08:32:08 +0100
 Subject: [PATCH] Disable sound cards when running sVirt
diff --git a/libvirt-fix-net-hotunplug-double-free.patch b/libvirt-fix-net-hotunplug-double-free.patch
new file mode 100644
index 0000000..8ce34ab
--- /dev/null
+++ b/libvirt-fix-net-hotunplug-double-free.patch
@@ -0,0 +1,44 @@
+From 9b926eb4c485bd81b0b553107dbb037c2188cd23 Mon Sep 17 00:00:00 2001
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Thu, 17 Sep 2009 15:31:08 +0100
+Subject: [PATCH] Fix net/disk hot-unplug segfault
+
+When we hot-unplug the last device, we're currently double-freeing
+the device definition.
+
+Reported by Michal Nowak here:
+
+  https://bugzilla.redhat.com/523960
+
+* src/qemu_driver.c: fix double free
+
+Fedora-patch: libvirt-fix-net-hotunplug-double-free.patch
+---
+ src/qemu_driver.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/qemu_driver.c b/src/qemu_driver.c
+index a65334f..de31581 100644
+--- a/src/qemu_driver.c
++++ b/src/qemu_driver.c
+@@ -5998,7 +5998,7 @@ try_command:
+             /* ignore, harmless */
+         }
+     } else {
+-        VIR_FREE(vm->def->disks[0]);
++        VIR_FREE(vm->def->disks);
+         vm->def->ndisks = 0;
+     }
+     virDomainDiskDefFree(detach);
+@@ -6100,7 +6100,7 @@ qemudDomainDetachNetDevice(virConnectPtr conn,
+             /* ignore, harmless */
+         }
+     } else {
+-        VIR_FREE(vm->def->nets[0]);
++        VIR_FREE(vm->def->nets);
+         vm->def->nnets = 0;
+     }
+     virDomainNetDefFree(detach);
+-- 
+1.6.2.5
+
diff --git a/libvirt-fix-pci-hostdev-hotunplug-leak.patch b/libvirt-fix-pci-hostdev-hotunplug-leak.patch
new file mode 100644
index 0000000..90dfd45
--- /dev/null
+++ b/libvirt-fix-pci-hostdev-hotunplug-leak.patch
@@ -0,0 +1,48 @@
+From 0538387bbdb426de88b54a8c45153c5644209698 Mon Sep 17 00:00:00 2001
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Thu, 17 Sep 2009 15:32:45 +0100
+Subject: [PATCH] Fix leak in PCI hostdev hot-unplug
+
+* src/qemu_driver.c: sync the hostdev hot-unplug code with the disk/net
+  code.
+
+Fedora-patch: libvirt-fix-pci-hostdev-hotunplug-leak.patch
+---
+ src/qemu_driver.c |   20 +++++++++++++-------
+ 1 files changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/qemu_driver.c b/src/qemu_driver.c
+index de31581..2ddcdc0 100644
+--- a/src/qemu_driver.c
++++ b/src/qemu_driver.c
+@@ -6206,14 +6206,20 @@ static int qemudDomainDetachHostPciDevice(virConnectPtr conn,
+         pciFreeDevice(conn, pci);
+     }
+ 
+-    if (i != --vm->def->nhostdevs)
+-        memmove(&vm->def->hostdevs[i],
+-                &vm->def->hostdevs[i+1],
+-                sizeof(*vm->def->hostdevs) * (vm->def->nhostdevs-i));
+-    if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) {
+-        virReportOOMError(conn);
+-        ret = -1;
++    if (vm->def->nhostdevs > 1) {
++        memmove(vm->def->hostdevs + i,
++                vm->def->hostdevs + i + 1,
++                sizeof(*vm->def->hostdevs) *
++                (vm->def->nhostdevs - (i + 1)));
++        vm->def->nhostdevs--;
++        if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) {
++            /* ignore, harmless */
++        }
++    } else {
++        VIR_FREE(vm->def->hostdevs);
++        vm->def->nhostdevs = 0;
+     }
++    virDomainHostdevDefFree(detach);
+ 
+     return ret;
+ }
+-- 
+1.6.2.5
+
diff --git a/libvirt.spec b/libvirt.spec
index 3c57b5e..81ddc77 100644
--- a/libvirt.spec
+++ b/libvirt.spec
@@ -151,7 +151,7 @@
 Summary: Library providing a simple API virtualization
 Name: libvirt
 Version: 0.7.1
-Release: 3%{?dist}%{?extra_release}
+Release: 4%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
 Source: http://libvirt.org/sources/libvirt-%{version}.tar.gz
@@ -160,6 +160,10 @@ Source: http://libvirt.org/sources/libvirt-%{version}.tar.gz
 # out when SELinux enforcing (bz 486112)
 Patch00: libvirt-0.6.4-svirt-sound.patch
 
+# A couple of hot-unplug memory handling fixes (#523960)
+Patch01: libvirt-fix-net-hotunplug-double-free.patch
+Patch02: libvirt-fix-pci-hostdev-hotunplug-leak.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 URL: http://libvirt.org/
 BuildRequires: python-devel
@@ -373,6 +377,8 @@ of recent versions of Linux (and other OSes).
 %setup -q
 
 %patch00 -p1
+%patch01 -p1
+%patch02 -p1
 
 %build
 %if ! %{with_xen}
@@ -763,6 +769,9 @@ fi
 %endif
 
 %changelog
+* Thu Sep 17 2009 Mark McLoughlin <markmc@redhat.com> - 0.7.1-4%
+- A couple of hot-unplug memory handling fixes (#523960)
+
 * Thu Sep 17 2009 Daniel Veillard <veillard@redhat.com> - 0.7.1-3
 - disable numactl on s390[x]