From c69ba67032e91b393427ef005a855d58e5576584 Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 30 Jun 2011 16:40:47 +0100
Subject: Fix release of virNetMessagePtr instances in streams processing

If a message packet for a invalid stream is received it is just
free'd. This is not good because it doesn't let the client RPC
request counter decrement. If a stream is shutdown with pending
packets the message also isn't released properly because of an
incorrect header type

* daemon/stream.c: Fix message header type
* src/rpc/virnetserverprogram.c: Send dummy reply instead of
  free'ing ignored stream message
---
 daemon/stream.c               | 1 +
 src/rpc/virnetserverprogram.c | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/daemon/stream.c b/daemon/stream.c
index 685cee2e0..56d79c2b6 100644
--- a/daemon/stream.c
+++ b/daemon/stream.c
@@ -327,6 +327,7 @@ int daemonFreeClientStream(virNetServerClientPtr client,
         virNetMessagePtr tmp = msg->next;
         /* Send a dummy reply to free up 'msg' & unblock client rx */
         memset(msg, 0, sizeof(*msg));
+        msg->header.type = VIR_NET_REPLY;
         if (virNetServerClientSendMessage(client, msg) < 0) {
             virNetServerClientMarkClose(client);
             virNetMessageFree(msg);
diff --git a/src/rpc/virnetserverprogram.c b/src/rpc/virnetserverprogram.c
index 4afed64c6..ca80ae09e 100644
--- a/src/rpc/virnetserverprogram.c
+++ b/src/rpc/virnetserverprogram.c
@@ -259,7 +259,13 @@ int virNetServerProgramDispatch(virNetServerProgramPtr prog,
          */
         VIR_INFO("Ignoring unexpected stream data serial=%d proc=%d status=%d",
                  msg->header.serial, msg->header.proc, msg->header.status);
-        virNetMessageFree(msg);
+        /* Send a dummy reply to free up 'msg' & unblock client rx */
+        memset(msg, 0, sizeof(*msg));
+        msg->header.type = VIR_NET_REPLY;
+        if (virNetServerClientSendMessage(client, msg) < 0) {
+            ret = -1;
+            goto cleanup;
+        }
         ret = 0;
         break;
 
@@ -275,6 +281,7 @@ int virNetServerProgramDispatch(virNetServerProgramPtr prog,
 error:
     ret = virNetServerProgramSendReplyError(prog, client, msg, &rerr, &msg->header);
 
+cleanup:
     return ret;
 }
 
-- 
cgit v1.2.3