[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 49/79] memory: cleanup side effects of memory_region_
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 49/79] memory: cleanup side effects of memory_region_init_foo() on failure |
Date: |
Sun, 30 Sep 2018 10:12:47 +0200 |
From: Igor Mammedov <address@hidden>
if MemoryRegion intialization fails it's left in semi-initialized state,
where it's size is not 0 and attached as child to owner object.
And this leds to crash in following use-case:
(monitor) object_add
memory-backend-file,id=mem1,size=99999G,mem-path=/tmp/foo,discard-data=yes
memory.c:2083: memory_region_get_ram_ptr: Assertion `mr->ram_block' failed
Aborted (core dumped)
it happens due to assumption that memory region is intialized when
memory_region_size() != 0
and therefore it's ok to access it in
file_backend_unparent()
if (memory_region_size() != 0)
memory_region_get_ram_ptr()
which happens when object_add fails and unparents failed backend making
file_backend_unparent() access invalid memory region.
Fix it by making sure that memory_region_init_foo() APIs cleanup externally
visible side effects on failure (like set size to 0 and unparenting object)
Signed-off-by: Igor Mammedov <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
memory.c | 48 ++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 42 insertions(+), 6 deletions(-)
diff --git a/memory.c b/memory.c
index 9b73892..aceadb2 100644
--- a/memory.c
+++ b/memory.c
@@ -1518,12 +1518,18 @@ void
memory_region_init_ram_shared_nomigrate(MemoryRegion *mr,
bool share,
Error **errp)
{
+ Error *err = NULL;
memory_region_init(mr, owner, name, size);
mr->ram = true;
mr->terminates = true;
mr->destructor = memory_region_destructor_ram;
- mr->ram_block = qemu_ram_alloc(size, share, mr, errp);
+ mr->ram_block = qemu_ram_alloc(size, share, mr, &err);
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
void memory_region_init_resizeable_ram(MemoryRegion *mr,
@@ -1536,13 +1542,19 @@ void memory_region_init_resizeable_ram(MemoryRegion *mr,
void *host),
Error **errp)
{
+ Error *err = NULL;
memory_region_init(mr, owner, name, size);
mr->ram = true;
mr->terminates = true;
mr->destructor = memory_region_destructor_ram;
mr->ram_block = qemu_ram_alloc_resizeable(size, max_size, resized,
- mr, errp);
+ mr, &err);
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
#ifdef __linux__
@@ -1555,13 +1567,19 @@ void memory_region_init_ram_from_file(MemoryRegion *mr,
const char *path,
Error **errp)
{
+ Error *err = NULL;
memory_region_init(mr, owner, name, size);
mr->ram = true;
mr->terminates = true;
mr->destructor = memory_region_destructor_ram;
mr->align = align;
- mr->ram_block = qemu_ram_alloc_from_file(size, mr, ram_flags, path, errp);
+ mr->ram_block = qemu_ram_alloc_from_file(size, mr, ram_flags, path, &err);
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
void memory_region_init_ram_from_fd(MemoryRegion *mr,
@@ -1572,14 +1590,20 @@ void memory_region_init_ram_from_fd(MemoryRegion *mr,
int fd,
Error **errp)
{
+ Error *err = NULL;
memory_region_init(mr, owner, name, size);
mr->ram = true;
mr->terminates = true;
mr->destructor = memory_region_destructor_ram;
mr->ram_block = qemu_ram_alloc_from_fd(size, mr,
share ? RAM_SHARED : 0,
- fd, errp);
+ fd, &err);
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
#endif
@@ -1630,13 +1654,19 @@ void memory_region_init_rom_nomigrate(MemoryRegion *mr,
uint64_t size,
Error **errp)
{
+ Error *err = NULL;
memory_region_init(mr, owner, name, size);
mr->ram = true;
mr->readonly = true;
mr->terminates = true;
mr->destructor = memory_region_destructor_ram;
- mr->ram_block = qemu_ram_alloc(size, false, mr, errp);
+ mr->ram_block = qemu_ram_alloc(size, false, mr, &err);
mr->dirty_log_mask = tcg_enabled() ? (1 << DIRTY_MEMORY_CODE) : 0;
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
void memory_region_init_rom_device_nomigrate(MemoryRegion *mr,
@@ -1647,6 +1677,7 @@ void memory_region_init_rom_device_nomigrate(MemoryRegion
*mr,
uint64_t size,
Error **errp)
{
+ Error *err = NULL;
assert(ops);
memory_region_init(mr, owner, name, size);
mr->ops = ops;
@@ -1654,7 +1685,12 @@ void
memory_region_init_rom_device_nomigrate(MemoryRegion *mr,
mr->terminates = true;
mr->rom_device = true;
mr->destructor = memory_region_destructor_ram;
- mr->ram_block = qemu_ram_alloc(size, false, mr, errp);
+ mr->ram_block = qemu_ram_alloc(size, false, mr, &err);
+ if (err) {
+ mr->size = int128_zero();
+ object_unparent(OBJECT(mr));
+ error_propagate(errp, err);
+ }
}
void memory_region_init_iommu(void *_iommu_mr,
--
1.8.3.1
- [Qemu-devel] [PULL 27/79] target/i386: move cpu_T0 to DisasContext, (continued)
- [Qemu-devel] [PULL 27/79] target/i386: move cpu_T0 to DisasContext, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 41/79] replay: allow loading any snapshots before recording, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 43/79] slirp: fix ipv6 timers, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 36/79] target/i386: move x86_64_hregs to DisasContext, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 45/79] fw_cfg_mem: add read memory region callback, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 44/79] ui: fix virtual timers, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 46/79] hw: debugexit: add read callback, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 48/79] hw: hyperv_testdev: add read callback, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 54/79] char-pty: remove unnecessary #ifdef, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 51/79] Revert "chardev: tcp: postpone async connection setup", Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 49/79] memory: cleanup side effects of memory_region_init_foo() on failure,
Paolo Bonzini <=
- [Qemu-devel] [PULL 52/79] char-socket: update all ioc handlers when changing context, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 53/79] test-char: add socket reconnect test, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 59/79] dump: move Windows dump structures definitions, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 61/79] MAINTAINERS: add myself as elf2dmp maintainer, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 58/79] hw: edu: replace device name with macro, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 62/79] kvmclock: run KVM_KVMCLOCK_CTRL ioctl in vcpu thread, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 70/79] replay: replay BH for IDE trim operation, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 57/79] i386: Compile CPUX86State xsave_buf only when support KVM or HVF, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 67/79] hvf: drop unused variable, Paolo Bonzini, 2018/09/30
- [Qemu-devel] [PULL 69/79] hostmem-file: make available memory-backend-file on POSIX-based hosts, Paolo Bonzini, 2018/09/30