Re: [Qemu-devel] [PATCH] hostmem: fix crash when querying empty host-nodes property via QMP

[Igor Mammedov <imammedo@redhat.com>]

On Wed, 13 Feb 2019 14:30:55 +0100
Markus Armbruster <armbru@redhat.com> wrote:

> Igor Mammedov <imammedo@redhat.com> writes:
> 
> > QEMU will crashes with
> >  qapi/qobject-output-visitor.c:210: qobject_output_complete: Assertion `qov->root && ((&qov->stack)->slh_first == ((void *)0))' failed
> > when trying to get value of empty hostmem.host-nodes property.
> >
> > Fix it by calling visitor even if host-nodes wasn't set
> > before exiting from property getter to return empty list.  
> 
> host-nodes or host_nodes?
> 
> If local variable host_nodes: that one's always set.  The case you fix
> has it set to NULL.

it's about property host-nodes:

  value = find_first_bit(backend->host_nodes, MAX_NODES);                      
  if (value == MAX_NODES) {                                                    
    goto ret;                                                                
  }

when no bits set, it exits without visiting being returned list.

I'll send v2 with commit message giving more explanation to make
it clearer.

> > Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> > ---
> >  backends/hostmem.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/backends/hostmem.c b/backends/hostmem.c
> > index 0c8ef17..fe14be5 100644
> > --- a/backends/hostmem.c
> > +++ b/backends/hostmem.c
> > @@ -86,7 +86,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
> >  
> >      value = find_first_bit(backend->host_nodes, MAX_NODES);
> >      if (value == MAX_NODES) {
> > -        return;
> > +        goto ret;
> >      }
> >  
> >      *node = g_malloc0(sizeof(**node));
> > @@ -104,6 +104,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
> >          node = &(*node)->next;
> >      } while (true);
> >  
> > +ret:
> >      visit_type_uint16List(v, name, &host_nodes, errp);
> >  }  
> 
> Yes, an empty list needs to be visited just like a non-empty list.
> 
> Patch looks good.
>