Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd

[Gonglei <arei.gonglei@huawei.com>]

On 2014/10/29 23:00, Markus Armbruster wrote:

> <arei.gonglei@huawei.com> writes:
> 
>> From: Gonglei <arei.gonglei@huawei.com>
>>
>> After commit 4c7e251a (), when dump memory completed,
>> the s->fd will be closed twice. We should return
>> directly when dump completed.
>>
>> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
>> ---
>>  dump.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/dump.c b/dump.c
>> index 06a4915..9d9a409 100644
>> --- a/dump.c
>> +++ b/dump.c
>> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
>>          ret = get_next_block(s, block);
>>          if (ret == 1) {
>>              dump_completed(s);
>> +            return;
>>          }
>>      }
>>  }
> 
> What about less tortuous control structure?
> 
>     do {
>         block = s->next_block;
> 
>         size = block->target_end - block->target_start;
>         if (s->has_filter) {
>             size -= s->start;
>             if (s->begin + s->length < block->target_end) {
>                 size -= block->target_end - (s->begin + s->length);
>             }
>         }
>         write_memory(s, block, s->start, size, &local_err);
>         if (local_err) {
>             error_propagate(errp, local_err);
>             return;
>         }
> 
>     } while (!get_next_block(s, block))
> 
>     dump_completed();
> 
> Makes the badly chosen return values of of get_next_block() more
> visible.  Easy enough to fix if it bothers you.

Looks better. v2 will be posted, thanks :)

Best regards,
-Gonglei