* [Qemu-trivial] [PATCH] dump: fix use-after-free for s->fd
@ 2014-10-29 10:28 ` arei.gonglei
0 siblings, 0 replies; 6+ messages in thread
From: arei.gonglei @ 2014-10-29 10:28 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-trivial, Gonglei, weidong.huang, lcapitulino
From: Gonglei <arei.gonglei@huawei.com>
After commit 4c7e251a (), when dump memory completed,
the s->fd will be closed twice. We should return
directly when dump completed.
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
---
dump.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/dump.c b/dump.c
index 06a4915..9d9a409 100644
--- a/dump.c
+++ b/dump.c
@@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
ret = get_next_block(s, block);
if (ret == 1) {
dump_completed(s);
+ return;
}
}
}
--
1.7.12.4
^ permalink raw reply related [flat|nested] 6+ messages in thread* [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd
@ 2014-10-29 10:28 ` arei.gonglei
0 siblings, 0 replies; 6+ messages in thread
From: arei.gonglei @ 2014-10-29 10:28 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-trivial, Gonglei, weidong.huang, lcapitulino
From: Gonglei <arei.gonglei@huawei.com>
After commit 4c7e251a (), when dump memory completed,
the s->fd will be closed twice. We should return
directly when dump completed.
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
---
dump.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/dump.c b/dump.c
index 06a4915..9d9a409 100644
--- a/dump.c
+++ b/dump.c
@@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
ret = get_next_block(s, block);
if (ret == 1) {
dump_completed(s);
+ return;
}
}
}
--
1.7.12.4
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd
2014-10-29 10:28 ` [Qemu-devel] " arei.gonglei
@ 2014-10-29 15:00 ` Markus Armbruster
-1 siblings, 0 replies; 6+ messages in thread
From: Markus Armbruster @ 2014-10-29 15:00 UTC (permalink / raw)
To: arei.gonglei; +Cc: qemu-trivial, weidong.huang, qemu-devel, lcapitulino
<arei.gonglei@huawei.com> writes:
> From: Gonglei <arei.gonglei@huawei.com>
>
> After commit 4c7e251a (), when dump memory completed,
> the s->fd will be closed twice. We should return
> directly when dump completed.
>
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
> dump.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/dump.c b/dump.c
> index 06a4915..9d9a409 100644
> --- a/dump.c
> +++ b/dump.c
> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
> ret = get_next_block(s, block);
> if (ret == 1) {
> dump_completed(s);
> + return;
> }
> }
> }
What about less tortuous control structure?
do {
block = s->next_block;
size = block->target_end - block->target_start;
if (s->has_filter) {
size -= s->start;
if (s->begin + s->length < block->target_end) {
size -= block->target_end - (s->begin + s->length);
}
}
write_memory(s, block, s->start, size, &local_err);
if (local_err) {
error_propagate(errp, local_err);
return;
}
} while (!get_next_block(s, block))
dump_completed();
Makes the badly chosen return values of of get_next_block() more
visible. Easy enough to fix if it bothers you.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd
@ 2014-10-29 15:00 ` Markus Armbruster
0 siblings, 0 replies; 6+ messages in thread
From: Markus Armbruster @ 2014-10-29 15:00 UTC (permalink / raw)
To: arei.gonglei; +Cc: qemu-trivial, weidong.huang, qemu-devel, lcapitulino
<arei.gonglei@huawei.com> writes:
> From: Gonglei <arei.gonglei@huawei.com>
>
> After commit 4c7e251a (), when dump memory completed,
> the s->fd will be closed twice. We should return
> directly when dump completed.
>
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
> dump.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/dump.c b/dump.c
> index 06a4915..9d9a409 100644
> --- a/dump.c
> +++ b/dump.c
> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
> ret = get_next_block(s, block);
> if (ret == 1) {
> dump_completed(s);
> + return;
> }
> }
> }
What about less tortuous control structure?
do {
block = s->next_block;
size = block->target_end - block->target_start;
if (s->has_filter) {
size -= s->start;
if (s->begin + s->length < block->target_end) {
size -= block->target_end - (s->begin + s->length);
}
}
write_memory(s, block, s->start, size, &local_err);
if (local_err) {
error_propagate(errp, local_err);
return;
}
} while (!get_next_block(s, block))
dump_completed();
Makes the badly chosen return values of of get_next_block() more
visible. Easy enough to fix if it bothers you.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd
2014-10-29 15:00 ` Markus Armbruster
@ 2014-10-30 0:54 ` Gonglei
-1 siblings, 0 replies; 6+ messages in thread
From: Gonglei @ 2014-10-30 0:54 UTC (permalink / raw)
To: Markus Armbruster
Cc: qemu-trivial@nongnu.org, Huangweidong (C), qemu-devel@nongnu.org,
lcapitulino@redhat.com
On 2014/10/29 23:00, Markus Armbruster wrote:
> <arei.gonglei@huawei.com> writes:
>
>> From: Gonglei <arei.gonglei@huawei.com>
>>
>> After commit 4c7e251a (), when dump memory completed,
>> the s->fd will be closed twice. We should return
>> directly when dump completed.
>>
>> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
>> ---
>> dump.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/dump.c b/dump.c
>> index 06a4915..9d9a409 100644
>> --- a/dump.c
>> +++ b/dump.c
>> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
>> ret = get_next_block(s, block);
>> if (ret == 1) {
>> dump_completed(s);
>> + return;
>> }
>> }
>> }
>
> What about less tortuous control structure?
>
> do {
> block = s->next_block;
>
> size = block->target_end - block->target_start;
> if (s->has_filter) {
> size -= s->start;
> if (s->begin + s->length < block->target_end) {
> size -= block->target_end - (s->begin + s->length);
> }
> }
> write_memory(s, block, s->start, size, &local_err);
> if (local_err) {
> error_propagate(errp, local_err);
> return;
> }
>
> } while (!get_next_block(s, block))
>
> dump_completed();
>
> Makes the badly chosen return values of of get_next_block() more
> visible. Easy enough to fix if it bothers you.
Looks better. v2 will be posted, thanks :)
Best regards,
-Gonglei
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd
@ 2014-10-30 0:54 ` Gonglei
0 siblings, 0 replies; 6+ messages in thread
From: Gonglei @ 2014-10-30 0:54 UTC (permalink / raw)
To: Markus Armbruster
Cc: qemu-trivial@nongnu.org, Huangweidong (C), qemu-devel@nongnu.org,
lcapitulino@redhat.com
On 2014/10/29 23:00, Markus Armbruster wrote:
> <arei.gonglei@huawei.com> writes:
>
>> From: Gonglei <arei.gonglei@huawei.com>
>>
>> After commit 4c7e251a (), when dump memory completed,
>> the s->fd will be closed twice. We should return
>> directly when dump completed.
>>
>> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
>> ---
>> dump.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/dump.c b/dump.c
>> index 06a4915..9d9a409 100644
>> --- a/dump.c
>> +++ b/dump.c
>> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
>> ret = get_next_block(s, block);
>> if (ret == 1) {
>> dump_completed(s);
>> + return;
>> }
>> }
>> }
>
> What about less tortuous control structure?
>
> do {
> block = s->next_block;
>
> size = block->target_end - block->target_start;
> if (s->has_filter) {
> size -= s->start;
> if (s->begin + s->length < block->target_end) {
> size -= block->target_end - (s->begin + s->length);
> }
> }
> write_memory(s, block, s->start, size, &local_err);
> if (local_err) {
> error_propagate(errp, local_err);
> return;
> }
>
> } while (!get_next_block(s, block))
>
> dump_completed();
>
> Makes the badly chosen return values of of get_next_block() more
> visible. Easy enough to fix if it bothers you.
Looks better. v2 will be posted, thanks :)
Best regards,
-Gonglei
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-10-30 0:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-29 10:28 [Qemu-trivial] [PATCH] dump: fix use-after-free for s->fd arei.gonglei
2014-10-29 10:28 ` [Qemu-devel] " arei.gonglei
2014-10-29 15:00 ` [Qemu-trivial] " Markus Armbruster
2014-10-29 15:00 ` Markus Armbruster
2014-10-30 0:54 ` [Qemu-trivial] " Gonglei
2014-10-30 0:54 ` Gonglei
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.