From: "Alex Bennée" <alex.bennee@linaro.org>
To: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>,
Peter Maydell <peter.maydell@linaro.org>,
vsementsov@virtuozzo.com, Stefan Hajnoczi <stefanha@redhat.com>
Subject: Re: [PATCH] qemu-coroutine-sleep: Silence Coverity warning
Date: Tue, 12 Nov 2019 11:22:27 +0000 [thread overview]
Message-ID: <87zhh18hl8.fsf@linaro.org> (raw)
In-Reply-To: <20191111203524.21912-1-eblake@redhat.com>
Eric Blake <eblake@redhat.com> writes:
> Coverity warns that we store the address of a stack variable through a
> pointer passed in by the caller, which would let the caller trivially
> trigger use-after-free if that stored value is still present when we
> finish execution. However, the way coroutines work is that after our
> call to qemu_coroutine_yield(), control is temporarily continued in
> the caller prior to our function concluding, and in order to resume
> our coroutine, the caller must poll until the variable has been set to
> NULL. Thus, we can add an assert that we do not leak stack storage to
> the caller on function exit.
>
> Fixes: Coverity CID 1406474
> CC: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Eric Blake <eblake@redhat.com>
It's a worthwhile documentation of what's going on even if it doesn't
shut up coverity.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
--
Alex Bennée
prev parent reply other threads:[~2019-11-12 11:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-11 20:35 [PATCH] qemu-coroutine-sleep: Silence Coverity warning Eric Blake
2019-11-12 9:56 ` Peter Maydell
2019-11-12 10:08 ` Vladimir Sementsov-Ogievskiy
2019-11-12 10:50 ` Peter Maydell
2019-11-12 11:22 ` Alex Bennée [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87zhh18hl8.fsf@linaro.org \
--to=alex.bennee@linaro.org \
--cc=kwolf@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
--cc=vsementsov@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.