* [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
@ 2016-04-01 7:08 zhanghailiang
2016-04-01 7:39 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: zhanghailiang @ 2016-04-01 7:08 UTC (permalink / raw)
To: qemu-devel; +Cc: jasowang, zhanghailiang
After commit 338d3f, we support 'status' property for filter object.
The segfault can be triggered by starting qemu with 'status=off' property
for filter, when the s->incoming_queue is NULL, we reference it directly
in qemu_net_queue_flush().
Let's check the value of 's->incoming_queue' before calling
qemu_net_queue_flush().
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
---
net/filter-buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/filter-buffer.c b/net/filter-buffer.c
index cc6bd94..79e2ce3 100644
--- a/net/filter-buffer.c
+++ b/net/filter-buffer.c
@@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
{
FilterBufferState *s = FILTER_BUFFER(nf);
- if (!qemu_net_queue_flush(s->incoming_queue)) {
+ if (s->incoming_queue && !qemu_net_queue_flush(s->incoming_queue)) {
/* Unable to empty the queue, purge remaining packets */
qemu_net_queue_purge(s->incoming_queue, nf->netdev);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
2016-04-01 7:08 [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property zhanghailiang
@ 2016-04-01 7:39 ` Jason Wang
2016-04-01 8:24 ` Hailiang Zhang
0 siblings, 1 reply; 6+ messages in thread
From: Jason Wang @ 2016-04-01 7:39 UTC (permalink / raw)
To: zhanghailiang, qemu-devel
On 04/01/2016 03:08 PM, zhanghailiang wrote:
> After commit 338d3f, we support 'status' property for filter object.
> The segfault can be triggered by starting qemu with 'status=off' property
> for filter, when the s->incoming_queue is NULL, we reference it directly
> in qemu_net_queue_flush().
>
> Let's check the value of 's->incoming_queue' before calling
> qemu_net_queue_flush().
>
> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
> ---
> net/filter-buffer.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/filter-buffer.c b/net/filter-buffer.c
> index cc6bd94..79e2ce3 100644
> --- a/net/filter-buffer.c
> +++ b/net/filter-buffer.c
> @@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
> {
> FilterBufferState *s = FILTER_BUFFER(nf);
>
> - if (!qemu_net_queue_flush(s->incoming_queue)) {
> + if (s->incoming_queue && !qemu_net_queue_flush(s->incoming_queue)) {
> /* Unable to empty the queue, purge remaining packets */
> qemu_net_queue_purge(s->incoming_queue, nf->netdev);
> }
We'd better handle this at generic layer and don't let a specific net
filter need to worry about this.
Looks like the issue is we may trigger status_changed() too early (even
before the the filter was initialized).
How about not call status_changed() if the initialization is not done?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
2016-04-01 7:39 ` Jason Wang
@ 2016-04-01 8:24 ` Hailiang Zhang
2016-04-01 9:10 ` Wen Congyang
0 siblings, 1 reply; 6+ messages in thread
From: Hailiang Zhang @ 2016-04-01 8:24 UTC (permalink / raw)
To: Jason Wang, qemu-devel; +Cc: peter.huangpeng
On 2016/4/1 15:39, Jason Wang wrote:
>
>
> On 04/01/2016 03:08 PM, zhanghailiang wrote:
>> After commit 338d3f, we support 'status' property for filter object.
>> The segfault can be triggered by starting qemu with 'status=off' property
>> for filter, when the s->incoming_queue is NULL, we reference it directly
>> in qemu_net_queue_flush().
>>
>> Let's check the value of 's->incoming_queue' before calling
>> qemu_net_queue_flush().
>>
>> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
>> ---
>> net/filter-buffer.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/filter-buffer.c b/net/filter-buffer.c
>> index cc6bd94..79e2ce3 100644
>> --- a/net/filter-buffer.c
>> +++ b/net/filter-buffer.c
>> @@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
>> {
>> FilterBufferState *s = FILTER_BUFFER(nf);
>>
>> - if (!qemu_net_queue_flush(s->incoming_queue)) {
>> + if (s->incoming_queue && !qemu_net_queue_flush(s->incoming_queue)) {
>> /* Unable to empty the queue, purge remaining packets */
>> qemu_net_queue_purge(s->incoming_queue, nf->netdev);
>> }
>
> We'd better handle this at generic layer and don't let a specific net
> filter need to worry about this.
>
> Looks like the issue is we may trigger status_changed() too early (even
> before the the filter was initialized).
>
Yes ~
> How about not call status_changed() if the initialization is not done?
>
But seems that it is difficult to confirm if the filter is initialized
or not ...
> .
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
2016-04-01 8:24 ` Hailiang Zhang
@ 2016-04-01 9:10 ` Wen Congyang
2016-04-01 9:33 ` Hailiang Zhang
0 siblings, 1 reply; 6+ messages in thread
From: Wen Congyang @ 2016-04-01 9:10 UTC (permalink / raw)
To: Hailiang Zhang, Jason Wang, qemu-devel; +Cc: peter.huangpeng
On 04/01/2016 04:24 PM, Hailiang Zhang wrote:
> On 2016/4/1 15:39, Jason Wang wrote:
>>
>>
>> On 04/01/2016 03:08 PM, zhanghailiang wrote:
>>> After commit 338d3f, we support 'status' property for filter object.
>>> The segfault can be triggered by starting qemu with 'status=off' property
>>> for filter, when the s->incoming_queue is NULL, we reference it directly
>>> in qemu_net_queue_flush().
>>>
>>> Let's check the value of 's->incoming_queue' before calling
>>> qemu_net_queue_flush().
>>>
>>> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
>>> ---
>>> net/filter-buffer.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/net/filter-buffer.c b/net/filter-buffer.c
>>> index cc6bd94..79e2ce3 100644
>>> --- a/net/filter-buffer.c
>>> +++ b/net/filter-buffer.c
>>> @@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
>>> {
>>> FilterBufferState *s = FILTER_BUFFER(nf);
>>>
>>> - if (!qemu_net_queue_flush(s->incoming_queue)) {
>>> + if (s->incoming_queue && !qemu_net_queue_flush(s->incoming_queue)) {
>>> /* Unable to empty the queue, purge remaining packets */
>>> qemu_net_queue_purge(s->incoming_queue, nf->netdev);
>>> }
>>
>> We'd better handle this at generic layer and don't let a specific net
>> filter need to worry about this.
>>
>> Looks like the issue is we may trigger status_changed() too early (even
>> before the the filter was initialized).
>>
>
> Yes ~
>
>> How about not call status_changed() if the initialization is not done?
>>
>
> But seems that it is difficult to confirm if the filter is initialized
> or not ...
If nfc->setup() is not called, nf->netdev is NULL.
Thanks
Wen Congyang
>
>> .
>>
>
>
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
2016-04-01 9:10 ` Wen Congyang
@ 2016-04-01 9:33 ` Hailiang Zhang
2016-04-05 0:53 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: Hailiang Zhang @ 2016-04-01 9:33 UTC (permalink / raw)
To: Wen Congyang, Jason Wang, qemu-devel; +Cc: peter.huangpeng
On 2016/4/1 17:10, Wen Congyang wrote:
> On 04/01/2016 04:24 PM, Hailiang Zhang wrote:
>> On 2016/4/1 15:39, Jason Wang wrote:
>>>
>>>
>>> On 04/01/2016 03:08 PM, zhanghailiang wrote:
>>>> After commit 338d3f, we support 'status' property for filter object.
>>>> The segfault can be triggered by starting qemu with 'status=off' property
>>>> for filter, when the s->incoming_queue is NULL, we reference it directly
>>>> in qemu_net_queue_flush().
>>>>
>>>> Let's check the value of 's->incoming_queue' before calling
>>>> qemu_net_queue_flush().
>>>>
>>>> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
>>>> ---
>>>> net/filter-buffer.c | 2 +-
>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/net/filter-buffer.c b/net/filter-buffer.c
>>>> index cc6bd94..79e2ce3 100644
>>>> --- a/net/filter-buffer.c
>>>> +++ b/net/filter-buffer.c
>>>> @@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
>>>> {
>>>> FilterBufferState *s = FILTER_BUFFER(nf);
>>>>
>>>> - if (!qemu_net_queue_flush(s->incoming_queue)) {
>>>> + if (s->incoming_queue && !qemu_net_queue_flush(s->incoming_queue)) {
>>>> /* Unable to empty the queue, purge remaining packets */
>>>> qemu_net_queue_purge(s->incoming_queue, nf->netdev);
>>>> }
>>>
>>> We'd better handle this at generic layer and don't let a specific net
>>> filter need to worry about this.
>>>
>>> Looks like the issue is we may trigger status_changed() too early (even
>>> before the the filter was initialized).
>>>
>>
>> Yes ~
>>
>>> How about not call status_changed() if the initialization is not done?
>>>
>>
>> But seems that it is difficult to confirm if the filter is initialized
>> or not ...
>
> If nfc->setup() is not called, nf->netdev is NULL.
>
Yes, you right, Jason, what's opinion ?
Thanks,
hailiang
> Thanks
> Wen Congyang
>
>>
>>> .
>>>
>>
>>
>>
>>
>>
>
>
>
>
> .
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property
2016-04-01 9:33 ` Hailiang Zhang
@ 2016-04-05 0:53 ` Jason Wang
0 siblings, 0 replies; 6+ messages in thread
From: Jason Wang @ 2016-04-05 0:53 UTC (permalink / raw)
To: Hailiang Zhang, Wen Congyang, qemu-devel; +Cc: peter.huangpeng
On 04/01/2016 05:33 PM, Hailiang Zhang wrote:
> On 2016/4/1 17:10, Wen Congyang wrote:
>> On 04/01/2016 04:24 PM, Hailiang Zhang wrote:
>>> On 2016/4/1 15:39, Jason Wang wrote:
>>>>
>>>>
>>>> On 04/01/2016 03:08 PM, zhanghailiang wrote:
>>>>> After commit 338d3f, we support 'status' property for filter object.
>>>>> The segfault can be triggered by starting qemu with 'status=off'
>>>>> property
>>>>> for filter, when the s->incoming_queue is NULL, we reference it
>>>>> directly
>>>>> in qemu_net_queue_flush().
>>>>>
>>>>> Let's check the value of 's->incoming_queue' before calling
>>>>> qemu_net_queue_flush().
>>>>>
>>>>> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
>>>>> ---
>>>>> net/filter-buffer.c | 2 +-
>>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/net/filter-buffer.c b/net/filter-buffer.c
>>>>> index cc6bd94..79e2ce3 100644
>>>>> --- a/net/filter-buffer.c
>>>>> +++ b/net/filter-buffer.c
>>>>> @@ -34,7 +34,7 @@ static void filter_buffer_flush(NetFilterState *nf)
>>>>> {
>>>>> FilterBufferState *s = FILTER_BUFFER(nf);
>>>>>
>>>>> - if (!qemu_net_queue_flush(s->incoming_queue)) {
>>>>> + if (s->incoming_queue &&
>>>>> !qemu_net_queue_flush(s->incoming_queue)) {
>>>>> /* Unable to empty the queue, purge remaining packets */
>>>>> qemu_net_queue_purge(s->incoming_queue, nf->netdev);
>>>>> }
>>>>
>>>> We'd better handle this at generic layer and don't let a specific net
>>>> filter need to worry about this.
>>>>
>>>> Looks like the issue is we may trigger status_changed() too early
>>>> (even
>>>> before the the filter was initialized).
>>>>
>>>
>>> Yes ~
>>>
>>>> How about not call status_changed() if the initialization is not done?
>>>>
>>>
>>> But seems that it is difficult to confirm if the filter is initialized
>>> or not ...
>>
>> If nfc->setup() is not called, nf->netdev is NULL.
>>
>
> Yes, you right, Jason, what's opinion ?
>
> Thanks,
> hailiang
Looks good. Please also add a comment of this in the patch.
Thanks
>
>> Thanks
>> Wen Congyang
>>
>>>
>>>> .
>>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>> .
>>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-04-05 0:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-01 7:08 [Qemu-devel] [PATCH] filter-buffer: fix segfault while start qemu with status=off property zhanghailiang
2016-04-01 7:39 ` Jason Wang
2016-04-01 8:24 ` Hailiang Zhang
2016-04-01 9:10 ` Wen Congyang
2016-04-01 9:33 ` Hailiang Zhang
2016-04-05 0:53 ` Jason Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).