qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Peter Maydell <peter.maydell@linaro.org>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: "Daniel P . Berrange" <berrange@redhat.com>,
	"Michael S . Tsirkin" <mst@redhat.com>,
	Michael Tokarev <mjt@tls.msk.ru>,
	Richard Henderson <richard.henderson@linaro.org>,
	QEMU Developers <qemu-devel@nongnu.org>,
	Anthony Perard <anthony.perard@citrix.com>,
	Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [RFC PATCH-for-5.1? v3 1/2] memory: Allow monkey-patching MemoryRegion access sizes
Date: Tue, 21 Jul 2020 15:32:10 +0100	[thread overview]
Message-ID: <CAFEAcA8-1b6UQ2TLh4nRGJuo2kGK31J_UWJi1fH26tjpF5gvLA@mail.gmail.com> (raw)
In-Reply-To: <0c235275-7cbb-7f50-2ff6-4d4ffe6a086f@amsat.org>

On Tue, 21 Jul 2020 at 15:23, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> On 7/21/20 2:49 PM, Peter Maydell wrote:
> > On Tue, 21 Jul 2020 at 13:39, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >>
> >> On 7/21/20 2:33 PM, Peter Maydell wrote:
> >>> On Tue, 21 Jul 2020 at 13:31, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >>> Don't you now need to g_memfree() mr->ops somewhere? Otherwise
> >>> you've leaked it if the device which owned this MemoryRegion
> >>> is hot-unplugged, I think.
> >>
> >> I haven't thinking of hot-unplug. I went with the simplest fix
> >> considering we are in freeze, and fixing the bug was more
> >> important that a leak at this point.
> >> I'll have a look at freeing this memory, hoping it is still less
> >> disruptive than a proper architectural change to fix this problem.
> >
> > Instead of g_memdup()ing the ops struct here, you could maybe
> > do it in isa_register_ioport() instead. Then you don't need to
> > worry about leaks because we know all ISA devices are not
> > hotpluggable, and the ugliness is also a bit more constrained
> > to the ISA code. (Coverity probably still thinks it's a leak though.)
>
> I tried that first but got:
>
> memory.c: In function ‘memory_region_initfn’:
> memory.c:1221:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
>  1221 |     mr->ops = &unassigned_mem_ops;
>       |             ^
> memory.c: In function ‘memory_region_init_io’:
> memory.c:1488:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
>  1488 |     mr->ops = ops ? ops : &unassigned_mem_ops;
>       |             ^
> memory.c: In function ‘memory_region_init_ram_device_ptr’:
> memory.c:1625:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
>  1625 |     mr->ops = &ram_device_mem_ops;
>       |             ^
> memory.c: In function ‘memory_region_init_rom_device_nomigrate’:
> memory.c:1667:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
>  1667 |     mr->ops = ops;
>       |             ^

I don't think you should need to change MemoryRegion::ops to
non-const for this approach. Since you allocate the memory for the
new ops struct in isa_register_ioport() you can set it
up there before assigning it to mr->ops -- you're not trying
to modify-in-place the mr->ops that's already there.

thanks
-- PMM


  reply	other threads:[~2020-07-21 14:33 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-21 12:31 [RFC PATCH-for-5.1? v3 0/2] hw/isa: Allow 8/16/32 bit access on ISA bus after CVE-2020-13754 fix Philippe Mathieu-Daudé
2020-07-21 12:31 ` [RFC PATCH-for-5.1? v3 1/2] memory: Allow monkey-patching MemoryRegion access sizes Philippe Mathieu-Daudé
2020-07-21 12:33   ` Peter Maydell
2020-07-21 12:39     ` Philippe Mathieu-Daudé
2020-07-21 12:49       ` Peter Maydell
2020-07-21 14:23         ` Philippe Mathieu-Daudé
2020-07-21 14:32           ` Peter Maydell [this message]
2020-07-21 12:31 ` [RFC PATCH-for-5.1? v3 2/2] hw/isa/isa-bus: Ensure ISA I/O regions are 8/16/32-bit accessible Philippe Mathieu-Daudé
2020-07-21 12:41   ` Peter Maydell
2020-07-21 12:55     ` Philippe Mathieu-Daudé

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFEAcA8-1b6UQ2TLh4nRGJuo2kGK31J_UWJi1fH26tjpF5gvLA@mail.gmail.com \
    --to=peter.maydell@linaro.org \
    --cc=anthony.perard@citrix.com \
    --cc=berrange@redhat.com \
    --cc=f4bug@amsat.org \
    --cc=mjt@tls.msk.ru \
    --cc=mst@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=richard.henderson@linaro.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).