From: Peter Maydell <peter.maydell@linaro.org>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: "Daniel P . Berrange" <berrange@redhat.com>,
"Michael S . Tsirkin" <mst@redhat.com>,
Michael Tokarev <mjt@tls.msk.ru>,
Richard Henderson <richard.henderson@linaro.org>,
QEMU Developers <qemu-devel@nongnu.org>,
Anthony Perard <anthony.perard@citrix.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [RFC PATCH-for-5.1? v3 1/2] memory: Allow monkey-patching MemoryRegion access sizes
Date: Tue, 21 Jul 2020 15:32:10 +0100 [thread overview]
Message-ID: <CAFEAcA8-1b6UQ2TLh4nRGJuo2kGK31J_UWJi1fH26tjpF5gvLA@mail.gmail.com> (raw)
In-Reply-To: <0c235275-7cbb-7f50-2ff6-4d4ffe6a086f@amsat.org>
On Tue, 21 Jul 2020 at 15:23, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> On 7/21/20 2:49 PM, Peter Maydell wrote:
> > On Tue, 21 Jul 2020 at 13:39, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >>
> >> On 7/21/20 2:33 PM, Peter Maydell wrote:
> >>> On Tue, 21 Jul 2020 at 13:31, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >>> Don't you now need to g_memfree() mr->ops somewhere? Otherwise
> >>> you've leaked it if the device which owned this MemoryRegion
> >>> is hot-unplugged, I think.
> >>
> >> I haven't thinking of hot-unplug. I went with the simplest fix
> >> considering we are in freeze, and fixing the bug was more
> >> important that a leak at this point.
> >> I'll have a look at freeing this memory, hoping it is still less
> >> disruptive than a proper architectural change to fix this problem.
> >
> > Instead of g_memdup()ing the ops struct here, you could maybe
> > do it in isa_register_ioport() instead. Then you don't need to
> > worry about leaks because we know all ISA devices are not
> > hotpluggable, and the ugliness is also a bit more constrained
> > to the ISA code. (Coverity probably still thinks it's a leak though.)
>
> I tried that first but got:
>
> memory.c: In function ‘memory_region_initfn’:
> memory.c:1221:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
> 1221 | mr->ops = &unassigned_mem_ops;
> | ^
> memory.c: In function ‘memory_region_init_io’:
> memory.c:1488:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
> 1488 | mr->ops = ops ? ops : &unassigned_mem_ops;
> | ^
> memory.c: In function ‘memory_region_init_ram_device_ptr’:
> memory.c:1625:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
> 1625 | mr->ops = &ram_device_mem_ops;
> | ^
> memory.c: In function ‘memory_region_init_rom_device_nomigrate’:
> memory.c:1667:13: error: assignment discards ‘const’ qualifier from
> pointer target type [-Werror=discarded-qualifiers]
> 1667 | mr->ops = ops;
> | ^
I don't think you should need to change MemoryRegion::ops to
non-const for this approach. Since you allocate the memory for the
new ops struct in isa_register_ioport() you can set it
up there before assigning it to mr->ops -- you're not trying
to modify-in-place the mr->ops that's already there.
thanks
-- PMM
next prev parent reply other threads:[~2020-07-21 14:33 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-21 12:31 [RFC PATCH-for-5.1? v3 0/2] hw/isa: Allow 8/16/32 bit access on ISA bus after CVE-2020-13754 fix Philippe Mathieu-Daudé
2020-07-21 12:31 ` [RFC PATCH-for-5.1? v3 1/2] memory: Allow monkey-patching MemoryRegion access sizes Philippe Mathieu-Daudé
2020-07-21 12:33 ` Peter Maydell
2020-07-21 12:39 ` Philippe Mathieu-Daudé
2020-07-21 12:49 ` Peter Maydell
2020-07-21 14:23 ` Philippe Mathieu-Daudé
2020-07-21 14:32 ` Peter Maydell [this message]
2020-07-21 12:31 ` [RFC PATCH-for-5.1? v3 2/2] hw/isa/isa-bus: Ensure ISA I/O regions are 8/16/32-bit accessible Philippe Mathieu-Daudé
2020-07-21 12:41 ` Peter Maydell
2020-07-21 12:55 ` Philippe Mathieu-Daudé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFEAcA8-1b6UQ2TLh4nRGJuo2kGK31J_UWJi1fH26tjpF5gvLA@mail.gmail.com \
--to=peter.maydell@linaro.org \
--cc=anthony.perard@citrix.com \
--cc=berrange@redhat.com \
--cc=f4bug@amsat.org \
--cc=mjt@tls.msk.ru \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).