[Qemu-devel] [PATCH v2] hostmem: fix crash when querying empty host-nodes property via QMP

[Qemu-devel] [PATCH v2] hostmem: fix crash when querying empty host-nodes property via QMP

[Igor Mammedov]

QEMU will crashes with
 qapi/qobject-output-visitor.c:210: qobject_output_complete: Assertion `qov->root && ((&qov->stack)->slh_first == ((void *)0))' failed
when trying to get value of not set hostmem's "host-nodes"
property, HostMemoryBackend::host_nodes bitmap doesn't have
any bits set in it, which leads to find_first_bit() returning
MAX_NODES and consequently to an early return from
host_memory_backend_get_host_nodes() without calling visitor.

Fix it by calling visitor even if "host-nodes" property wasn't
set before exiting from property getter to return valid empty
list.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
---
v2:
  * fixup commit message to put emphasis on property instead
    local variable host_nodes and make explanation more hopefully
    more clear. (Markus Armbruster <armbru@redhat.com>)
---
 backends/hostmem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backends/hostmem.c b/backends/hostmem.c
index 87b19d2111..04baf479a1 100644
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -88,7 +88,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
 
     value = find_first_bit(backend->host_nodes, MAX_NODES);
     if (value == MAX_NODES) {
-        return;
+        goto ret;
     }
 
     *node = g_malloc0(sizeof(**node));
@@ -106,6 +106,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
         node = &(*node)->next;
     } while (true);
 
+ret:
     visit_type_uint16List(v, name, &host_nodes, errp);
 }
 
-- 
2.18.1

Re: [Qemu-devel] [PATCH v2] hostmem: fix crash when querying empty host-nodes property via QMP

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 1898 bytes --]

On 2/14/19 4:57 AM, Igor Mammedov wrote:
> QEMU will crashes with
>  qapi/qobject-output-visitor.c:210: qobject_output_complete: Assertion `qov->root && ((&qov->stack)->slh_first == ((void *)0))' failed
> when trying to get value of not set hostmem's "host-nodes"
> property, HostMemoryBackend::host_nodes bitmap doesn't have
> any bits set in it, which leads to find_first_bit() returning
> MAX_NODES and consequently to an early return from
> host_memory_backend_get_host_nodes() without calling visitor.
> 
> Fix it by calling visitor even if "host-nodes" property wasn't
> set before exiting from property getter to return valid empty
> list.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> ---
> v2:
>   * fixup commit message to put emphasis on property instead
>     local variable host_nodes and make explanation more hopefully
>     more clear. (Markus Armbruster <armbru@redhat.com>)
> ---
>  backends/hostmem.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

Reviewed-by: Eric Blake <eblake@redhat.com>

> diff --git a/backends/hostmem.c b/backends/hostmem.c
> index 87b19d2111..04baf479a1 100644
> --- a/backends/hostmem.c
> +++ b/backends/hostmem.c
> @@ -88,7 +88,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
>  
>      value = find_first_bit(backend->host_nodes, MAX_NODES);
>      if (value == MAX_NODES) {
> -        return;
> +        goto ret;
>      }
>  
>      *node = g_malloc0(sizeof(**node));
> @@ -106,6 +106,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
>          node = &(*node)->next;
>      } while (true);
>  
> +ret:
>      visit_type_uint16List(v, name, &host_nodes, errp);
>  }
>  
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [Qemu-devel] [PATCH v2] hostmem: fix crash when querying empty host-nodes property via QMP

[Stefano Garzarella]

On Thu, Feb 14, 2019 at 05:57:33AM -0500, Igor Mammedov wrote:
> QEMU will crashes with
>  qapi/qobject-output-visitor.c:210: qobject_output_complete: Assertion `qov->root && ((&qov->stack)->slh_first == ((void *)0))' failed
> when trying to get value of not set hostmem's "host-nodes"
> property, HostMemoryBackend::host_nodes bitmap doesn't have
> any bits set in it, which leads to find_first_bit() returning
> MAX_NODES and consequently to an early return from
> host_memory_backend_get_host_nodes() without calling visitor.
> 
> Fix it by calling visitor even if "host-nodes" property wasn't
> set before exiting from property getter to return valid empty
> list.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> ---
> v2:
>   * fixup commit message to put emphasis on property instead
>     local variable host_nodes and make explanation more hopefully
>     more clear. (Markus Armbruster <armbru@redhat.com>)
> ---
>  backends/hostmem.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Re: [Qemu-devel] [PATCH v2] hostmem: fix crash when querying empty host-nodes property via QMP

[Eduardo Habkost]

On Thu, Feb 14, 2019 at 05:57:33AM -0500, Igor Mammedov wrote:
> QEMU will crashes with
>  qapi/qobject-output-visitor.c:210: qobject_output_complete: Assertion `qov->root && ((&qov->stack)->slh_first == ((void *)0))' failed
> when trying to get value of not set hostmem's "host-nodes"
> property, HostMemoryBackend::host_nodes bitmap doesn't have
> any bits set in it, which leads to find_first_bit() returning
> MAX_NODES and consequently to an early return from
> host_memory_backend_get_host_nodes() without calling visitor.
> 
> Fix it by calling visitor even if "host-nodes" property wasn't
> set before exiting from property getter to return valid empty
> list.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>

Queued on machine-next, thanks!

-- 
Eduardo