Re: g_autoptr(Error)

[Peter Xu <peterx@redhat.com>]

On Tue, Nov 25, 2025 at 08:02:55PM +0100, Markus Armbruster wrote:
> Peter Xu <peterx@redhat.com> writes:
> 
> > On Tue, Nov 25, 2025 at 12:46:01PM +0100, Markus Armbruster wrote:
> >> Daniel P. Berrangé <berrange@redhat.com> writes:
> >> 
> >> > On Tue, Nov 25, 2025 at 08:40:07AM +0100, Markus Armbruster wrote:
> >> >> g_autoptr(T) is quite useful when the object's extent matches the
> >> >> function's.
> >> >> 
> >> >> This isn't the case for an Error object the function propagates to its
> >> >> caller.  It is the case for an Error object the function reports or
> >> >> handles itself.  However, the functions to report Error also free it.
> >
> > I'd confess I didn't pay enough attention on how the error API was designed
> > deliberately to always free the Error objects before almost whenever
> > possible.  But I see now, thanks for the write up.
> 
> You're welcome!
> 
> >> >> 
> >> >> Thus, g_autoptr(Error) is rarely applicable.  We have just three
> >> >> instances out of >1100 local Error variables, all in migration code.
> >> >> 
> >> >> Two want to move the error to the MigrationState for later handling /
> >> >> reporting.  Since migrate_set_error() doesn't move, but stores a copy,
> >> >> the original needs to be freed, and g_autoptr() is correct there.  We
> >> >> have 17 more that instead manually free with error_free() or
> >> >> error_report_err() right after migrate_set_error().
> >> >> 
> >> >> We recently discussed storing a copy vs. move the original:
> >> >> 
> >> >>     From: Peter Xu <peterx@redhat.com>
> >> >>     Subject: Re: [PATCH 0/3] migration: Error fixes and improvements
> >> >>     Date: Mon, 17 Nov 2025 11:03:37 -0500
> >> >>     Message-ID: <aRtHWbWcTh3OF2wY@x1.local>
> >> >> 
> >> >> The two g_autoptr() gave me pause when I investigated this topic, simply
> >> >> because they deviate from the common pattern migrate_set_error(s, err)
> >> >> followed by error_free() or error_report_err().
> >> >> 
> >> >> The third one became wrong when I cleaned up the reporting (missed in
> >> >> the cleanup patch, fixed in the patch I'm replying to).  I suspect my
> >> >> mistake escaped review for the same reason I made it: g_autoptr(Error)
> >> >> is unusual and not visible in the patch hunk.
> >> >> 
> >> >> Would you like me to replace the two correct uses of g_autoptr(Error) by
> >> >> more common usage?
> >
> > Works for me.
> >
> > Now I also think it should be good migrate_set_error() follow QEMU's Error
> > API design if we decide to stick with it freeing errors in such APIs.
> >
> > Said that, I wonder if you think we could still consider passing Error**
> > into migrate_set_error(), though, which will be a merged solution of
> > current Error API and what Marc-Andre proposed on resetting pointers to
> > avoid any possible UAF, which I would still slightly prefer personally.
> >
> > If we rework migrate_set_error() to take ownership first, then we can
> > naturally drop the two use cases, and remove the cleanup function.
> >
> > Markus, please also let me know if you want me to do it.
> 
> I think the first step should replace the two g_autoptr() by
> error_free(), then delete g_autoptr() support.
> 
> A possible second step is to replace migrate_set_error() by a function
> that takes ownership.  "Replace" because I think migrate_set_error()
> would be a bad name for such a function.  What's a better name?  Naming
> is hard...  migrate_error_propagate_to_state()?  Because there's
> similarity:
> 
>     error_propagate(errp, err);
> 
> stores @err in @errp, or else frees it, and
> 
>     migrate_error_propagate_to_state(s, err)

I took this one but dropped to_state to make it shorter (and also dropped
"s" to make it g_clear_pointer() friendly).

> 
> stores @err in @s, or else frees it.
> 
> We could also forgo encapsulation and simply use
> 
>     error_propagate(&s->error, err);
> 
> Matter of taste, which means migration maintainers decide.
> 
> I can do just the first step, or both.  Up to you.

I sent the patches here for both of the issues discussed (I should still
owe some other patches; I'll do them separately..):

https://lore.kernel.org/r/20251125204648.857018-1-peterx@redhat.com

Comments more than welcomed.

Thanks,

-- 
Peter Xu