[PATCH] tools: libxl: make it illegal to pass libxl__realloc(gc) a non-gc ptr

[PATCH] tools: libxl: make it illegal to pass libxl__realloc(gc) a non-gc ptr

[Ian Campbell]

That is, if gc is not NOGC and ptr is not NULL then ptr must be
associated gc.

Currently in this case the new_ptr would not be registered with any
gc, which Coverity rightly points out would be a memory leak.

It would also be possible to fix this by adding a libxl__ptr_add() at
the same point, however semantically it seems like a programming error
to gc-realloc a pointer which is not associated with the gc in
question, so treat it as such.

Compile tested only, this change could expose latent bugs.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 tools/libxl/libxl_internal.c | 7 +++++++
 tools/libxl/libxl_internal.h | 4 +++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/libxl/libxl_internal.c b/tools/libxl/libxl_internal.c
index 328046b..179d618 100644
--- a/tools/libxl/libxl_internal.c
+++ b/tools/libxl/libxl_internal.c
@@ -122,6 +122,13 @@ void *libxl__realloc(libxl__gc *gc, void *ptr, size_t new_size)
                 break;
             }
         }
+        /*
+         * If we get here then ptr was not previously registered with
+         * this gc.
+         */
+        LOG(CRITICAL,
+            "libxl__realloc on a pointer which tracked by the given gc");
+        abort();
     }
 
     return new_ptr;
diff --git a/tools/libxl/libxl_internal.h b/tools/libxl/libxl_internal.h
index fc1b558..650a958 100644
--- a/tools/libxl/libxl_internal.h
+++ b/tools/libxl/libxl_internal.h
@@ -617,7 +617,9 @@ _hidden void *libxl__zalloc(libxl__gc *gc_opt, size_t size) NN1;
 _hidden void *libxl__calloc(libxl__gc *gc_opt, size_t nmemb, size_t size) NN1;
 /* change the size of the memory block pointed to by @ptr to @new_size bytes.
  * unlike other allocation functions here any additional space between the
- * oldsize and @new_size is not initialised (similar to a gc'd realloc(3)). */
+ * oldsize and @new_size is not initialised (similar to a gc'd realloc(3)).
+ * if @ptr is non-NULL and @gc_opt is not nogc_gc then @ptr must have been
+ * registered with @gc_opt previously. */
 _hidden void *libxl__realloc(libxl__gc *gc_opt, void *ptr, size_t new_size) NN1;
 /* print @fmt into an allocated string large enoughto contain the result.
  * (similar to gc'd asprintf(3)). */
-- 
2.1.4

Re: [PATCH] tools: libxl: make it illegal to pass libxl__realloc(gc) a non-gc ptr

[Andrew Cooper]

On 10/02/16 17:27, Ian Campbell wrote:
> That is, if gc is not NOGC and ptr is not NULL then ptr must be
> associated gc.
>
> Currently in this case the new_ptr would not be registered with any
> gc, which Coverity rightly points out would be a memory leak.
>
> It would also be possible to fix this by adding a libxl__ptr_add() at
> the same point, however semantically it seems like a programming error
> to gc-realloc a pointer which is not associated with the gc in
> question, so treat it as such.
>
> Compile tested only, this change could expose latent bugs.
>
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> ---
>  tools/libxl/libxl_internal.c | 7 +++++++
>  tools/libxl/libxl_internal.h | 4 +++-
>  2 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/tools/libxl/libxl_internal.c b/tools/libxl/libxl_internal.c
> index 328046b..179d618 100644
> --- a/tools/libxl/libxl_internal.c
> +++ b/tools/libxl/libxl_internal.c
> @@ -122,6 +122,13 @@ void *libxl__realloc(libxl__gc *gc, void *ptr, size_t new_size)
>                  break;
>              }
>          }
> +        /*
> +         * If we get here then ptr was not previously registered with
> +         * this gc.
> +         */
> +        LOG(CRITICAL,
> +            "libxl__realloc on a pointer which tracked by the given gc");

"is not" ?

~Andrew

Re: [PATCH] tools: libxl: make it illegal to pass libxl__realloc(gc) a non-gc ptr

[Ian Campbell]

On Wed, 2016-02-10 at 17:33 +0000, Andrew Cooper wrote:
> On 10/02/16 17:27, Ian Campbell wrote:
> > That is, if gc is not NOGC and ptr is not NULL then ptr must be
> > associated gc.
> >
> > Currently in this case the new_ptr would not be registered with any
> > gc, which Coverity rightly points out would be a memory leak.
> >
> > It would also be possible to fix this by adding a libxl__ptr_add()
> at
> > the same point, however semantically it seems like a programming
> error
> > to gc-realloc a pointer which is not associated with the gc in
> > question, so treat it as such.
> >
> > Compile tested only, this change could expose latent bugs.
> >
> > Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> > ---
> >  tools/libxl/libxl_internal.c | 7 +++++++
> >  tools/libxl/libxl_internal.h | 4 +++-
> >  2 files changed, 10 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/libxl/libxl_internal.c
> b/tools/libxl/libxl_internal.c
> > index 328046b..179d618 100644
> > --- a/tools/libxl/libxl_internal.c
> > +++ b/tools/libxl/libxl_internal.c
> > @@ -122,6 +122,13 @@ void *libxl__realloc(libxl__gc *gc, void *ptr,
> size_t new_size)
> >                  break;
> >              }
> >          }
> > +        /*
> > +         * If we get here then ptr was not previously registered
> with
> > +         * this gc.
> > +         */
> > +        LOG(CRITICAL,
> > +            "libxl__realloc on a pointer which tracked by the
> given gc");
> 
> "is not" ?

Yes.

More importantly I'd somehow convinced myself that the break in the for
loop went one scope further than it did. IOW this code _really_ needs
an i == gc->alloc_maxsize check before it makes a fuss!

At which point I may just turn it into an assert.

Ian.