Re: question about SIGSEGV in datacopier_readable in libxl_aoutil.c [and 1 more messages]

[Chunyan Liu <cyliu@suse.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2102 bytes --]

2013/9/3 Ian Jackson <Ian.Jackson@eu.citrix.com>

> Ian Campbell writes ("Re: [Xen-devel] question about SIGSEGV in
> datacopier_readable in libxl_aoutil.c"):
> > On Tue, 2013-09-03 at 15:01 +0800, Chunyan Liu wrote:
> > >       if (!buf || buf->used >= sizeof(buf->buf)) {
> > >             buf = malloc(sizeof(*buf));
> ...
> > > ==7510== Syscall param read(buf) points to unaddressable byte(s)
> ...
> > > ==7510==  Address 0x18a409ec is 0 bytes after a block of size 28
> alloc'd
> > > ==7510==    at 0x4C26FFB: calloc (in
> /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
> > > ==7510==    by 0x14AAECB6: libxl__zalloc (libxl_internal.c:83)
> > > ==7510==    by 0x14AB33B0: libxl__datacopier_prefixdata
> (libxl_aoutils.c:92)
>
> I think this is my fault.  Please try this patch.
>
> Thanks,
> Ian.
>
> commit 25cd65c97b733d5892b62c3ffae0887f426398ec
> Author: Ian Jackson <ian.jackson@eu.citrix.com>
> Date:   Tue Sep 3 13:41:46 2013 +0100
>
>     libxl: Do not generate short block in libxl__datacopier_prefixdata
>
>     libxl__datacopier_prefixdata would prepend a deliberately short block
>     (not just a half-full one, but one with a short buffer) to the
>     dc->bufs queue.  However, this is wrong because datacopier_readable
>     will find it and try to continue to fill it up.
>
>     Instead, allocate a full-sized buffer.
>
>     Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
>
> diff --git a/tools/libxl/libxl_aoutils.c b/tools/libxl/libxl_aoutils.c
> index 983a60a..b4eb6e5 100644
> --- a/tools/libxl/libxl_aoutils.c
> +++ b/tools/libxl/libxl_aoutils.c
> @@ -89,7 +89,7 @@ void libxl__datacopier_prefixdata(libxl__egc *egc,
> libxl__datacopier_state *dc,
>
>      assert(len < dc->maxsz - dc->used);
>
> -    buf = libxl__zalloc(NOGC, sizeof(*buf) - sizeof(buf->buf) + len);
> +    buf = libxl__zalloc(NOGC, sizeof(*buf));
>      buf->used = len;
>      memcpy(buf->buf, data, len);
>
>
Tried the patch. It worked. Thanks.


> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel
>
>

[-- Attachment #1.2: Type: text/html, Size: 3084 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel