[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 02/10] qemu-coroutine-sleep: Silence Coverity warning
From: |
Eric Blake |
Subject: |
[PULL 02/10] qemu-coroutine-sleep: Silence Coverity warning |
Date: |
Mon, 18 Nov 2019 21:07:51 -0600 |
Coverity warns that we store the address of a stack variable through a
pointer passed in by the caller, which would let the caller trivially
trigger use-after-free if that stored value is still present when we
finish execution. However, the way coroutines work is that after our
call to qemu_coroutine_yield(), control is temporarily continued in
the caller prior to our function concluding, and in order to resume
our coroutine, the caller must poll until the variable has been set to
NULL. Thus, we can add an assert that we do not leak stack storage to
the caller on function exit.
Fixes: Coverity CID 1406474
CC: Peter Maydell <address@hidden>
Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Alex Bennée <address@hidden>
---
util/qemu-coroutine-sleep.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
index ae91b92b6e78..769a76e57df0 100644
--- a/util/qemu-coroutine-sleep.c
+++ b/util/qemu-coroutine-sleep.c
@@ -68,5 +68,12 @@ void coroutine_fn qemu_co_sleep_ns_wakeable(QEMUClockType
type, int64_t ns,
}
timer_mod(state.ts, qemu_clock_get_ns(type) + ns);
qemu_coroutine_yield();
+ if (sleep_state) {
+ /*
+ * Note that *sleep_state is cleared during qemu_co_sleep_wake
+ * before resuming this coroutine.
+ */
+ assert(*sleep_state == NULL);
+ }
timer_free(state.ts);
}
--
2.21.0
- [PULL 00/10] NBD patches for 2019-11-19 for 4.2-rc2, Eric Blake, 2019/11/18
- [PULL 01/10] iotests: Test NBD client reconnection, Eric Blake, 2019/11/18
- [PULL 04/10] bitmap: Enforce maximum bitmap name length, Eric Blake, 2019/11/18
- [PULL 06/10] MAINTAINERS: add more bitmap-related to Dirty Bitmaps section, Eric Blake, 2019/11/18
- [PULL 03/10] nbd/server: Prefer heap over stack for parsing client names, Eric Blake, 2019/11/18
- [PULL 02/10] qemu-coroutine-sleep: Silence Coverity warning,
Eric Blake <=
- [PULL 05/10] nbd: Don't send oversize strings, Eric Blake, 2019/11/18
- [PULL 10/10] tests: More iotest 223 improvements, Eric Blake, 2019/11/18
- [PULL 08/10] iotests: Switch nbd tests to use Unix rather than TCP, Eric Blake, 2019/11/18
- [PULL 07/10] iotests: Fix 173, Eric Blake, 2019/11/18
- [PULL 09/10] iotests: Include QMP input in .out files, Eric Blake, 2019/11/18
- Re: [PULL 00/10] NBD patches for 2019-11-19 for 4.2-rc2, Peter Maydell, 2019/11/19