[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 2/9] migration/rdma: Fix cm event use after free
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 2/9] migration/rdma: Fix cm event use after free |
Date: |
Wed, 9 Jun 2021 15:45:05 +0100 |
From: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Message-Id: <20210602023506.3821293-1-lizhijian@cn.fujitsu.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
migration/rdma.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/migration/rdma.c b/migration/rdma.c
index 1cdb4561f3..d90b29a4b5 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext
*rdma)
if (pfds[1].revents) {
ret = rdma_get_cm_event(rdma->channel, &cm_event);
- if (!ret) {
- rdma_ack_cm_event(cm_event);
+ if (ret) {
+ error_report("failed to get cm event while wait "
+ "completion channel");
+ return -EPIPE;
}
error_report("receive cm event while wait comp channel,"
"cm event is %d", cm_event->event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
+ rdma_ack_cm_event(cm_event);
return -EPIPE;
}
+ rdma_ack_cm_event(cm_event);
}
break;
@@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
error_report("get_cm_event failed %d", errno);
return;
}
- rdma_ack_cm_event(cm_event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
@@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
rdma->return_path->error_state = -EPIPE;
}
}
+ rdma_ack_cm_event(cm_event);
if (mis->migration_incoming_co) {
qemu_coroutine_enter(mis->migration_incoming_co);
}
return;
}
+ rdma_ack_cm_event(cm_event);
}
static int qemu_rdma_accept(RDMAContext *rdma)
--
2.31.1
- [PULL 0/9] migration queue, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 1/9] yank: Unregister function when using TLS migration, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 2/9] migration/rdma: Fix cm event use after free,
Dr. David Alan Gilbert (git) <=
- [PULL 3/9] channel-socket: Only set CLOEXEC if we have space for fds, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 4/9] io/net-listener: Call the notifier during finalize, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 6/9] migration/socket: Close the listener at the end, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 7/9] sockets: Support multipath TCP, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 5/9] migration: Add cleanup hook for inwards migration, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 9/9] hmp: Add "calc_dirty_rate" and "info dirty_rate" cmds, Dr. David Alan Gilbert (git), 2021/06/09
- [PULL 8/9] migration/dirtyrate: make sample page count configurable, Dr. David Alan Gilbert (git), 2021/06/09
- Re: [PULL 0/9] migration queue, Peter Maydell, 2021/06/09
- Re: [PULL 0/9] migration queue, no-reply, 2021/06/14