| Message ID | 1396016569-1913-1-git-send-email-peter.maydell@linaro.org |
|---|---|
| State | New |
| Headers | show |
On 28 March 2014 14:22, Peter Maydell <peter.maydell@linaro.org> wrote: > Initialize the dbs->in_cancel flag in dma_bdrv_io(), since qemu_aio_get() > does not return zero-initialized memory. Spotted by the clang sanitizer > (which complained when the value loaded in dma_complete() was not valid > for a bool type); this might have resulted in leaking the AIO block. Please ignore the 1/2 in the header -- this is a single standalone patch, I just fluffed the git-format-patch command. thanks -- PMM
On 28 March 2014 14:22, Peter Maydell <peter.maydell@linaro.org> wrote: > Initialize the dbs->in_cancel flag in dma_bdrv_io(), since qemu_aio_get() > does not return zero-initialized memory. Spotted by the clang sanitizer > (which complained when the value loaded in dma_complete() was not valid > for a bool type); this might have resulted in leaking the AIO block. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > > dma-helpers.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/dma-helpers.c b/dma-helpers.c > index c9620a5..5f421e9 100644 > --- a/dma-helpers.c > +++ b/dma-helpers.c > @@ -213,6 +213,7 @@ BlockDriverAIOCB *dma_bdrv_io( > dbs->sg_cur_index = 0; > dbs->sg_cur_byte = 0; > dbs->dir = dir; > + dbs->in_cancel = false; > dbs->io_func = io_func; > dbs->bh = NULL; > qemu_iovec_init(&dbs->iov, sg->nsg); > -- > 1.9.0 Ping, or do we think this isn't worthwhile for 2.0? (I guess I should have stuck a for-2.0 in the subject.) thanks -- PMM
On Fri, Mar 28, 2014 at 02:22:49PM +0000, Peter Maydell wrote: > Initialize the dbs->in_cancel flag in dma_bdrv_io(), since qemu_aio_get() > does not return zero-initialized memory. Spotted by the clang sanitizer > (which complained when the value loaded in dma_complete() was not valid > for a bool type); this might have resulted in leaking the AIO block. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > > dma-helpers.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/dma-helpers.c b/dma-helpers.c > index c9620a5..5f421e9 100644 > --- a/dma-helpers.c > +++ b/dma-helpers.c > @@ -213,6 +213,7 @@ BlockDriverAIOCB *dma_bdrv_io( > dbs->sg_cur_index = 0; > dbs->sg_cur_byte = 0; > dbs->dir = dir; > + dbs->in_cancel = false; > dbs->io_func = io_func; > dbs->bh = NULL; > qemu_iovec_init(&dbs->iov, sg->nsg); Worth merging for 2.0. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Am 28.03.2014 um 15:22 hat Peter Maydell geschrieben: > Initialize the dbs->in_cancel flag in dma_bdrv_io(), since qemu_aio_get() > does not return zero-initialized memory. Spotted by the clang sanitizer > (which complained when the value loaded in dma_complete() was not valid > for a bool type); this might have resulted in leaking the AIO block. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Thanks, applied to the block branch. Kevin
diff --git a/dma-helpers.c b/dma-helpers.c index c9620a5..5f421e9 100644 --- a/dma-helpers.c +++ b/dma-helpers.c @@ -213,6 +213,7 @@ BlockDriverAIOCB *dma_bdrv_io( dbs->sg_cur_index = 0; dbs->sg_cur_byte = 0; dbs->dir = dir; + dbs->in_cancel = false; dbs->io_func = io_func; dbs->bh = NULL; qemu_iovec_init(&dbs->iov, sg->nsg);
Initialize the dbs->in_cancel flag in dma_bdrv_io(), since qemu_aio_get() does not return zero-initialized memory. Spotted by the clang sanitizer (which complained when the value loaded in dma_complete() was not valid for a bool type); this might have resulted in leaking the AIO block. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- dma-helpers.c | 1 + 1 file changed, 1 insertion(+)