From patchwork Thu Jan 8 17:33:18 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 426755 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 24D57140129 for ; Fri, 9 Jan 2015 04:54:05 +1100 (AEDT) Received: from localhost ([::1]:47242 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9HHX-0004BG-Ax for incoming@patchwork.ozlabs.org; Thu, 08 Jan 2015 12:54:03 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59774) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9GzM-0003NB-7r for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y9GzF-0006M4-0T for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:16 -0500 Received: from e7.ny.us.ibm.com ([32.97.182.137]:55006) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9GzE-0006LR-TV for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:08 -0500 Received: from /spool/local by e7.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 8 Jan 2015 12:35:08 -0500 Received: from d01dlp01.pok.ibm.com (9.56.250.166) by e7.ny.us.ibm.com (192.168.1.107) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 8 Jan 2015 12:35:05 -0500 Received: from b01cxnp22035.gho.pok.ibm.com (b01cxnp22035.gho.pok.ibm.com [9.57.198.25]) by d01dlp01.pok.ibm.com (Postfix) with ESMTP id 73A8938C804D; Thu, 8 Jan 2015 12:35:05 -0500 (EST) Received: from d01av02.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216]) by b01cxnp22035.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t08HZ5ld21758192; Thu, 8 Jan 2015 17:35:05 GMT Received: from d01av02.pok.ibm.com (localhost [127.0.0.1]) by d01av02.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t08HZ4t6009176; Thu, 8 Jan 2015 12:35:05 -0500 Received: from localhost (morrigu.austin.ibm.com [9.41.105.45]) by d01av02.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id t08HZ2w7009009; Thu, 8 Jan 2015 12:35:02 -0500 From: Michael Roth To: qemu-devel@nongnu.org Date: Thu, 8 Jan 2015 11:33:18 -0600 Message-Id: <1420738472-23267-15-git-send-email-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 15010817-0037-0000-0000-0000004BC304 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 32.97.182.137 Cc: qemu-stable@nongnu.org Subject: [Qemu-devel] [PATCH 14/88] qapi: add visit_start_union and visit_end_union X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org In some cases an input visitor might bail out on filling out a struct for various reasons, such as missing fields when running in strict mode. In the case of a QAPI Union type, this may lead to cases where the .kind field which encodes the union type is uninitialized. Subsequently, other visitors, such as the dealloc visitor, may use this .kind value as if it were initialized, leading to assumptions about the union type which in this case may lead to segfaults. For example, freeing an integer value. However, we can generally rely on the fact that the always-present .data void * field that we generate for these union types will always be NULL in cases where .kind is uninitialized (at least, there shouldn't be a reason where we'd do this purposefully). So pass this information on to Visitor implementation via these optional start_union/end_union interfaces so this information can be used to guard against the situation above. We will make use of this information in a subsequent patch for the dealloc visitor. Cc: qemu-stable@nongnu.org Reported-by: Fam Zheng Suggested-by: Paolo Bonzini Reviewed-by: Paolo Bonzini Reviewed-by: Eric Blake Signed-off-by: Michael Roth Signed-off-by: Luiz Capitulino (cherry picked from commit cee2dedb85b97e4976c83bea84064c3921b8b7ac) Signed-off-by: Michael Roth --- include/qapi/visitor-impl.h | 2 ++ include/qapi/visitor.h | 2 ++ qapi/qapi-visit-core.c | 15 +++++++++++++++ scripts/qapi-visit.py | 6 ++++++ 4 files changed, 25 insertions(+) diff --git a/include/qapi/visitor-impl.h b/include/qapi/visitor-impl.h index ecc0183..09bb0fd 100644 --- a/include/qapi/visitor-impl.h +++ b/include/qapi/visitor-impl.h @@ -55,6 +55,8 @@ struct Visitor void (*type_int64)(Visitor *v, int64_t *obj, const char *name, Error **errp); /* visit_type_size() falls back to (*type_uint64)() if type_size is unset */ void (*type_size)(Visitor *v, uint64_t *obj, const char *name, Error **errp); + bool (*start_union)(Visitor *v, bool data_present, Error **errp); + void (*end_union)(Visitor *v, bool data_present, Error **errp); }; void input_type_enum(Visitor *v, int *obj, const char *strings[], diff --git a/include/qapi/visitor.h b/include/qapi/visitor.h index 4a0178f..5934f59 100644 --- a/include/qapi/visitor.h +++ b/include/qapi/visitor.h @@ -58,5 +58,7 @@ void visit_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp); void visit_type_bool(Visitor *v, bool *obj, const char *name, Error **errp); void visit_type_str(Visitor *v, char **obj, const char *name, Error **errp); void visit_type_number(Visitor *v, double *obj, const char *name, Error **errp); +bool visit_start_union(Visitor *v, bool data_present, Error **errp); +void visit_end_union(Visitor *v, bool data_present, Error **errp); #endif diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c index 55f8d40..b66b93a 100644 --- a/qapi/qapi-visit-core.c +++ b/qapi/qapi-visit-core.c @@ -58,6 +58,21 @@ void visit_end_list(Visitor *v, Error **errp) v->end_list(v, errp); } +bool visit_start_union(Visitor *v, bool data_present, Error **errp) +{ + if (v->start_union) { + return v->start_union(v, data_present, errp); + } + return true; +} + +void visit_end_union(Visitor *v, bool data_present, Error **errp) +{ + if (v->end_union) { + v->end_union(v, data_present, errp); + } +} + void visit_optional(Visitor *v, bool *present, const char *name, Error **errp) { diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py index c129697..cfce31b 100644 --- a/scripts/qapi-visit.py +++ b/scripts/qapi-visit.py @@ -357,6 +357,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e if (err) { goto out_obj; } + if (!visit_start_union(m, !!(*obj)->data, &err) || err) { + goto out_obj; + } switch ((*obj)->kind) { ''', disc_type = disc_type, @@ -385,6 +388,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e out_obj: error_propagate(errp, err); err = NULL; + visit_end_union(m, !!(*obj)->data, &err); + error_propagate(errp, err); + err = NULL; } visit_end_struct(m, &err); out: