[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 05/31] aio-posix: fix use after leaving scope in aio_poll()
From: |
Stefan Hajnoczi |
Subject: |
[PULL 05/31] aio-posix: fix use after leaving scope in aio_poll() |
Date: |
Sat, 22 Feb 2020 08:50:04 +0000 |
epoll_handler is a stack variable and must not be accessed after it goes
out of scope:
if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) {
AioHandler epoll_handler;
...
add_pollfd(&epoll_handler);
ret = aio_epoll(ctx, pollfds, npfd, timeout);
} ...
...
/* if we have any readable fds, dispatch event */
if (ret > 0) {
for (i = 0; i < npfd; i++) {
nodes[i]->pfd.revents = pollfds[i].revents;
}
}
nodes[0] is &epoll_handler, which has already gone out of scope.
There is no need to use pollfds[] for epoll. We don't need an
AioHandler for the epoll fd.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Sergio Lopez <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
util/aio-posix.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/util/aio-posix.c b/util/aio-posix.c
index f67f5b34e9..c964627a03 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -105,17 +105,18 @@ static void aio_epoll_update(AioContext *ctx, AioHandler
*node, bool is_new)
}
}
-static int aio_epoll(AioContext *ctx, GPollFD *pfds,
- unsigned npfd, int64_t timeout)
+static int aio_epoll(AioContext *ctx, int64_t timeout)
{
+ GPollFD pfd = {
+ .fd = ctx->epollfd,
+ .events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR,
+ };
AioHandler *node;
int i, ret = 0;
struct epoll_event events[128];
- assert(npfd == 1);
- assert(pfds[0].fd == ctx->epollfd);
if (timeout > 0) {
- ret = qemu_poll_ns(pfds, npfd, timeout);
+ ret = qemu_poll_ns(&pfd, 1, timeout);
}
if (timeout <= 0 || ret > 0) {
ret = epoll_wait(ctx->epollfd, events,
@@ -669,13 +670,8 @@ bool aio_poll(AioContext *ctx, bool blocking)
/* wait until next event */
if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) {
- AioHandler epoll_handler;
-
- epoll_handler.pfd.fd = ctx->epollfd;
- epoll_handler.pfd.events = G_IO_IN | G_IO_OUT | G_IO_HUP |
G_IO_ERR;
- npfd = 0;
- add_pollfd(&epoll_handler);
- ret = aio_epoll(ctx, pollfds, npfd, timeout);
+ npfd = 0; /* pollfds[] is not being used */
+ ret = aio_epoll(ctx, timeout);
} else {
ret = qemu_poll_ns(pollfds, npfd, timeout);
}
--
2.24.1
- [PULL 00/31] Block patches, Stefan Hajnoczi, 2020/02/22
- [PULL 02/31] aio-posix: avoid reacquiring rcu_read_lock() when polling, Stefan Hajnoczi, 2020/02/22
- [PULL 01/31] virtio: increase virtqueue size for virtio-scsi and virtio-blk, Stefan Hajnoczi, 2020/02/22
- [PULL 03/31] rcu_queue: add QSLIST functions, Stefan Hajnoczi, 2020/02/22
- [PULL 04/31] util/async: make bh_aio_poll() O(1), Stefan Hajnoczi, 2020/02/22
- [PULL 05/31] aio-posix: fix use after leaving scope in aio_poll(),
Stefan Hajnoczi <=
- [PULL 06/31] aio-posix: don't pass ns timeout to epoll_wait(), Stefan Hajnoczi, 2020/02/22
- [PULL 07/31] qemu/queue.h: add QLIST_SAFE_REMOVE(), Stefan Hajnoczi, 2020/02/22
- [PULL 08/31] aio-posix: make AioHandler deletion O(1), Stefan Hajnoczi, 2020/02/22
- [PULL 09/31] aio-posix: make AioHandler dispatch O(1) with epoll, Stefan Hajnoczi, 2020/02/22
- [PULL 10/31] softmmu: move vl.c to softmmu/, Stefan Hajnoczi, 2020/02/22
- [PULL 11/31] softmmu: split off vl.c:main() into main.c, Stefan Hajnoczi, 2020/02/22
- [PULL 12/31] module: check module wasn't already initialized, Stefan Hajnoczi, 2020/02/22
- [PULL 13/31] fuzz: add FUZZ_TARGET module type, Stefan Hajnoczi, 2020/02/22
- [PULL 14/31] qtest: add qtest_server_send abstraction, Stefan Hajnoczi, 2020/02/22
- [PULL 15/31] libqtest: add a layer of abstraction to send/recv, Stefan Hajnoczi, 2020/02/22