[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL v4 01/47] qom: assert integer does not overflow
From: |
Michael S. Tsirkin |
Subject: |
[PULL v4 01/47] qom: assert integer does not overflow |
Date: |
Mon, 7 Mar 2022 17:44:27 -0500 |
QOM reference counting is not designed with an infinite amount of
references in mind, trying to take a reference in a loop without
dropping a reference will overflow the integer.
It is generally a symptom of a reference leak (a missing deref, commonly
as part of error handling - such as one fixed here:
https://lore.kernel.org/r/20220228095058.27899-1-sgarzare%40redhat.com ).
All this can lead to either freeing the object too early (memory
corruption) or never freeing it (memory leak).
If we happen to dereference at just the right time (when it's wrapping
around to 0), we might eventually assert when dereferencing, but the
real problem is an extra object_ref so let's assert there to make such
issues cleaner and easier to debug.
Some micro-benchmarking shows using fetch and add this is essentially
free on x86.
Since multiple threads could be incrementing in parallel, we assert
around INT_MAX to make sure none of these approach the wrap around
point: this way we get a memory leak and not a memory corruption, the
former is generally easier to debug.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
qom/object.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/qom/object.c b/qom/object.c
index 9f7a33139d..a27532a6ba 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1167,10 +1167,14 @@ GSList *object_class_get_list_sorted(const char
*implements_type,
Object *object_ref(void *objptr)
{
Object *obj = OBJECT(objptr);
+ uint32_t ref;
+
if (!obj) {
return NULL;
}
- qatomic_inc(&obj->ref);
+ ref = qatomic_fetch_inc(&obj->ref);
+ /* Assert waaay before the integer overflows */
+ g_assert(ref < INT_MAX);
return obj;
}
--
MST
- [PULL v4 00/47] virtio,pc,pci: features, cleanups, fixes, Michael S. Tsirkin, 2022/03/07
- [PULL v4 01/47] qom: assert integer does not overflow,
Michael S. Tsirkin <=
- [PULL v4 02/47] ACPI ERST: specification for ERST support, Michael S. Tsirkin, 2022/03/07
- [PULL v4 03/47] MAINTAINERS: no need to add my name explicitly as a reviewer for VIOT tables, Michael S. Tsirkin, 2022/03/07
- [PULL v4 04/47] docs/acpi/erst: add device id for ACPI ERST device in pci-ids.txt, Michael S. Tsirkin, 2022/03/07
- [PULL v4 05/47] hw/acpi/erst: clean up unused IS_UEFI_CPER_RECORD macro, Michael S. Tsirkin, 2022/03/07
- [PULL v4 06/47] hw/smbios: code cleanup - use macro definitions for table header handles, Michael S. Tsirkin, 2022/03/07
- [PULL v4 07/47] hw/smbios: fix overlapping table handle numbers with large memory vms, Michael S. Tsirkin, 2022/03/07
- [PULL v4 08/47] hw/smbios: add assertion to ensure handles of tables 19 and 32 do not collide, Michael S. Tsirkin, 2022/03/07
- [PULL v4 09/47] vhost-user: remove VirtQ notifier restore, Michael S. Tsirkin, 2022/03/07
- [PULL v4 10/47] vhost-user: fix VirtQ notifier cleanup, Michael S. Tsirkin, 2022/03/07
- [PULL v4 11/47] virtio: fix the condition for iommu_platform not supported, Michael S. Tsirkin, 2022/03/07