mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

migration/rdma: Fix cm event use after free

Browse Source 
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Message-Id: <20210602023506.3821293-1-lizhijian@cn.fujitsu.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Li Zhijian 2021-06-02 10:35:06 +08:00 committed by Dr. David Alan Gilbert
parent 7de2e85653
commit 6b8c2eb5c6
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
migration/rdma.c
View File

@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma)
if (pfds[1].revents) { if (pfds[1].revents) {
ret = rdma_get_cm_event(rdma->channel, &cm_event); ret = rdma_get_cm_event(rdma->channel, &cm_event);
if (!ret) { if (ret) {
rdma_ack_cm_event(cm_event); error_report("failed to get cm event while wait "
"completion channel");
return -EPIPE;
} }
error_report("receive cm event while wait comp channel," error_report("receive cm event while wait comp channel,"
"cm event is %d", cm_event->event); "cm event is %d", cm_event->event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED || if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) { cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
rdma_ack_cm_event(cm_event);
return -EPIPE; return -EPIPE;
} }
rdma_ack_cm_event(cm_event);
} }
break; break;
@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
error_report("get_cm_event failed %d", errno); error_report("get_cm_event failed %d", errno);
return; return;
} }
rdma_ack_cm_event(cm_event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED || if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) { cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
rdma->return_path->error_state = -EPIPE; rdma->return_path->error_state = -EPIPE;
} }
} }
rdma_ack_cm_event(cm_event);
if (mis->migration_incoming_co) { if (mis->migration_incoming_co) {
qemu_coroutine_enter(mis->migration_incoming_co); qemu_coroutine_enter(mis->migration_incoming_co);
} }
return; return;
} }
rdma_ack_cm_event(cm_event);
} }
static int qemu_rdma_accept(RDMAContext *rdma) static int qemu_rdma_accept(RDMAContext *rdma)