qemu/scripts
Eric Blake 9b4e38fe6a qapi: Fix crash on missing alternate member of QAPI struct
If a QAPI struct has a mandatory alternate member which is not
present on input, the input visitor reports an error for the
missing alternate without setting the discriminator, but the
cleanup code for the struct still tries to use the dealloc
visitor to clean up the alternate.

Commit dbf11922 changed visit_start_alternate to set *obj to NULL
when an error occurs, where it was previously left untouched.
Thus, before the patch, the dealloc visitor is blindly trying to
cleanup whatever branch corresponds to (*obj)->type == 0 (that is,
QTYPE_NONE, because *obj still pointed to zeroed memory), which
selects the default branch of the switch and sets an error, but
this second error is ignored by the way the dealloc visitor is
used; but after the patch, the attempt to switch dereferences NULL.

When cleaning up after a partial object parse, we specifically
check for !*obj after visit_start_struct() (see gen_visit_object());
doing the same for alternates fixes the crash. Enhance the testsuite
to give coverage for both missing struct and missing alternate
members.

Also add an abort - we expect visit_start_alternate() to either set an
error or to set (*obj)->type to a valid QType that corresponds to
actual user input, and QTYPE_NONE should never be reachable from valid
input.  Had the abort() been in place earlier, we might have noticed
the dealloc visitor dereferencing bogus zeroed memory prior to when
commit dbf11922 forced our hand by setting *obj to NULL and causing a
fault.

Test case:

{'execute':'blockdev-add', 'arguments':{'options':{'driver':'raw'}}}

The choice of 'driver':'raw' selects a BlockdevOptionsGenericFormat
struct, which has a mandatory 'file':'BlockdevRef' in QAPI.  Since
'file' is missing as a sibling of 'driver', this should report a
graceful error rather than fault.  After this patch, we are back to:

{"error": {"class": "GenericError", "desc": "Parameter 'file' is missing"}}

Generated code in qapi-visit.c changes as:

|@@ -2444,6 +2444,9 @@ void visit_type_BlockdevRef(Visitor *v,
|     if (err) {
|         goto out;
|     }
|+    if (!*obj) {
|+        goto out_obj;
|+    }
|     switch ((*obj)->type) {
|     case QTYPE_QDICT:
|         visit_start_struct(v, name, NULL, 0, &err);
|@@ -2459,10 +2462,13 @@ void visit_type_BlockdevRef(Visitor *v,
|     case QTYPE_QSTRING:
|         visit_type_str(v, name, &(*obj)->u.reference, &err);
|         break;
|+    case QTYPE_NONE:
|+        abort();
|     default:
|         error_setg(&err, QERR_INVALID_PARAMETER_TYPE, name ? name : "null",
|                    "BlockdevRef");
|     }
|+out_obj:
|     visit_end_alternate(v);

Reported by Kashyap Chamarthy <kchamart@redhat.com>
CC: qemu-stable@nongnu.org
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1466012271-5204-1-git-send-email-eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
[Commit message tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-06-30 15:24:36 +02:00
..
coccinelle coccinelle: Remove unnecessary variables for function return value 2016-06-20 16:38:13 +02:00
kvm kvm_stat: Remove 2016-05-29 09:11:10 +02:00
qemu-guest-agent qemu-ga: sample fsfreeze hooks 2013-01-08 16:38:12 -06:00
qemugdb scripts/gdb: Fix a python exception in mtree.py 2015-12-22 16:01:08 +08:00
qmp qmp-shell: fix pretty printing of JSON responses 2016-03-04 17:16:32 +01:00
tracetool qemu-common: push cpu.h inclusion out of qemu-common.h 2016-05-19 16:42:29 +02:00
analyse-9p-simpletrace.py scripts/analyse-9p-simpletrace.py: Add symbolic names for 9p operations. 2011-12-21 12:37:23 +05:30
analyze-inclusions scripts: add script to build QEMU and analyze inclusions 2016-05-19 12:09:28 +02:00
analyze-migration.py migration: fix analyze-migration.py script 2015-11-04 13:40:13 +01:00
check-qerror.sh qerror: add check-qerror.sh to verify alphabetical order 2012-01-18 10:23:39 -02:00
checkpatch.pl checkpatch: There is no qemu_strtod() 2016-06-30 15:24:36 +02:00
clean-includes os-posix: include sys/mman.h 2016-06-16 18:39:03 +02:00
cleanup-trace-events.pl cleanup-trace-events.pl: Tighten search for trace event call 2014-09-26 09:34:38 +01:00
cocci-macro-file.h coccinelle: add g_assert_cmp* to macro file 2016-05-23 16:53:46 +02:00
coverity-model.c coverity: Model g_memdup() 2015-12-17 17:33:49 +01:00
create_config * max-ram-below-4g improvement (Gerd) 2016-06-08 14:45:28 +01:00
disas-objdump.pl disas-objdump: Pass --adjust-vma to objdump 2013-08-24 07:26:45 +02:00
dump-guest-memory.py exec: hide mr->ram_addr from qemu_get_ram_ptr users 2016-05-29 09:11:12 +02:00
extract-vsssdk-headers Add a script to extract VSS SDK headers on POSIX system 2013-09-09 14:17:56 -05:00
feature_to_c.sh scripts: Use $(..) instead of deprecated `..` 2016-06-07 18:19:23 +03:00
get_maintainer.pl get_maintainer.pl: fall back to git if only lists are found 2016-02-09 17:07:55 +01:00
gtester-cat test makefile overhaul 2012-03-30 08:14:11 -05:00
hxtool vl.c: In qemu -h output, only print options for the arch we are running as 2011-12-19 10:27:33 -06:00
make-release make-release: Record SeaBIOS version 2014-03-31 15:02:04 +01:00
make_device_config.sh scripts: Use $(..) instead of deprecated `..` 2016-06-07 18:19:23 +03:00
ordereddict.py qapi: Clean up qapi.py per pep8 2015-10-12 18:44:54 +02:00
qapi-commands.py qapi: Split visit_end_struct() into pieces 2016-05-12 09:47:55 +02:00
qapi-event.py qapi: Split visit_end_struct() into pieces 2016-05-12 09:47:55 +02:00
qapi-introspect.py qapi: Clean up includes in generated files 2016-02-16 14:29:27 +00:00
qapi-types.py Clean up includes some more 2016-03-22 22:20:16 +01:00
qapi-visit.py qapi: Fix crash on missing alternate member of QAPI struct 2016-06-30 15:24:36 +02:00
qapi.py qapi: Use anonymous bases in QMP flat unions 2016-03-18 10:29:26 +01:00
qemu-binfmt-conf.sh scripts: Use $(..) instead of deprecated `..` 2016-06-07 18:19:23 +03:00
qemu-gdb.py gdb command: qemu handlers 2015-10-29 17:59:27 +00:00
qtest.py qtest: Add scripts/qtest.py 2015-02-16 15:07:18 +00:00
refresh-pxe-roms.sh roms: rewrite scripts/refresh-pxe-roms.sh 2013-09-30 09:44:35 +02:00
shaderinclude.pl opengl: add shader build infrastructure 2015-05-05 09:03:32 +02:00
signrom.py scripts/signrom.py: Check for magic in option ROMs. 2016-05-23 16:53:45 +02:00
simpletrace.py simpletrace: add simpletrace.py --no-header option 2014-08-12 14:26:11 +01:00
switch-timer-api misc: Fix case Qemu -> QEMU 2014-02-15 16:10:25 +04:00
texi2pod.pl scripts/text2pod.pl: Escape left brace 2015-11-02 14:50:27 +01:00
tracetool.py Revert "tracetool: use Python 2.4-compatible exception handling syntax" 2016-02-08 17:29:54 +01:00
update-linux-headers.sh scripts: Use $(..) instead of deprecated `..` 2016-06-07 18:19:23 +03:00
vmstate-static-checker.py vmstate-static-checker: fix size mismatch detection in unused fields 2016-06-17 18:24:33 +05:30