mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9e06080bed
qemu/hw
History
Greg Kurz 9e06080bed vhost-user: Fix double-close on slave_read() error path 
Some message types, e.g. VHOST_USER_SLAVE_VRING_HOST_NOTIFIER_MSG,
can convey file descriptors. These must be closed before returning
from slave_read() to avoid being leaked. This can currently be done
in two different places:

[1] just after the request has been processed

[2] on the error path, under the goto label err:

These path are supposed to be mutually exclusive but they are not
actually. If the VHOST_USER_NEED_REPLY_MASK flag was passed and the
sending of the reply fails, both [1] and [2] are performed with the
same descriptor values. This can potentially cause subtle bugs if one
of the descriptor was recycled by some other thread in the meantime.

This code duplication complicates rollback for no real good benefit.
Do the closing in a unique place, under a new fdcleanup: goto label
at the end of the function.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <20210312092212.782255-3-groug@kaod.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-22 10:17:53 -04:00
..
9pfs hw/9pfs/9p-synth: Replaced qemu_mutex_lock with QEMU_LOCK_GUARD 2021-03-16 11:41:49 +01:00
acpi acpi/core: always set SCI_EN when SMM isn't supported 2021-02-23 10:58:42 -05:00
adc clock: Add ClockEvent parameter to callbacks 2021-03-08 17:20:01 +00:00
alpha vl: extract softmmu/datadir.c 2020-12-10 12:15:18 -05:00
arm hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
audio hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
avr hw/avr/arduino: List board schematic links 2021-03-15 00:39:52 +01:00
block hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
char hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
core Remove many old deprecated features 2021-03-18 19:00:50 +00:00
cpu
cris hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
display hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
dma target-arm queue: 2021-03-10 13:57:31 +00:00
gpio hw: gpio: implement gpio-pwr driver for qemu reset/poweroff 2021-01-29 10:47:28 +00:00
hppa hw: Use the PCI_SLOT() macro from 'hw/pci/pci.h' 2021-01-04 23:24:44 +01:00
hyperv qdev: Move softmmu properties to qdev-properties-system.h 2020-12-18 15:20:17 -05:00
i2c hw/i2c/npcm7xx_smbus: Simplify npcm7xx_smbus_init() 2021-03-05 15:17:34 +00:00
i386 hw/scsi: remove 'scsi-disk' device 2021-03-18 09:22:55 +00:00
ide hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
input Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
intc * fixes for i386 TCG paging 2021-03-19 18:01:17 +00:00
ipack
ipmi Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
isa hw/southbridge: Add missing Kconfig dependency VT82C686 on USB_UHCI 2021-03-15 17:00:59 +01:00
lm32 hw/lm32/Kconfig: Have MILKYMIST select LM32_DEVICES 2021-03-09 22:37:08 +01:00
m68k m68k: add Virtual M68k Machine 2021-03-15 21:03:06 +01:00
mem memory: add a sparse memory device for fuzzing 2021-03-16 14:30:30 -04:00
microblaze hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
mips hw/mips/gt64xxx: Trace accesses to ISD registers 2021-03-13 20:29:36 +01:00
misc hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
moxie moxie: do not use ram_size global 2020-12-10 12:15:08 -05:00
net net: Move NetClientState.info_str to dynamic allocations 2021-03-15 16:41:22 +08:00
nios2 * New -action option and set-action QMP command (Alejandro) 2020-12-15 21:24:31 +00:00
nubus
nvram sysemu: Let VMChangeStateHandler take boolean 'running' argument 2021-03-09 23:13:57 +01:00
openrisc target/openrisc: Move pic_cpu code into CPU object proper 2020-12-15 12:04:30 +00:00
pci hw/pci: Have safer pcie_bus_realize() by checking error path 2021-03-02 09:16:18 -05:00
pci-bridge Kconfig: Compile PXB for ARM_VIRT 2021-01-17 06:42:54 -05:00
pci-host hw/pci-host: Introduce SH_PCI Kconfig entry 2021-03-06 16:18:42 +01:00
pcmcia
ppc hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
rdma pvrdma: wean code off pvrdma_ring.h kernel header 2021-03-15 16:41:22 +08:00
remote multi-process: perform device reset in the remote process 2021-02-10 09:23:28 +00:00
riscv Testing, guest-loader and other misc tweaks 2021-03-11 16:20:58 +00:00
rtc goldfish_rtc: re-arm the alarm after migration 2021-03-04 09:43:29 -05:00
rx qtest: delete superfluous inclusions of qtest.h 2021-03-09 06:03:53 +01:00
s390x s390x/pci: Add missing initialization for g_autofree variables 2021-03-15 15:47:18 +01:00
scsi hw/scsi: remove 'scsi-disk' device 2021-03-18 09:22:55 +00:00
sd Pull request trivial patches 20210220 2021-02-21 12:12:18 +00:00
sh4 hw/sh4/sh7750_regs: Replace link to license by its full content 2021-03-06 16:19:03 +01:00
smbios i386: do not use ram_size global 2020-12-10 12:15:08 -05:00
sparc hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
sparc64 hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
ssi hw/ssi: xilinx_spips: Remove DMA related dead codes from zynqmp_spips 2021-03-10 13:54:51 +00:00
timer hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
tpm tpm: put some tpm devices into the correct category 2021-02-20 12:36:19 +01:00
tricore tricore: added triboard with tc27x_soc 2021-03-14 14:41:55 +01:00
unicore32
usb usb/storage: clear csw on reset 2021-03-15 17:01:17 +01:00
vfio vfio/migrate: Move switch of dirty tracking into vfio_memory_listener 2021-03-16 10:06:44 -06:00
virtio vhost-user: Fix double-close on slave_read() error path 2021-03-22 10:17:53 -04:00
watchdog clock: Add ClockEvent parameter to callbacks 2021-03-08 17:20:01 +00:00
xen pci: add romsize property 2021-02-05 08:52:58 -05:00
xenpv
xtensa vl: make qemu_get_machine_opts static 2020-12-15 12:51:55 -05:00
Kconfig semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00
meson.build semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00