f61ffad53f
Coverity warns that we store the address of a stack variable through a pointer passed in by the caller, which would let the caller trivially trigger use-after-free if that stored value is still present when we finish execution. However, the way coroutines work is that after our call to qemu_coroutine_yield(), control is temporarily continued in the caller prior to our function concluding, and in order to resume our coroutine, the caller must poll until the variable has been set to NULL. Thus, we can add an assert that we do not leak stack storage to the caller on function exit. Fixes: Coverity CID 1406474 CC: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191111203524.21912-1-eblake@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
80 lines
2.2 KiB
C
80 lines
2.2 KiB
C
/*
|
|
* QEMU coroutine sleep
|
|
*
|
|
* Copyright IBM, Corp. 2011
|
|
*
|
|
* Authors:
|
|
* Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU LGPL, version 2 or later.
|
|
* See the COPYING.LIB file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/coroutine.h"
|
|
#include "qemu/coroutine_int.h"
|
|
#include "qemu/timer.h"
|
|
#include "block/aio.h"
|
|
|
|
static const char *qemu_co_sleep_ns__scheduled = "qemu_co_sleep_ns";
|
|
|
|
struct QemuCoSleepState {
|
|
Coroutine *co;
|
|
QEMUTimer *ts;
|
|
QemuCoSleepState **user_state_pointer;
|
|
};
|
|
|
|
void qemu_co_sleep_wake(QemuCoSleepState *sleep_state)
|
|
{
|
|
/* Write of schedule protected by barrier write in aio_co_schedule */
|
|
const char *scheduled = atomic_cmpxchg(&sleep_state->co->scheduled,
|
|
qemu_co_sleep_ns__scheduled, NULL);
|
|
|
|
assert(scheduled == qemu_co_sleep_ns__scheduled);
|
|
if (sleep_state->user_state_pointer) {
|
|
*sleep_state->user_state_pointer = NULL;
|
|
}
|
|
timer_del(sleep_state->ts);
|
|
aio_co_wake(sleep_state->co);
|
|
}
|
|
|
|
static void co_sleep_cb(void *opaque)
|
|
{
|
|
qemu_co_sleep_wake(opaque);
|
|
}
|
|
|
|
void coroutine_fn qemu_co_sleep_ns_wakeable(QEMUClockType type, int64_t ns,
|
|
QemuCoSleepState **sleep_state)
|
|
{
|
|
AioContext *ctx = qemu_get_current_aio_context();
|
|
QemuCoSleepState state = {
|
|
.co = qemu_coroutine_self(),
|
|
.ts = aio_timer_new(ctx, type, SCALE_NS, co_sleep_cb, &state),
|
|
.user_state_pointer = sleep_state,
|
|
};
|
|
|
|
const char *scheduled = atomic_cmpxchg(&state.co->scheduled, NULL,
|
|
qemu_co_sleep_ns__scheduled);
|
|
if (scheduled) {
|
|
fprintf(stderr,
|
|
"%s: Co-routine was already scheduled in '%s'\n",
|
|
__func__, scheduled);
|
|
abort();
|
|
}
|
|
|
|
if (sleep_state) {
|
|
*sleep_state = &state;
|
|
}
|
|
timer_mod(state.ts, qemu_clock_get_ns(type) + ns);
|
|
qemu_coroutine_yield();
|
|
if (sleep_state) {
|
|
/*
|
|
* Note that *sleep_state is cleared during qemu_co_sleep_wake
|
|
* before resuming this coroutine.
|
|
*/
|
|
assert(*sleep_state == NULL);
|
|
}
|
|
timer_free(state.ts);
|
|
}
|