From: "Dr. David Alan Gilbert (git)" <dgilbert@redhat.com>
To: qemu-devel@nongnu.org, aiyutao@huawei.com,
peter.maydell@linaro.org, vgoyal@redhat.com, lersek@redhat.com,
alex.chen@huawei.com, armbru@redhat.com, tu.guoyi@h3c.com
Cc: stefanha@redhat.com, quintela@redhat.com
Subject: [PULL 11/15] virtiofsd: Remove useless code about send_notify_iov
Date: Fri, 18 Dec 2020 10:41:13 +0000 [thread overview]
Message-ID: <20201218104117.199096-12-dgilbert@redhat.com> (raw)
In-Reply-To: <20201218104117.199096-1-dgilbert@redhat.com>
From: Alex Chen <alex.chen@huawei.com>
The 'ch' will be NULL in the following stack:
send_notify_iov()->fuse_send_msg()->virtio_send_msg(), and
this may lead to NULL pointer dereferenced in virtio_send_msg().
But send_notify_iov() was never called, so remove the useless code
about send_notify_iov() to fix this problem.
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-Id: <20201214121615.29967-1-alex.chen@huawei.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
tools/virtiofsd/fuse_lowlevel.c | 98 ---------------------------------
1 file changed, 98 deletions(-)
diff --git a/tools/virtiofsd/fuse_lowlevel.c b/tools/virtiofsd/fuse_lowlevel.c
index d4119e92ab..e94b71110b 100644
--- a/tools/virtiofsd/fuse_lowlevel.c
+++ b/tools/virtiofsd/fuse_lowlevel.c
@@ -2143,104 +2143,6 @@ static void do_destroy(fuse_req_t req, fuse_ino_t nodeid,
send_reply_ok(req, NULL, 0);
}
-static int send_notify_iov(struct fuse_session *se, int notify_code,
- struct iovec *iov, int count)
-{
- struct fuse_out_header out = {
- .error = notify_code,
- };
-
- if (!se->got_init) {
- return -ENOTCONN;
- }
-
- iov[0].iov_base = &out;
- iov[0].iov_len = sizeof(struct fuse_out_header);
-
- return fuse_send_msg(se, NULL, iov, count);
-}
-
-int fuse_lowlevel_notify_poll(struct fuse_pollhandle *ph)
-{
- if (ph != NULL) {
- struct fuse_notify_poll_wakeup_out outarg = {
- .kh = ph->kh,
- };
- struct iovec iov[2];
-
- iov[1].iov_base = &outarg;
- iov[1].iov_len = sizeof(outarg);
-
- return send_notify_iov(ph->se, FUSE_NOTIFY_POLL, iov, 2);
- } else {
- return 0;
- }
-}
-
-int fuse_lowlevel_notify_inval_inode(struct fuse_session *se, fuse_ino_t ino,
- off_t off, off_t len)
-{
- struct fuse_notify_inval_inode_out outarg = {
- .ino = ino,
- .off = off,
- .len = len,
- };
- struct iovec iov[2];
-
- if (!se) {
- return -EINVAL;
- }
-
- iov[1].iov_base = &outarg;
- iov[1].iov_len = sizeof(outarg);
-
- return send_notify_iov(se, FUSE_NOTIFY_INVAL_INODE, iov, 2);
-}
-
-int fuse_lowlevel_notify_inval_entry(struct fuse_session *se, fuse_ino_t parent,
- const char *name, size_t namelen)
-{
- struct fuse_notify_inval_entry_out outarg = {
- .parent = parent,
- .namelen = namelen,
- };
- struct iovec iov[3];
-
- if (!se) {
- return -EINVAL;
- }
-
- iov[1].iov_base = &outarg;
- iov[1].iov_len = sizeof(outarg);
- iov[2].iov_base = (void *)name;
- iov[2].iov_len = namelen + 1;
-
- return send_notify_iov(se, FUSE_NOTIFY_INVAL_ENTRY, iov, 3);
-}
-
-int fuse_lowlevel_notify_delete(struct fuse_session *se, fuse_ino_t parent,
- fuse_ino_t child, const char *name,
- size_t namelen)
-{
- struct fuse_notify_delete_out outarg = {
- .parent = parent,
- .child = child,
- .namelen = namelen,
- };
- struct iovec iov[3];
-
- if (!se) {
- return -EINVAL;
- }
-
- iov[1].iov_base = &outarg;
- iov[1].iov_len = sizeof(outarg);
- iov[2].iov_base = (void *)name;
- iov[2].iov_len = namelen + 1;
-
- return send_notify_iov(se, FUSE_NOTIFY_DELETE, iov, 3);
-}
-
int fuse_lowlevel_notify_store(struct fuse_session *se, fuse_ino_t ino,
off_t offset, struct fuse_bufvec *bufv)
{
--
2.29.2
next prev parent reply other threads:[~2020-12-18 11:06 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-18 10:41 [PULL 00/15] migration queue Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 01/15] monitor:open brace '{' following struct go on the same line Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 02/15] monitor:braces {} are necessary for all arms of this statement Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 03/15] monitor:Don't use '#' flag of printf format ('%#') in format strings Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 04/15] hmp-commands.hx: List abbreviation after command for cont, quit, print Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 05/15] virtiofsd: Use --thread-pool-size=0 to mean no thread pool Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 06/15] virtiofsd: make the debug log timestamp on stderr more human-readable Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 07/15] virtiofsd: Set up posix_lock hash table for root inode Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 08/15] virtiofsd: Disable posix_lock hash table if remote locks are not enabled Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 09/15] virtiofsd: Check file type in lo_flush() Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 10/15] virtiofsd: update FUSE_FORGET comment on "lo_inode.nlookup" Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` Dr. David Alan Gilbert (git) [this message]
2020-12-18 10:41 ` [PULL 12/15] docs/devel/migration: Improve debugging section a bit Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 13/15] savevm: Remove dead code in save_snapshot() Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 14/15] savevm: Delete snapshots just created in case of error Dr. David Alan Gilbert (git)
2020-12-18 10:41 ` [PULL 15/15] migration: Don't allow migration if vm is in POSTMIGRATE Dr. David Alan Gilbert (git)
2020-12-31 19:15 ` [PULL 00/15] migration queue Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201218104117.199096-12-dgilbert@redhat.com \
--to=dgilbert@redhat.com \
--cc=aiyutao@huawei.com \
--cc=alex.chen@huawei.com \
--cc=armbru@redhat.com \
--cc=lersek@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=quintela@redhat.com \
--cc=stefanha@redhat.com \
--cc=tu.guoyi@h3c.com \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).