* [PATCH] migration/rdma: Fix cm event use after free
@ 2021-06-02 2:35 Li Zhijian
2021-06-02 15:52 ` Dr. David Alan Gilbert
0 siblings, 1 reply; 3+ messages in thread
From: Li Zhijian @ 2021-06-02 2:35 UTC (permalink / raw)
To: quintela, dgilbert; +Cc: qemu-devel, Li Zhijian
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
---
migration/rdma.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/migration/rdma.c b/migration/rdma.c
index 1cdb4561f32..d90b29a4b51 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma)
if (pfds[1].revents) {
ret = rdma_get_cm_event(rdma->channel, &cm_event);
- if (!ret) {
- rdma_ack_cm_event(cm_event);
+ if (ret) {
+ error_report("failed to get cm event while wait "
+ "completion channel");
+ return -EPIPE;
}
error_report("receive cm event while wait comp channel,"
"cm event is %d", cm_event->event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
+ rdma_ack_cm_event(cm_event);
return -EPIPE;
}
+ rdma_ack_cm_event(cm_event);
}
break;
@@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
error_report("get_cm_event failed %d", errno);
return;
}
- rdma_ack_cm_event(cm_event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
@@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
rdma->return_path->error_state = -EPIPE;
}
}
+ rdma_ack_cm_event(cm_event);
if (mis->migration_incoming_co) {
qemu_coroutine_enter(mis->migration_incoming_co);
}
return;
}
+ rdma_ack_cm_event(cm_event);
}
static int qemu_rdma_accept(RDMAContext *rdma)
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] migration/rdma: Fix cm event use after free
2021-06-02 2:35 [PATCH] migration/rdma: Fix cm event use after free Li Zhijian
@ 2021-06-02 15:52 ` Dr. David Alan Gilbert
2021-06-08 17:55 ` Dr. David Alan Gilbert
0 siblings, 1 reply; 3+ messages in thread
From: Dr. David Alan Gilbert @ 2021-06-02 15:52 UTC (permalink / raw)
To: Li Zhijian; +Cc: qemu-devel, quintela
* Li Zhijian (lizhijian@cn.fujitsu.com) wrote:
> Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Thanks! I don't think I understood that 'ack' actually meant 'free'!
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> ---
> migration/rdma.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/migration/rdma.c b/migration/rdma.c
> index 1cdb4561f32..d90b29a4b51 100644
> --- a/migration/rdma.c
> +++ b/migration/rdma.c
> @@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma)
>
> if (pfds[1].revents) {
> ret = rdma_get_cm_event(rdma->channel, &cm_event);
> - if (!ret) {
> - rdma_ack_cm_event(cm_event);
> + if (ret) {
> + error_report("failed to get cm event while wait "
> + "completion channel");
> + return -EPIPE;
> }
>
> error_report("receive cm event while wait comp channel,"
> "cm event is %d", cm_event->event);
> if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
> cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
> + rdma_ack_cm_event(cm_event);
> return -EPIPE;
> }
> + rdma_ack_cm_event(cm_event);
> }
> break;
>
> @@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
> error_report("get_cm_event failed %d", errno);
> return;
> }
> - rdma_ack_cm_event(cm_event);
>
> if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
> cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
> @@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
> rdma->return_path->error_state = -EPIPE;
> }
> }
> + rdma_ack_cm_event(cm_event);
>
> if (mis->migration_incoming_co) {
> qemu_coroutine_enter(mis->migration_incoming_co);
> }
> return;
> }
> + rdma_ack_cm_event(cm_event);
> }
>
> static int qemu_rdma_accept(RDMAContext *rdma)
> --
> 2.30.2
>
>
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] migration/rdma: Fix cm event use after free
2021-06-02 15:52 ` Dr. David Alan Gilbert
@ 2021-06-08 17:55 ` Dr. David Alan Gilbert
0 siblings, 0 replies; 3+ messages in thread
From: Dr. David Alan Gilbert @ 2021-06-08 17:55 UTC (permalink / raw)
To: Li Zhijian; +Cc: qemu-devel, quintela
* Dr. David Alan Gilbert (dgilbert@redhat.com) wrote:
> * Li Zhijian (lizhijian@cn.fujitsu.com) wrote:
> > Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
>
> Thanks! I don't think I understood that 'ack' actually meant 'free'!
>
> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Queued
>
> > ---
> > migration/rdma.c | 11 ++++++++---
> > 1 file changed, 8 insertions(+), 3 deletions(-)
> >
> > diff --git a/migration/rdma.c b/migration/rdma.c
> > index 1cdb4561f32..d90b29a4b51 100644
> > --- a/migration/rdma.c
> > +++ b/migration/rdma.c
> > @@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma)
> >
> > if (pfds[1].revents) {
> > ret = rdma_get_cm_event(rdma->channel, &cm_event);
> > - if (!ret) {
> > - rdma_ack_cm_event(cm_event);
> > + if (ret) {
> > + error_report("failed to get cm event while wait "
> > + "completion channel");
> > + return -EPIPE;
> > }
> >
> > error_report("receive cm event while wait comp channel,"
> > "cm event is %d", cm_event->event);
> > if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
> > cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
> > + rdma_ack_cm_event(cm_event);
> > return -EPIPE;
> > }
> > + rdma_ack_cm_event(cm_event);
> > }
> > break;
> >
> > @@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
> > error_report("get_cm_event failed %d", errno);
> > return;
> > }
> > - rdma_ack_cm_event(cm_event);
> >
> > if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
> > cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
> > @@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
> > rdma->return_path->error_state = -EPIPE;
> > }
> > }
> > + rdma_ack_cm_event(cm_event);
> >
> > if (mis->migration_incoming_co) {
> > qemu_coroutine_enter(mis->migration_incoming_co);
> > }
> > return;
> > }
> > + rdma_ack_cm_event(cm_event);
> > }
> >
> > static int qemu_rdma_accept(RDMAContext *rdma)
> > --
> > 2.30.2
> >
> >
> >
> --
> Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
>
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-06-08 17:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-02 2:35 [PATCH] migration/rdma: Fix cm event use after free Li Zhijian
2021-06-02 15:52 ` Dr. David Alan Gilbert
2021-06-08 17:55 ` Dr. David Alan Gilbert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).