From patchwork Wed Apr 27 14:29:07 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Markus Armbruster X-Patchwork-Id: 8958161 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id E934C9F66C for ; Wed, 27 Apr 2016 14:29:41 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 54DE62022A for ; Wed, 27 Apr 2016 14:29:41 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 65FEB2024D for ; Wed, 27 Apr 2016 14:29:40 +0000 (UTC) Received: from localhost ([::1]:43564 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1avQTD-0002jF-MD for patchwork-qemu-devel@patchwork.kernel.org; Wed, 27 Apr 2016 10:29:39 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36819) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1avQSp-0002Ub-Rb for qemu-devel@nongnu.org; Wed, 27 Apr 2016 10:29:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1avQSm-0004to-06 for qemu-devel@nongnu.org; Wed, 27 Apr 2016 10:29:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42325) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1avQSl-0004tZ-Qa for qemu-devel@nongnu.org; Wed, 27 Apr 2016 10:29:11 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7302947052 for ; Wed, 27 Apr 2016 14:29:11 +0000 (UTC) Received: from blackfin.pond.sub.org (ovpn-116-23.ams2.redhat.com [10.36.116.23]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u3RET9bp032584 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 27 Apr 2016 10:29:11 -0400 Received: by blackfin.pond.sub.org (Postfix, from userid 1000) id 611231132D8B; Wed, 27 Apr 2016 16:29:09 +0200 (CEST) From: Markus Armbruster To: qemu-devel@nongnu.org Date: Wed, 27 Apr 2016 16:29:07 +0200 Message-Id: <1461767349-15329-2-git-send-email-armbru@redhat.com> In-Reply-To: <1461767349-15329-1-git-send-email-armbru@redhat.com> References: <1461767349-15329-1-git-send-email-armbru@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH for-2.6 1/3] QemuOpts: Fix qemu_opts_foreach() dangling location regression X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP qemu_opts_foreach() pushes and pops a Location with automatic storage duration. Except it fails to pop when @func() returns non-zero. cur_loc then points to unused stack space, and will most likely get clobbered in short order. Clobbered cur_loc can make loc_pop() and error_print_loc() crash or report bogus locations. Affects several qemu command line options as well as qemu-img, qemu-io, qemu-nbd -object, and blkdebug's configuration file. Broken in commit a4c7367, v2.4.0. Reproducer: $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar main() reports "Property '.foo' not found" like this: if (qemu_opts_foreach(qemu_find_opts("object"), user_creatable_add_opts_foreach, object_create_delayed, &err)) { error_report_err(err); exit(1); } cur_loc then points to where qemu_opts_foreach()'s Location used to be, i.e. unused stack space. With optimization, this Location doesn't get clobbered for me, and also happens to be the correct location. Without optimization, it does get clobbered in a way that makes error_report_err() report no location. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake --- util/qemu-option.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/util/qemu-option.c b/util/qemu-option.c index dd9e73d..3467dc2 100644 --- a/util/qemu-option.c +++ b/util/qemu-option.c @@ -1108,19 +1108,19 @@ int qemu_opts_foreach(QemuOptsList *list, qemu_opts_loopfunc func, { Location loc; QemuOpts *opts; - int rc; + int rc = 0; loc_push_none(&loc); QTAILQ_FOREACH(opts, &list->head, next) { loc_restore(&opts->loc); rc = func(opaque, opts, errp); if (rc) { - return rc; + break; } assert(!errp || !*errp); } loc_pop(&loc); - return 0; + return rc; } static size_t count_opts_list(QemuOptsList *list)