From patchwork Tue Aug 9 16:43:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bin Meng X-Patchwork-Id: 12939772 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 99F31C25B0C for ; Tue, 9 Aug 2022 16:44:25 +0000 (UTC) Received: from localhost ([::1]:58190 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oLSLA-0000Ye-Kw for qemu-devel@archiver.kernel.org; Tue, 09 Aug 2022 12:44:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42354) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oLSK8-0007S4-Fh for qemu-devel@nongnu.org; Tue, 09 Aug 2022 12:43:20 -0400 Received: from mail-pj1-x1033.google.com ([2607:f8b0:4864:20::1033]:38826) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oLSK5-0006bQ-OZ for qemu-devel@nongnu.org; Tue, 09 Aug 2022 12:43:19 -0400 Received: by mail-pj1-x1033.google.com with SMTP id q9-20020a17090a2dc900b001f58bcaca95so11410832pjm.3 for ; Tue, 09 Aug 2022 09:43:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc; bh=2QLlX9RX/cSrGJAJe1RXGf+VhriXF6uPxDi06LasPNc=; b=hjt3Wd7osu+dQ2APVgmIjm+Hqeu8E8gesI9FHhs+y5S3Wp3QmUwuusv2xXJMuM5HlL 1i27cpbP2X2VlsnWTG8w4qeOGxLok6dJ3SRxq8L4qZlPy8gSdcgbo/sVCJGjML2VOGmV xDaVBKbD6fLtMgVQlFbthjvi09F/SFhVG5x8i+gJqiIxMW6cIgkLjNxJo4iduB9XS/W9 faRupbinOy8Abi2RCcqh5HSIViW4Uhv2u8Qc9n/gvcNO48l9rm3j/1F8VuUOaTV2IIkp AJhMUdkREkiRE16Ai90Hr+LlVcJ+F/jV9YzlCPbE5gALKjoyTZqkEjWqSth+txJRWqsW XGXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc; bh=2QLlX9RX/cSrGJAJe1RXGf+VhriXF6uPxDi06LasPNc=; b=vLKIyvqb4K8MWvktbL+2urTH7rOY9Vyct+uTRxE9dCORCZvmoD+62Yfl+Ea03EX66/ h+1AowVUMbBVWDJ1WBxCgosHiJ0CDSguFDQ+xgTQin5JOfbOrfV0Tn+YHBRFEyoJ30gO I4d2t3q8vD4G1lWOPLkr7WVp5IJTEbRJ4jAQKoFvP+i1Gk30dzxe3fsvNIc+k46vMxCo Z9/iw4nSxAFoxieVxudWvUpCKRjn67uHBSpW3d7uHI24d7MS5lPGVefclGl7RDdi3ONv MtOEbqOz47zGyaX01+fzPDj4nZ71P5edwTI2QhqKN+265bR4nJYepUU6UAeFrFILYNa+ k7Qw== X-Gm-Message-State: ACgBeo0ApX8bSiF7v1c/Ht0+D1iq3I69E75kFaEFbE56ntzH40t5oaLt 9N12OK7ogRjGNFJr2DKwEROkYv/GN8w= X-Google-Smtp-Source: AA6agR5jg/JLsAHZB28joyn8YKm0+8aRErWKVehCu/XCGei27P58KpGeMVHq4wlrbknrXjzX6ATkdg== X-Received: by 2002:a17:903:1c8:b0:171:2ed3:6780 with SMTP id e8-20020a17090301c800b001712ed36780mr1059531plh.30.1660063392887; Tue, 09 Aug 2022 09:43:12 -0700 (PDT) Received: from ubuntu.. (144.168.56.201.16clouds.com. [144.168.56.201]) by smtp.gmail.com with ESMTPSA id cp17-20020a17090afb9100b001f207d1860fsm10224143pjb.45.2022.08.09.09.43.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Aug 2022 09:43:12 -0700 (PDT) From: Bin Meng To: qemu-devel@nongnu.org, =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Cc: Bin Meng , Paolo Bonzini Subject: [PATCH v2 1/2] util/main-loop: Fix maximum number of wait objects for win32 Date: Wed, 10 Aug 2022 00:43:07 +0800 Message-Id: <20220809164308.1182645-1-bmeng.cn@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::1033; envelope-from=bmeng.cn@gmail.com; helo=mail-pj1-x1033.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" From: Bin Meng The maximum number of wait objects for win32 should be MAXIMUM_WAIT_OBJECTS, not MAXIMUM_WAIT_OBJECTS + 1. Fix the logic in qemu_add_wait_object() to avoid adding the same HANDLE twice. Signed-off-by: Bin Meng --- Changes in v2: - fix the logic in qemu_add_wait_object() to avoid adding the same HANDLE twice util/main-loop.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) diff --git a/util/main-loop.c b/util/main-loop.c index f00a25451b..66b2ae2800 100644 --- a/util/main-loop.c +++ b/util/main-loop.c @@ -363,37 +363,56 @@ void qemu_del_polling_cb(PollingFunc *func, void *opaque) /* Wait objects support */ typedef struct WaitObjects { int num; - int revents[MAXIMUM_WAIT_OBJECTS + 1]; - HANDLE events[MAXIMUM_WAIT_OBJECTS + 1]; - WaitObjectFunc *func[MAXIMUM_WAIT_OBJECTS + 1]; - void *opaque[MAXIMUM_WAIT_OBJECTS + 1]; + int revents[MAXIMUM_WAIT_OBJECTS]; + HANDLE events[MAXIMUM_WAIT_OBJECTS]; + WaitObjectFunc *func[MAXIMUM_WAIT_OBJECTS]; + void *opaque[MAXIMUM_WAIT_OBJECTS]; } WaitObjects; static WaitObjects wait_objects = {0}; int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque) { + int i; + bool found = false; WaitObjects *w = &wait_objects; + if (w->num >= MAXIMUM_WAIT_OBJECTS) { return -1; } - w->events[w->num] = handle; - w->func[w->num] = func; - w->opaque[w->num] = opaque; - w->revents[w->num] = 0; - w->num++; + + for (i = 0; i < w->num; i++) { + /* if the same handle is added twice, newer overwrites older */ + if (w->events[i] == handle) { + found = true; + break; + } + } + + w->events[i] = handle; + w->func[i] = func; + w->opaque[i] = opaque; + w->revents[i] = 0; + + if (!found) { + w->num++; + } + return 0; } void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque) { - int i, found; + int i; + bool found = false; WaitObjects *w = &wait_objects; - found = 0; for (i = 0; i < w->num; i++) { if (w->events[i] == handle) { - found = 1; + found = true; + } + if (i == MAXIMUM_WAIT_OBJECTS - 1) { + break; } if (found) { w->events[i] = w->events[i + 1]; From patchwork Tue Aug 9 16:43:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Bin Meng X-Patchwork-Id: 12939774 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ACA16C19F2D for ; Tue, 9 Aug 2022 16:48:18 +0000 (UTC) Received: from localhost ([::1]:34736 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oLSOv-0003vf-Lv for qemu-devel@archiver.kernel.org; Tue, 09 Aug 2022 12:48:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42376) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oLSK9-0007SR-LX; Tue, 09 Aug 2022 12:43:21 -0400 Received: from mail-pj1-x1031.google.com ([2607:f8b0:4864:20::1031]:53170) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oLSK7-0006bd-Ci; Tue, 09 Aug 2022 12:43:21 -0400 Received: by mail-pj1-x1031.google.com with SMTP id ha11so12239361pjb.2; Tue, 09 Aug 2022 09:43:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc; bh=qYrAxloXsrXBc5iTwVz/QR/2rEB8uGLW0aVimr2yXFc=; b=PRh9h6Vk5abZXyR6T4tf+XZ7YmiKaOesz0GR24E0YhFnunXu0kTZTgeSN6Wm1SW38d n5nGgL4AFbpqcDb1EoHbpMa4foevJk+k758WdPmSoInFNj1eJuRs+V089+aeApe6v+SO t2czGbqmCF0Zt+MPTi3Sgcpk/AJs/3t+EbkrGyH/OjZZ25Yy2mqvMdrt13d/qBkX8V3K WbfTALCWSnqk6OE0CZIQISp2N+G58D0Y/XN3cIaECUixx+CT6yKy4ht9TQLW1DYlnOdW jUlGi1fcuI8FggjD54vqdJo+5ELciDmI7GGgMDKgxuqXGkPsyasCxLMwRfHfMvEw4wsJ r9aA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=qYrAxloXsrXBc5iTwVz/QR/2rEB8uGLW0aVimr2yXFc=; b=A9haHWw6/5LhN712SkI13xnHbPw3RMzqIeNHT29kEb6VKLHb6vKfJ5PKIpt4RpRtaQ TUpmh9bPx2OsouHeDMxq0kj+CWIe/8pNQ7cWz4HlNxhcvm60bFcE7Y5uehCshOD1JIIo 09MLQlQ8z0EO5+hPQOyQyEY6SIxWZcesdtZSlfr6/8xwAuRpkN1vkEie7qpx8ie/TaTo I9yivkmnTabulNFiwAqqTgrBlmCWFiB309zUBl1go6ochmtpYn83n6TdK+bCWzns20EV j2wASLcyuxd2Ta2nIY0G+NekgAQiPQtjkUZ2X5bNZxP1gsqfQViZFcZzFnox0I96VHLz xrKA== X-Gm-Message-State: ACgBeo3zVIlje/qixY+1bDm76ZGGXehdBiWM5xYNwOwE9bGEc0IUNWMR XnMVi9QBbzIIjGdMvwGIwInIg4+q57Y= X-Google-Smtp-Source: AA6agR4cDFCs49SRVdFUn/nBdK3JRS/SFcp56INgn7zuIhseKIc6roj9sO8ofdLgYEk2XRqVBZTm6g== X-Received: by 2002:a17:902:f60c:b0:16d:1af0:6656 with SMTP id n12-20020a170902f60c00b0016d1af06656mr23808348plg.153.1660063395755; Tue, 09 Aug 2022 09:43:15 -0700 (PDT) Received: from ubuntu.. (144.168.56.201.16clouds.com. [144.168.56.201]) by smtp.gmail.com with ESMTPSA id cp17-20020a17090afb9100b001f207d1860fsm10224143pjb.45.2022.08.09.09.43.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Aug 2022 09:43:15 -0700 (PDT) From: Bin Meng To: qemu-devel@nongnu.org, =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Cc: Bin Meng , Stefan Weil , Fam Zheng , Stefan Hajnoczi , qemu-block@nongnu.org Subject: [PATCH v2 2/2] util/aio-win32: Correct the event array size in aio_poll() Date: Wed, 10 Aug 2022 00:43:08 +0800 Message-Id: <20220809164308.1182645-2-bmeng.cn@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220809164308.1182645-1-bmeng.cn@gmail.com> References: <20220809164308.1182645-1-bmeng.cn@gmail.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::1031; envelope-from=bmeng.cn@gmail.com; helo=mail-pj1-x1031.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" From: Bin Meng WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS object handles. Correct the event array size in aio_poll() and add a assert() to ensure it does not cause out of bound access. Signed-off-by: Bin Meng Reviewed-by: Stefan Weil Reviewed-by: Marc-André Lureau --- Changes in v2: - change 'count' to unsigned util/aio-win32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/util/aio-win32.c b/util/aio-win32.c index 44003d645e..80cfe012ad 100644 --- a/util/aio-win32.c +++ b/util/aio-win32.c @@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx) bool aio_poll(AioContext *ctx, bool blocking) { AioHandler *node; - HANDLE events[MAXIMUM_WAIT_OBJECTS + 1]; + HANDLE events[MAXIMUM_WAIT_OBJECTS]; bool progress, have_select_revents, first; - int count; + unsigned count; int timeout; /* @@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { if (!node->deleted && node->io_notify && aio_node_check(ctx, node->is_external)) { + assert(count < MAXIMUM_WAIT_OBJECTS); events[count++] = event_notifier_get_handle(node->e); } }