Skip to content
  • Igor Mammedov's avatar
    1cd3d492
    memory: cleanup side effects of memory_region_init_foo() on failure · 1cd3d492
    Igor Mammedov authored
    
    
    if MemoryRegion intialization fails it's left in semi-initialized state,
    where it's size is not 0 and attached as child to owner object.
    And this leds to crash in following use-case:
        (monitor) object_add memory-backend-file,id=mem1,size=99999G,mem-path=/tmp/foo,discard-data=yes
        memory.c:2083: memory_region_get_ram_ptr: Assertion `mr->ram_block' failed
        Aborted (core dumped)
    it happens due to assumption that memory region is intialized when
       memory_region_size() != 0
    and therefore it's ok to access it in
       file_backend_unparent()
          if (memory_region_size() != 0)
              memory_region_get_ram_ptr()
    
    which happens when object_add fails and unparents failed backend making
    file_backend_unparent() access invalid memory region.
    
    Fix it by making sure that memory_region_init_foo() APIs cleanup externally
    visible side effects on failure (like set size to 0 and unparenting object)
    
    Signed-off-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Message-Id: <1536064777-42312-1-git-send-email-imammedo@redhat.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    1cd3d492
    memory: cleanup side effects of memory_region_init_foo() on failure
    Igor Mammedov authored
    
    
    if MemoryRegion intialization fails it's left in semi-initialized state,
    where it's size is not 0 and attached as child to owner object.
    And this leds to crash in following use-case:
        (monitor) object_add memory-backend-file,id=mem1,size=99999G,mem-path=/tmp/foo,discard-data=yes
        memory.c:2083: memory_region_get_ram_ptr: Assertion `mr->ram_block' failed
        Aborted (core dumped)
    it happens due to assumption that memory region is intialized when
       memory_region_size() != 0
    and therefore it's ok to access it in
       file_backend_unparent()
          if (memory_region_size() != 0)
              memory_region_get_ram_ptr()
    
    which happens when object_add fails and unparents failed backend making
    file_backend_unparent() access invalid memory region.
    
    Fix it by making sure that memory_region_init_foo() APIs cleanup externally
    visible side effects on failure (like set size to 0 and unparenting object)
    
    Signed-off-by: default avatarIgor Mammedov <imammedo@redhat.com>
    Message-Id: <1536064777-42312-1-git-send-email-imammedo@redhat.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Loading