Commit cee2dedb authored by Michael Roth's avatar Michael Roth Committed by Luiz Capitulino
Browse files

qapi: add visit_start_union and visit_end_union 



In some cases an input visitor might bail out on filling out a
struct for various reasons, such as missing fields when running
in strict mode. In the case of a QAPI Union type, this may lead
to cases where the .kind field which encodes the union type
is uninitialized. Subsequently, other visitors, such as the
dealloc visitor, may use this .kind value as if it were
initialized, leading to assumptions about the union type which
in this case may lead to segfaults. For example, freeing an
integer value.

However, we can generally rely on the fact that the always-present
.data void * field that we generate for these union types will
always be NULL in cases where .kind is uninitialized (at least,
there shouldn't be a reason where we'd do this purposefully).

So pass this information on to Visitor implementation via these
optional start_union/end_union interfaces so this information
can be used to guard against the situation above. We will make
use of this information in a subsequent patch for the dealloc
visitor.

Cc: qemu-stable@nongnu.org
Reported-by: default avatarFam Zheng <famz@redhat.com>
Suggested-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
Signed-off-by: default avatarMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: default avatarLuiz Capitulino <lcapitulino@redhat.com>
parent 1f9296b5

include/qapi/visitor-impl.h

+2 −0
Original line number Diff line number Diff line
@@ -55,6 +55,8 @@ struct Visitor 
    void (*type_int64)(Visitor *v, int64_t *obj, const char *name, Error **errp);

    /* visit_type_size() falls back to (*type_uint64)() if type_size is unset */

    void (*type_size)(Visitor *v, uint64_t *obj, const char *name, Error **errp);

    bool (*start_union)(Visitor *v, bool data_present, Error **errp);

    void (*end_union)(Visitor *v, bool data_present, Error **errp);

};



void input_type_enum(Visitor *v, int *obj, const char *strings[],

include/qapi/visitor.h

+2 −0
Original line number Diff line number Diff line
@@ -58,5 +58,7 @@ void visit_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp); 
void visit_type_bool(Visitor *v, bool *obj, const char *name, Error **errp);

void visit_type_str(Visitor *v, char **obj, const char *name, Error **errp);

void visit_type_number(Visitor *v, double *obj, const char *name, Error **errp);

bool visit_start_union(Visitor *v, bool data_present, Error **errp);

void visit_end_union(Visitor *v, bool data_present, Error **errp);



#endif

qapi/qapi-visit-core.c

+15 −0
Original line number Diff line number Diff line
@@ -58,6 +58,21 @@ void visit_end_list(Visitor *v, Error **errp) 
    v->end_list(v, errp);

}



bool visit_start_union(Visitor *v, bool data_present, Error **errp)

{

    if (v->start_union) {

        return v->start_union(v, data_present, errp);

    }

    return true;

}



void visit_end_union(Visitor *v, bool data_present, Error **errp)

{

    if (v->end_union) {

        v->end_union(v, data_present, errp);

    }

}



void visit_optional(Visitor *v, bool *present, const char *name,

                    Error **errp)

{

scripts/qapi-visit.py

+6 −0
Original line number Diff line number Diff line
@@ -358,6 +358,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e 
        if (err) {

            goto out_obj;

        }

        if (!visit_start_union(m, !!(*obj)->data, &err) || err) {

            goto out_obj;

        }

        switch ((*obj)->kind) {

''',

                 disc_type = disc_type,
@@ -386,6 +389,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e 
out_obj:

        error_propagate(errp, err);

        err = NULL;

        visit_end_union(m, !!(*obj)->data, &err);

        error_propagate(errp, err);

        err = NULL;

    }

    visit_end_struct(m, &err);

out: