OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

qemu-coroutine-sleep: Silence Coverity warning 

Coverity warns that we store the address of a stack variable through a
pointer passed in by the caller, which would let the caller trivially
trigger use-after-free if that stored value is still present when we
finish execution.  However, the way coroutines work is that after our
call to qemu_coroutine_yield(), control is temporarily continued in
the caller prior to our function concluding, and in order to resume
our coroutine, the caller must poll until the variable has been set to
NULL.  Thus, we can add an assert that we do not leak stack storage to
the caller on function exit.

Fixes: Coverity CID 1406474
CC: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20191111203524.21912-1-eblake@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
This commit is contained in:
Eric Blake 2019-11-11 14:35:24 -06:00
parent a4d925f8f0
commit f61ffad53f
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
util/qemu-coroutine-sleep.c
View File

@ -68,5 +68,12 @@ void coroutine_fn qemu_co_sleep_ns_wakeable(QEMUClockType type, int64_t ns,
}
timer_mod(state.ts, qemu_clock_get_ns(type) + ns);
qemu_coroutine_yield();
if (sleep_state) {
/*
* Note that *sleep_state is cleared during qemu_co_sleep_wake
* before resuming this coroutine.
*/
assert(*sleep_state == NULL);
}
timer_free(state.ts);
}