mirror of
https://git.proxmox.com/git/qemu
synced 2025-06-14 12:33:48 +00:00
30fb2ca603
Passing on '0' as ballooning target to indicate retrieval of stats is
bad API. It also makes 'balloon 0' in the monitor cause a segfault.
Have two different functions handle the different functionality instead.
Detailed explanation from Markus's review:
1. do_info_balloon() is an info_async() method. It receives a callback
with argument, to be called exactly once (callback frees the
argument). It passes the callback via qemu_balloon_status() and
indirectly through qemu_balloon_event to virtio_balloon_to_target().
virtio_balloon_to_target() executes its balloon stats half. It
stores the callback in the device state.
If it can't send a stats request, it resets stats and calls the
callback right away.
Else, it sends a stats request. The device model runs the callback
when it receives the answer.
Works.
2. do_balloon() is a cmd_async() method. It receives a callback with
argument, to be called when the command completes. do_balloon()
calls it right before it succeeds. Odd, but should work.
Nevertheless, it passes the callback on via qemu_ballon() and
indirectly through qemu_balloon_event to virtio_balloon_to_target().
a. If the argument is non-zero, virtio_balloon_to_target() executes
its balloon half, which doesn't use the callback in any way.
Odd, but works.
b. If the argument is zero, virtio_balloon_to_target() executes its
balloon stats half, just like in 1. It either calls the callback
right away, or arranges for it to be called later.
Thus, the callback runs twice: use after free and double free.
Test case: start with -S -device virtio-balloon, execute "balloon 0" in
human monitor. Runs the callback first from virtio_balloon_to_target(),
then again from do_balloon().
Reported-by: Mike Cao <bcao@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
32 lines
873 B
C
32 lines
873 B
C
/*
|
|
* Balloon
|
|
*
|
|
* Copyright IBM, Corp. 2008
|
|
*
|
|
* Authors:
|
|
* Anthony Liguori <aliguori@us.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#ifndef _QEMU_BALLOON_H
|
|
#define _QEMU_BALLOON_H
|
|
|
|
#include "monitor.h"
|
|
|
|
typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
|
|
typedef void (QEMUBalloonStatus)(void *opaque, MonitorCompletion cb,
|
|
void *cb_data);
|
|
|
|
void qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
|
|
QEMUBalloonStatus *stat_func, void *opaque);
|
|
|
|
void monitor_print_balloon(Monitor *mon, const QObject *data);
|
|
int do_info_balloon(Monitor *mon, MonitorCompletion cb, void *opaque);
|
|
int do_balloon(Monitor *mon, const QDict *params,
|
|
MonitorCompletion cb, void *opaque);
|
|
|
|
#endif
|