From 8e08bf4ea24c3e6e07fab2c1b5bdcc7b104012c4 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 24 Apr 2020 10:43:29 +0200 Subject: qapi: Assert incomplete object occurs only in dealloc visitor Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Message-Id: <20200424084338.26803-7-armbru@redhat.com> --- scripts/qapi/visit.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'scripts/qapi/visit.py') diff --git a/scripts/qapi/visit.py b/scripts/qapi/visit.py index 23d9194aa4..e3467b770b 100644 --- a/scripts/qapi/visit.py +++ b/scripts/qapi/visit.py @@ -189,6 +189,8 @@ void visit_type_%(c_name)s(Visitor *v, const char *name, %(c_name)s **obj, Error goto out; } if (!*obj) { + /* incomplete */ + assert(visit_is_dealloc(v)); goto out_obj; } switch ((*obj)->type) { @@ -260,6 +262,8 @@ void visit_type_%(c_name)s(Visitor *v, const char *name, %(c_name)s **obj, Error goto out; } if (!*obj) { + /* incomplete */ + assert(visit_is_dealloc(v)); goto out_obj; } visit_type_%(c_name)s_members(v, *obj, &err); -- cgit v1.2.3 From c978bd5226f1ed73456ac468a7ed50af3d24dc84 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 24 Apr 2020 10:43:33 +0200 Subject: qapi: Clean up visitor's recovery from input with invalid type An alternate type's visit_type_FOO() fails when it runs into an invalid ->type. If it's an input visit, we then need to free the the object we got from visit_start_alternate(). We do that with qapi_free_FOO(), which uses the dealloc visitor. Trouble is that object is in a bad state: its ->type is invalid. So the dealloc visitor will run into the same error again, and the error recovery skips deallocating the alternate's (invalid) alternative. Works, because qapi_free_FOO() ignores the error. Avoid it instead: free the messed up object with by g_free(). Signed-off-by: Markus Armbruster Message-Id: <20200424084338.26803-11-armbru@redhat.com> Reviewed-by: Eric Blake --- scripts/qapi/visit.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'scripts/qapi/visit.py') diff --git a/scripts/qapi/visit.py b/scripts/qapi/visit.py index e3467b770b..678109dfb5 100644 --- a/scripts/qapi/visit.py +++ b/scripts/qapi/visit.py @@ -234,6 +234,9 @@ void visit_type_%(c_name)s(Visitor *v, const char *name, %(c_name)s **obj, Error default: error_setg(&err, QERR_INVALID_PARAMETER_TYPE, name ? name : "null", "%(name)s"); + /* Avoid passing invalid *obj to qapi_free_%(c_name)s() */ + g_free(*obj); + *obj = NULL; } out_obj: visit_end_alternate(v, (void **)obj); -- cgit v1.2.3 From 7111a86e1ba23ff8d59886df03d8a1cd6c5aab43 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 24 Apr 2020 10:43:34 +0200 Subject: qapi: Assert non-input visitors see only valid alternate tags An alternate type's visit_type_FOO() fails when it runs into an invalid ->type. This is appropriate with an input visitor: visit_start_alternate() sets ->type according to the input, and bad input can lead to bad ->type. It should never happen with an output, clone or dealloc visitor: if it did, the alternate being output, cloned or deallocated would be messed up beyond repair. Assert that. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Message-Id: <20200424084338.26803-12-armbru@redhat.com> --- scripts/qapi/visit.py | 1 + 1 file changed, 1 insertion(+) (limited to 'scripts/qapi/visit.py') diff --git a/scripts/qapi/visit.py b/scripts/qapi/visit.py index 678109dfb5..d5d7a1031f 100644 --- a/scripts/qapi/visit.py +++ b/scripts/qapi/visit.py @@ -232,6 +232,7 @@ void visit_type_%(c_name)s(Visitor *v, const char *name, %(c_name)s **obj, Error case QTYPE_NONE: abort(); default: + assert(visit_is_input(v)); error_setg(&err, QERR_INVALID_PARAMETER_TYPE, name ? name : "null", "%(name)s"); /* Avoid passing invalid *obj to qapi_free_%(c_name)s() */ -- cgit v1.2.3