diff options
| author | Li Zhijian <lizhijian@cn.fujitsu.com> | 2021-06-02 10:35:06 +0800 |
|---|---|---|
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2021-06-08 18:55:43 +0100 |
| commit | 6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f (patch) | |
| tree | 6f318226920c48336f35f3972267e8a0ebd44c9b | |
| parent | 7de2e8565335c13fb3516cddbe2e40e366cce273 (diff) | |
| download | qemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.zip qemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.tar.gz qemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.tar.bz2 | |
migration/rdma: Fix cm event use after free
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Message-Id: <20210602023506.3821293-1-lizhijian@cn.fujitsu.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| -rw-r--r-- | migration/rdma.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/migration/rdma.c b/migration/rdma.c index 1cdb456..d90b29a 100644 --- a/migration/rdma.c +++ b/migration/rdma.c @@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma) if (pfds[1].revents) { ret = rdma_get_cm_event(rdma->channel, &cm_event); - if (!ret) { - rdma_ack_cm_event(cm_event); + if (ret) { + error_report("failed to get cm event while wait " + "completion channel"); + return -EPIPE; } error_report("receive cm event while wait comp channel," "cm event is %d", cm_event->event); if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED || cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) { + rdma_ack_cm_event(cm_event); return -EPIPE; } + rdma_ack_cm_event(cm_event); } break; @@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque) error_report("get_cm_event failed %d", errno); return; } - rdma_ack_cm_event(cm_event); if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED || cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) { @@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque) rdma->return_path->error_state = -EPIPE; } } + rdma_ack_cm_event(cm_event); if (mis->migration_incoming_co) { qemu_coroutine_enter(mis->migration_incoming_co); } return; } + rdma_ack_cm_event(cm_event); } static int qemu_rdma_accept(RDMAContext *rdma) |