aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLi Zhijian <lizhijian@cn.fujitsu.com>2021-06-02 10:35:06 +0800
committerDr. David Alan Gilbert <dgilbert@redhat.com>2021-06-08 18:55:43 +0100
commit6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f (patch)
tree6f318226920c48336f35f3972267e8a0ebd44c9b
parent7de2e8565335c13fb3516cddbe2e40e366cce273 (diff)
downloadqemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.zip
qemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.tar.gz
qemu-6b8c2eb5c63db2b6b418256bcfecb51e17d72b0f.tar.bz2
migration/rdma: Fix cm event use after free
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Message-Id: <20210602023506.3821293-1-lizhijian@cn.fujitsu.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-rw-r--r--migration/rdma.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/migration/rdma.c b/migration/rdma.c
index 1cdb456..d90b29a 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -1539,16 +1539,20 @@ static int qemu_rdma_wait_comp_channel(RDMAContext *rdma)
if (pfds[1].revents) {
ret = rdma_get_cm_event(rdma->channel, &cm_event);
- if (!ret) {
- rdma_ack_cm_event(cm_event);
+ if (ret) {
+ error_report("failed to get cm event while wait "
+ "completion channel");
+ return -EPIPE;
}
error_report("receive cm event while wait comp channel,"
"cm event is %d", cm_event->event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
+ rdma_ack_cm_event(cm_event);
return -EPIPE;
}
+ rdma_ack_cm_event(cm_event);
}
break;
@@ -3285,7 +3289,6 @@ static void rdma_cm_poll_handler(void *opaque)
error_report("get_cm_event failed %d", errno);
return;
}
- rdma_ack_cm_event(cm_event);
if (cm_event->event == RDMA_CM_EVENT_DISCONNECTED ||
cm_event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
@@ -3298,12 +3301,14 @@ static void rdma_cm_poll_handler(void *opaque)
rdma->return_path->error_state = -EPIPE;
}
}
+ rdma_ack_cm_event(cm_event);
if (mis->migration_incoming_co) {
qemu_coroutine_enter(mis->migration_incoming_co);
}
return;
}
+ rdma_ack_cm_event(cm_event);
}
static int qemu_rdma_accept(RDMAContext *rdma)