aboutsummaryrefslogtreecommitdiff
path: root/balloon.c
diff options
context:
space:
mode:
authorAmit Shah <amit.shah@redhat.com>2011-07-20 13:30:56 +0530
committerAnthony Liguori <aliguori@us.ibm.com>2011-08-04 16:43:09 -0500
commit30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa (patch)
tree15cf07aad31a658c0e42ee98c6a6fa87ebe2c10e /balloon.c
parentdce911c753489609238f91d29bcf945c87a19911 (diff)
downloadqemu-30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa.zip
qemu-30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa.tar.gz
qemu-30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa.tar.bz2
balloon: Separate out stat and balloon handling
Passing on '0' as ballooning target to indicate retrieval of stats is bad API. It also makes 'balloon 0' in the monitor cause a segfault. Have two different functions handle the different functionality instead. Detailed explanation from Markus's review: 1. do_info_balloon() is an info_async() method. It receives a callback with argument, to be called exactly once (callback frees the argument). It passes the callback via qemu_balloon_status() and indirectly through qemu_balloon_event to virtio_balloon_to_target(). virtio_balloon_to_target() executes its balloon stats half. It stores the callback in the device state. If it can't send a stats request, it resets stats and calls the callback right away. Else, it sends a stats request. The device model runs the callback when it receives the answer. Works. 2. do_balloon() is a cmd_async() method. It receives a callback with argument, to be called when the command completes. do_balloon() calls it right before it succeeds. Odd, but should work. Nevertheless, it passes the callback on via qemu_ballon() and indirectly through qemu_balloon_event to virtio_balloon_to_target(). a. If the argument is non-zero, virtio_balloon_to_target() executes its balloon half, which doesn't use the callback in any way. Odd, but works. b. If the argument is zero, virtio_balloon_to_target() executes its balloon stats half, just like in 1. It either calls the callback right away, or arranges for it to be called later. Thus, the callback runs twice: use after free and double free. Test case: start with -S -device virtio-balloon, execute "balloon 0" in human monitor. Runs the callback first from virtio_balloon_to_target(), then again from do_balloon(). Reported-by: Mike Cao <bcao@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'balloon.c')
-rw-r--r--balloon.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/balloon.c b/balloon.c
index d40be39..8be3812 100644
--- a/balloon.c
+++ b/balloon.c
@@ -32,30 +32,33 @@
static QEMUBalloonEvent *balloon_event_fn;
+static QEMUBalloonStatus *balloon_stat_fn;
static void *balloon_opaque;
-void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque)
+void qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
+ QEMUBalloonStatus *stat_func, void *opaque)
{
- balloon_event_fn = func;
+ balloon_event_fn = event_func;
+ balloon_stat_fn = stat_func;
balloon_opaque = opaque;
}
-static int qemu_balloon(ram_addr_t target, MonitorCompletion cb, void *opaque)
+static int qemu_balloon(ram_addr_t target)
{
if (!balloon_event_fn) {
return 0;
}
trace_balloon_event(balloon_opaque, target);
- balloon_event_fn(balloon_opaque, target, cb, opaque);
+ balloon_event_fn(balloon_opaque, target);
return 1;
}
static int qemu_balloon_status(MonitorCompletion cb, void *opaque)
{
- if (!balloon_event_fn) {
+ if (!balloon_stat_fn) {
return 0;
}
- balloon_event_fn(balloon_opaque, 0, cb, opaque);
+ balloon_stat_fn(balloon_opaque, cb, opaque);
return 1;
}
@@ -135,7 +138,7 @@ int do_balloon(Monitor *mon, const QDict *params,
return -1;
}
- ret = qemu_balloon(qdict_get_int(params, "value"), cb, opaque);
+ ret = qemu_balloon(qdict_get_int(params, "value"));
if (ret == 0) {
qerror_report(QERR_DEVICE_NOT_ACTIVE, "balloon");
return -1;