|
 |
f375e62 |
From 0e647462940092c7af035c69613c799fd65bd0cb Mon Sep 17 00:00:00 2001
|
|
|
f375e62 |
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
f375e62 |
Date: Mon, 26 Nov 2012 13:10:12 +0100
|
|
|
f375e62 |
Subject: [PATCH] qapi: handle visitor->type_size() in QapiDeallocVisitor
|
|
|
f375e62 |
MIME-Version: 1.0
|
|
|
f375e62 |
Content-Type: text/plain; charset=UTF-8
|
|
|
f375e62 |
Content-Transfer-Encoding: 8bit
|
|
|
f375e62 |
|
|
|
f375e62 |
visit_type_size() requires either visitor->type_size() or
|
|
|
f375e62 |
visitor_uint64() to be implemented, otherwise a NULL function pointer is
|
|
|
f375e62 |
invoked.
|
|
|
f375e62 |
|
|
|
f375e62 |
It is possible to trigger this crash as follows:
|
|
|
f375e62 |
|
|
|
f375e62 |
$ qemu-system-x86_64 -netdev tap,sndbuf=0,id=netdev0 \
|
|
|
f375e62 |
-device virtio-blk-pci,netdev=netdev0
|
|
|
f375e62 |
|
|
|
f375e62 |
The 'sndbuf' option has type "size".
|
|
|
f375e62 |
|
|
|
f375e62 |
Reviewed-by: Andreas Färber <afaerber@suse.de>
|
|
|
f375e62 |
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
|
f375e62 |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
f375e62 |
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
|
|
f375e62 |
(cherry picked from commit 0c26f2eca40d6c65ea9edc62a10e510dc7f65cc8)
|
|
|
f375e62 |
|
|
|
f375e62 |
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
|
f375e62 |
---
|
|
|
f375e62 |
qapi/qapi-dealloc-visitor.c | 6 ++++++
|
|
|
f375e62 |
1 file changed, 6 insertions(+)
|
|
|
f375e62 |
|
|
|
f375e62 |
diff --git a/qapi/qapi-dealloc-visitor.c b/qapi/qapi-dealloc-visitor.c
|
|
|
f375e62 |
index a154523..a07b171 100644
|
|
|
f375e62 |
--- a/qapi/qapi-dealloc-visitor.c
|
|
|
f375e62 |
+++ b/qapi/qapi-dealloc-visitor.c
|
|
|
f375e62 |
@@ -132,6 +132,11 @@ static void qapi_dealloc_type_number(Visitor *v, double *obj, const char *name,
|
|
|
f375e62 |
{
|
|
|
f375e62 |
}
|
|
|
f375e62 |
|
|
|
f375e62 |
+static void qapi_dealloc_type_size(Visitor *v, size_t *obj, const char *name,
|
|
|
f375e62 |
+ Error **errp)
|
|
|
f375e62 |
+{
|
|
|
f375e62 |
+}
|
|
|
f375e62 |
+
|
|
|
f375e62 |
static void qapi_dealloc_type_enum(Visitor *v, int *obj, const char *strings[],
|
|
|
f375e62 |
const char *kind, const char *name,
|
|
|
f375e62 |
Error **errp)
|
|
|
f375e62 |
@@ -164,6 +169,7 @@ QapiDeallocVisitor *qapi_dealloc_visitor_new(void)
|
|
|
f375e62 |
v->visitor.type_bool = qapi_dealloc_type_bool;
|
|
|
f375e62 |
v->visitor.type_str = qapi_dealloc_type_str;
|
|
|
f375e62 |
v->visitor.type_number = qapi_dealloc_type_number;
|
|
|
f375e62 |
+ v->visitor.type_size = qapi_dealloc_type_size;
|
|
|
f375e62 |
|
|
|
f375e62 |
QTAILQ_INIT(&v->stack);
|
|
|
f375e62 |
|