[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 01/45] qom: assert integer does not overflow
From: |
Michael S. Tsirkin |
Subject: |
[PULL 01/45] qom: assert integer does not overflow |
Date: |
Fri, 4 Mar 2022 08:37:03 -0500 |
QOM reference counting is not designed with an infinite amount of
references in mind, trying to take a reference in a loop without
dropping a reference will overflow the integer.
It is generally a symptom of a reference leak (a missing deref, commonly
as part of error handling - such as one fixed here:
https://lore.kernel.org/r/20220228095058.27899-1-sgarzare%40redhat.com ).
All this can lead to either freeing the object too early (memory
corruption) or never freeing it (memory leak).
If we happen to dereference at just the right time (when it's wrapping
around to 0), we might eventually assert when dereferencing, but the
real problem is an extra object_ref so let's assert there to make such
issues cleaner and easier to debug.
Some micro-benchmarking shows using fetch and add this is essentially
free on x86.
Since multiple threads could be incrementing in parallel, we assert
around INT_MAX to make sure none of these approach the wrap around
point: this way we get a memory leak and not a memory corruption, the
former is generally easier to debug.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
qom/object.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/qom/object.c b/qom/object.c
index 9f7a33139d..a27532a6ba 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1167,10 +1167,14 @@ GSList *object_class_get_list_sorted(const char
*implements_type,
Object *object_ref(void *objptr)
{
Object *obj = OBJECT(objptr);
+ uint32_t ref;
+
if (!obj) {
return NULL;
}
- qatomic_inc(&obj->ref);
+ ref = qatomic_fetch_inc(&obj->ref);
+ /* Assert waaay before the integer overflows */
+ g_assert(ref < INT_MAX);
return obj;
}
--
MST
- [PULL 00/45] virtio,pc,pci: features, cleanups, fixes, Michael S. Tsirkin, 2022/03/04
- [PULL 01/45] qom: assert integer does not overflow,
Michael S. Tsirkin <=
- [PULL 02/45] ACPI ERST: specification for ERST support, Michael S. Tsirkin, 2022/03/04
- [PULL 03/45] MAINTAINERS: no need to add my name explicitly as a reviewer for VIOT tables, Michael S. Tsirkin, 2022/03/04
- [PULL 04/45] docs/acpi/erst: add device id for ACPI ERST device in pci-ids.txt, Michael S. Tsirkin, 2022/03/04
- [PULL 05/45] hw/acpi/erst: clean up unused IS_UEFI_CPER_RECORD macro, Michael S. Tsirkin, 2022/03/04
- [PULL 06/45] hw/smbios: code cleanup - use macro definitions for table header handles, Michael S. Tsirkin, 2022/03/04
- [PULL 08/45] hw/smbios: add assertion to ensure handles of tables 19 and 32 do not collide, Michael S. Tsirkin, 2022/03/04
- [PULL 07/45] hw/smbios: fix overlapping table handle numbers with large memory vms, Michael S. Tsirkin, 2022/03/04
- [PULL 09/45] vhost-user: remove VirtQ notifier restore, Michael S. Tsirkin, 2022/03/04
- [PULL 10/45] vhost-user: fix VirtQ notifier cleanup, Michael S. Tsirkin, 2022/03/04
- [PULL 11/45] virtio: fix the condition for iommu_platform not supported, Michael S. Tsirkin, 2022/03/04