Skip to content

Commit 08a655b

Browse files
gongleiareiMichael Tokarev
authored and
Michael Tokarev
committed
dump: Fix dump-guest-memory termination and use-after-close
dump_iterate() dumps blocks in a loop. Eventually, get_next_block() returns "no more". We then call dump_completed(). But we neglect to break the loop! Broken in commit 4c7e251. Because of that, we dump the last block again. This attempts to write to s->fd, which fails if we're lucky. The error makes dump_iterate() return failure. It's the only way it can ever return. Theoretical: if we're not so lucky, something else has opened something for writing and got the same fd. dump_iterate() then keeps looping, messing up the something else's output, until a write fails, or the process mercifully terminates. The obvious fix is to restore the return lost in commit 4c7e251. But the root cause of the bug is needlessly opaque loop control. Replace it by a clean do ... while loop. This makes the badly chosen return values of get_next_block() more visible. Cleaning that up is outside the scope of this bug fix. Signed-off-by: Gonglei <[email protected]> Signed-off-by: Markus Armbruster <[email protected]> Signed-off-by: Michael Tokarev <[email protected]>
1 parent 7d5a843 commit 08a655b

File tree

1 file changed

+4
-7
lines changed

1 file changed

+4
-7
lines changed

dump.c

+4-7
Original file line numberDiff line numberDiff line change
@@ -604,10 +604,9 @@ static void dump_iterate(DumpState *s, Error **errp)
604604
{
605605
GuestPhysBlock *block;
606606
int64_t size;
607-
int ret;
608607
Error *local_err = NULL;
609608

610-
while (1) {
609+
do {
611610
block = s->next_block;
612611

613612
size = block->target_end - block->target_start;
@@ -623,11 +622,9 @@ static void dump_iterate(DumpState *s, Error **errp)
623622
return;
624623
}
625624

626-
ret = get_next_block(s, block);
627-
if (ret == 1) {
628-
dump_completed(s);
629-
}
630-
}
625+
} while (!get_next_block(s, block));
626+
627+
dump_completed(s);
631628
}
632629

633630
static void create_vmcore(DumpState *s, Error **errp)

0 commit comments

Comments
 (0)