Re: [PATCH] migration/rdma: Fix cm_event used before being initialized

[Philippe Mathieu-Daudé]

On 5/13/21 6:13 PM, Philippe Mathieu-Daudé wrote:
> On 5/13/21 1:37 PM, Li Zhijian wrote:
>> A segmentation fault was triggered when i try to abort a postcopy + rdma
>> migration.
>>
>> since rdma_ack_cm_event releases a uninitialized cm_event in thise case.
>>
>> like below:
>> 2496     ret = rdma_get_cm_event(rdma->channel, &cm_event);
>> 2497     if (ret) {
>> 2498         perror("rdma_get_cm_event after rdma_connect");
>> 2499         ERROR(errp, "connecting to destination!");
>> 2500         rdma_ack_cm_event(cm_event); <<<< cause segmentation fault
>> 2501         goto err_rdma_source_connect;
>> 2502     }
>>
>> Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
>> ---
>>  migration/rdma.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/migration/rdma.c b/migration/rdma.c
>> index 00eac34232..2dadb62aed 100644
>> --- a/migration/rdma.c
>> +++ b/migration/rdma.c
>> @@ -2466,7 +2466,7 @@ static int qemu_rdma_connect(RDMAContext *rdma, Error 
>> **errp)
>>                                            .private_data = &cap,
>>                                            .private_data_len = sizeof(cap),
>>                                          };
>> -    struct rdma_cm_event *cm_event;
>> +    struct rdma_cm_event *cm_event = NULL;
>>      int ret;
>>  
>>      /*
>>
> 
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> 

Cc: qemu-stable@nongnu.org