 cc40b8b844
			
		
	
	
		cc40b8b844
		
	
	
	
	
		
			
			Fix use-after-free errors in the code path that called error_handle(). A
call to error_handle() will now either free the passed Error 'err' or
assign it to '*errp' if '*errp' is currently NULL. This ensures that 'err'
either has been freed or is assigned to '*errp' if this function returns.
Adjust the two callers of this function to not assign the 'err' to '*errp'
themselves, since this is now handled by error_handle().
Fixes: commit 3ffef1a55ca3 ("error: add global &error_warn destination")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20230406154347.4100700-1-stefanb@linux.ibm.com
		
	
			
		
			
				
	
	
		
			309 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			309 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * QEMU Error Objects
 | |
|  *
 | |
|  * Copyright IBM, Corp. 2011
 | |
|  * Copyright (C) 2011-2015 Red Hat, Inc.
 | |
|  *
 | |
|  * Authors:
 | |
|  *  Anthony Liguori   <aliguori@us.ibm.com>
 | |
|  *  Markus Armbruster <armbru@redhat.com>,
 | |
|  *
 | |
|  * This work is licensed under the terms of the GNU LGPL, version 2.  See
 | |
|  * the COPYING.LIB file in the top-level directory.
 | |
|  */
 | |
| 
 | |
| #include "qemu/osdep.h"
 | |
| #include "qapi/error.h"
 | |
| #include "qemu/error-report.h"
 | |
| 
 | |
| struct Error
 | |
| {
 | |
|     char *msg;
 | |
|     ErrorClass err_class;
 | |
|     const char *src, *func;
 | |
|     int line;
 | |
|     GString *hint;
 | |
| };
 | |
| 
 | |
| Error *error_abort;
 | |
| Error *error_fatal;
 | |
| Error *error_warn;
 | |
| 
 | |
| static void error_handle(Error **errp, Error *err)
 | |
| {
 | |
|     if (errp == &error_abort) {
 | |
|         fprintf(stderr, "Unexpected error in %s() at %s:%d:\n",
 | |
|                 err->func, err->src, err->line);
 | |
|         error_report("%s", error_get_pretty(err));
 | |
|         if (err->hint) {
 | |
|             error_printf("%s", err->hint->str);
 | |
|         }
 | |
|         abort();
 | |
|     }
 | |
|     if (errp == &error_fatal) {
 | |
|         error_report_err(err);
 | |
|         exit(1);
 | |
|     }
 | |
|     if (errp == &error_warn) {
 | |
|         warn_report_err(err);
 | |
|     } else if (errp && !*errp) {
 | |
|         *errp = err;
 | |
|     } else {
 | |
|         error_free(err);
 | |
|     }
 | |
| }
 | |
| 
 | |
| G_GNUC_PRINTF(6, 0)
 | |
| static void error_setv(Error **errp,
 | |
|                        const char *src, int line, const char *func,
 | |
|                        ErrorClass err_class, const char *fmt, va_list ap,
 | |
|                        const char *suffix)
 | |
| {
 | |
|     Error *err;
 | |
|     int saved_errno = errno;
 | |
| 
 | |
|     if (errp == NULL) {
 | |
|         return;
 | |
|     }
 | |
|     assert(*errp == NULL);
 | |
| 
 | |
|     err = g_malloc0(sizeof(*err));
 | |
|     err->msg = g_strdup_vprintf(fmt, ap);
 | |
|     if (suffix) {
 | |
|         char *msg = err->msg;
 | |
|         err->msg = g_strdup_printf("%s: %s", msg, suffix);
 | |
|         g_free(msg);
 | |
|     }
 | |
|     err->err_class = err_class;
 | |
|     err->src = src;
 | |
|     err->line = line;
 | |
|     err->func = func;
 | |
| 
 | |
|     error_handle(errp, err);
 | |
| 
 | |
|     errno = saved_errno;
 | |
| }
 | |
| 
 | |
| void error_set_internal(Error **errp,
 | |
|                         const char *src, int line, const char *func,
 | |
|                         ErrorClass err_class, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_setv(errp, src, line, func, err_class, fmt, ap, NULL);
 | |
|     va_end(ap);
 | |
| }
 | |
| 
 | |
| void error_setg_internal(Error **errp,
 | |
|                          const char *src, int line, const char *func,
 | |
|                          const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_setv(errp, src, line, func, ERROR_CLASS_GENERIC_ERROR, fmt, ap, NULL);
 | |
|     va_end(ap);
 | |
| }
 | |
| 
 | |
| void error_setg_errno_internal(Error **errp,
 | |
|                                const char *src, int line, const char *func,
 | |
|                                int os_errno, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
|     int saved_errno = errno;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_setv(errp, src, line, func, ERROR_CLASS_GENERIC_ERROR, fmt, ap,
 | |
|                os_errno != 0 ? strerror(os_errno) : NULL);
 | |
|     va_end(ap);
 | |
| 
 | |
|     errno = saved_errno;
 | |
| }
 | |
| 
 | |
| void error_setg_file_open_internal(Error **errp,
 | |
|                                    const char *src, int line, const char *func,
 | |
|                                    int os_errno, const char *filename)
 | |
| {
 | |
|     error_setg_errno_internal(errp, src, line, func, os_errno,
 | |
|                               "Could not open '%s'", filename);
 | |
| }
 | |
| 
 | |
| void error_vprepend(Error *const *errp, const char *fmt, va_list ap)
 | |
| {
 | |
|     GString *newmsg;
 | |
| 
 | |
|     if (!errp) {
 | |
|         return;
 | |
|     }
 | |
| 
 | |
|     newmsg = g_string_new(NULL);
 | |
|     g_string_vprintf(newmsg, fmt, ap);
 | |
|     g_string_append(newmsg, (*errp)->msg);
 | |
|     g_free((*errp)->msg);
 | |
|     (*errp)->msg = g_string_free(newmsg, 0);
 | |
| }
 | |
| 
 | |
| void error_prepend(Error *const *errp, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_vprepend(errp, fmt, ap);
 | |
|     va_end(ap);
 | |
| }
 | |
| 
 | |
| void error_append_hint(Error *const *errp, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
|     int saved_errno = errno;
 | |
|     Error *err;
 | |
| 
 | |
|     if (!errp) {
 | |
|         return;
 | |
|     }
 | |
|     err = *errp;
 | |
|     assert(err && errp != &error_abort && errp != &error_fatal);
 | |
| 
 | |
|     if (!err->hint) {
 | |
|         err->hint = g_string_new(NULL);
 | |
|     }
 | |
|     va_start(ap, fmt);
 | |
|     g_string_append_vprintf(err->hint, fmt, ap);
 | |
|     va_end(ap);
 | |
| 
 | |
|     errno = saved_errno;
 | |
| }
 | |
| 
 | |
| #ifdef _WIN32
 | |
| 
 | |
| void error_setg_win32_internal(Error **errp,
 | |
|                                const char *src, int line, const char *func,
 | |
|                                int win32_err, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
|     char *suffix = NULL;
 | |
| 
 | |
|     if (errp == NULL) {
 | |
|         return;
 | |
|     }
 | |
| 
 | |
|     if (win32_err != 0) {
 | |
|         suffix = g_win32_error_message(win32_err);
 | |
|     }
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_setv(errp, src, line, func, ERROR_CLASS_GENERIC_ERROR,
 | |
|                fmt, ap, suffix);
 | |
|     va_end(ap);
 | |
| 
 | |
|     g_free(suffix);
 | |
| }
 | |
| 
 | |
| #endif
 | |
| 
 | |
| Error *error_copy(const Error *err)
 | |
| {
 | |
|     Error *err_new;
 | |
| 
 | |
|     err_new = g_malloc0(sizeof(*err));
 | |
|     err_new->msg = g_strdup(err->msg);
 | |
|     err_new->err_class = err->err_class;
 | |
|     err_new->src = err->src;
 | |
|     err_new->line = err->line;
 | |
|     err_new->func = err->func;
 | |
|     if (err->hint) {
 | |
|         err_new->hint = g_string_new(err->hint->str);
 | |
|     }
 | |
| 
 | |
|     return err_new;
 | |
| }
 | |
| 
 | |
| ErrorClass error_get_class(const Error *err)
 | |
| {
 | |
|     return err->err_class;
 | |
| }
 | |
| 
 | |
| const char *error_get_pretty(const Error *err)
 | |
| {
 | |
|     return err->msg;
 | |
| }
 | |
| 
 | |
| void error_report_err(Error *err)
 | |
| {
 | |
|     error_report("%s", error_get_pretty(err));
 | |
|     if (err->hint) {
 | |
|         error_printf("%s", err->hint->str);
 | |
|     }
 | |
|     error_free(err);
 | |
| }
 | |
| 
 | |
| void warn_report_err(Error *err)
 | |
| {
 | |
|     warn_report("%s", error_get_pretty(err));
 | |
|     if (err->hint) {
 | |
|         error_printf("%s", err->hint->str);
 | |
|     }
 | |
|     error_free(err);
 | |
| }
 | |
| 
 | |
| void error_reportf_err(Error *err, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_vprepend(&err, fmt, ap);
 | |
|     va_end(ap);
 | |
|     error_report_err(err);
 | |
| }
 | |
| 
 | |
| 
 | |
| void warn_reportf_err(Error *err, const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     va_start(ap, fmt);
 | |
|     error_vprepend(&err, fmt, ap);
 | |
|     va_end(ap);
 | |
|     warn_report_err(err);
 | |
| }
 | |
| 
 | |
| void error_free(Error *err)
 | |
| {
 | |
|     if (err) {
 | |
|         g_free(err->msg);
 | |
|         if (err->hint) {
 | |
|             g_string_free(err->hint, true);
 | |
|         }
 | |
|         g_free(err);
 | |
|     }
 | |
| }
 | |
| 
 | |
| void error_free_or_abort(Error **errp)
 | |
| {
 | |
|     assert(errp && *errp);
 | |
|     error_free(*errp);
 | |
|     *errp = NULL;
 | |
| }
 | |
| 
 | |
| void error_propagate(Error **dst_errp, Error *local_err)
 | |
| {
 | |
|     if (!local_err) {
 | |
|         return;
 | |
|     }
 | |
|     error_handle(dst_errp, local_err);
 | |
| }
 | |
| 
 | |
| void error_propagate_prepend(Error **dst_errp, Error *err,
 | |
|                              const char *fmt, ...)
 | |
| {
 | |
|     va_list ap;
 | |
| 
 | |
|     if (dst_errp && !*dst_errp) {
 | |
|         va_start(ap, fmt);
 | |
|         error_vprepend(&err, fmt, ap);
 | |
|         va_end(ap);
 | |
|     } /* else error is being ignored, don't bother with prepending */
 | |
|     error_propagate(dst_errp, err);
 | |
| }
 |