Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd

[Markus Armbruster]

<address@hidden> writes:

> From: Gonglei <address@hidden>
>
> After commit 4c7e251a (), when dump memory completed,
> the s->fd will be closed twice. We should return
> directly when dump completed.
>
> Signed-off-by: Gonglei <address@hidden>
> ---
>  dump.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/dump.c b/dump.c
> index 06a4915..9d9a409 100644
> --- a/dump.c
> +++ b/dump.c
> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
>          ret = get_next_block(s, block);
>          if (ret == 1) {
>              dump_completed(s);
> +            return;
>          }
>      }
>  }

What about less tortuous control structure?

    do {
        block = s->next_block;

        size = block->target_end - block->target_start;
        if (s->has_filter) {
            size -= s->start;
            if (s->begin + s->length < block->target_end) {
                size -= block->target_end - (s->begin + s->length);
            }
        }
        write_memory(s, block, s->start, size, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }

    } while (!get_next_block(s, block))

    dump_completed();

Makes the badly chosen return values of of get_next_block() more
visible.  Easy enough to fix if it bothers you.