1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
From 1b6acdeeb2323c53d841356da50440e274e7bf9a Mon Sep 17 00:00:00 2001
From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Wed, 1 Feb 2023 11:27:42 +0000
Subject: [PATCH 21/61] tools/ocaml/libs: Fix memory/resource leaks with
caml_alloc_custom()
All caml_alloc_*() functions can throw exceptions, and longjump out of
context. If this happens, we leak the xch/xce handle.
Reorder the logic to allocate the the Ocaml object first.
Fixes: 8b3c06a3e545 ("tools/ocaml/xenctrl: OCaml 5 support, fix use-after-free")
Fixes: 22d5affdf0ce ("tools/ocaml/evtchn: OCaml 5 support, fix potential resource leak")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Christian Lindig <christian.lindig@citrix.com>
(cherry picked from commit d69ccf52ad467ccc22029172a8e61dc621187889)
---
tools/ocaml/libs/eventchn/xeneventchn_stubs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/ocaml/libs/eventchn/xeneventchn_stubs.c b/tools/ocaml/libs/eventchn/xeneventchn_stubs.c
index d7881ca95f..de2fc29292 100644
--- a/tools/ocaml/libs/eventchn/xeneventchn_stubs.c
+++ b/tools/ocaml/libs/eventchn/xeneventchn_stubs.c
@@ -63,6 +63,8 @@ CAMLprim value stub_eventchn_init(value cloexec)
if ( !Bool_val(cloexec) )
flags |= XENEVTCHN_NO_CLOEXEC;
+ result = caml_alloc_custom(&xenevtchn_ops, sizeof(xce), 0, 1);
+
caml_enter_blocking_section();
xce = xenevtchn_open(NULL, flags);
caml_leave_blocking_section();
@@ -70,7 +72,6 @@ CAMLprim value stub_eventchn_init(value cloexec)
if (xce == NULL)
caml_failwith("open failed");
- result = caml_alloc_custom(&xenevtchn_ops, sizeof(xce), 0, 1);
*(xenevtchn_handle **)Data_custom_val(result) = xce;
CAMLreturn(result);
@@ -82,6 +83,8 @@ CAMLprim value stub_eventchn_fdopen(value fdval)
CAMLlocal1(result);
xenevtchn_handle *xce;
+ result = caml_alloc_custom(&xenevtchn_ops, sizeof(xce), 0, 1);
+
caml_enter_blocking_section();
xce = xenevtchn_fdopen(NULL, Int_val(fdval), 0);
caml_leave_blocking_section();
@@ -89,7 +92,6 @@ CAMLprim value stub_eventchn_fdopen(value fdval)
if (xce == NULL)
caml_failwith("evtchn fdopen failed");
- result = caml_alloc_custom(&xenevtchn_ops, sizeof(xce), 0, 1);
*(xenevtchn_handle **)Data_custom_val(result) = xce;
CAMLreturn(result);
--
2.40.0
|
GitWeb
