From: Akihiko Odaki <akihiko.od...@daynix.com>
Using -fsanitize=undefined with Clang v18 causes an error if function
pointers are casted:
qapi/qapi-clone-visitor.c:188:5: runtime error: call to function
visit_type_SocketAddress through pointer to incorrect function type 'bool
(*)(struct Visitor *, const char *, void **, struct Error **)'
/tmp/qemu-ubsan/qapi/qapi-visit-sockets.c:487: note: visit_type_SocketAddress
defined here
#0 0x5642aa2f7f3b in qapi_clone qapi/qapi-clone-visitor.c:188:5
#1 0x5642aa2c8ce5 in qio_channel_socket_listen_async
io/channel-socket.c:285:18
#2 0x5642aa2b8903 in test_io_channel_setup_async
tests/unit/test-io-channel-socket.c:116:5
#3 0x5642aa2b8204 in test_io_channel
tests/unit/test-io-channel-socket.c:179:9
#4 0x5642aa2b8129 in test_io_channel_ipv4
tests/unit/test-io-channel-socket.c:323:5
...
It also prevents enabling the strict mode of CFI which is currently
disabled with -fsanitize-cfi-icall-generalize-pointers.
The problematic casts are necessary to pass visit_type_T() and
visit_type_T_members() as callbacks to qapi_clone() and qapi_clone_members(),
respectively. Open-code these two functions to avoid the callbacks, and
thus the type casts.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2346
Signed-off-by: Akihiko Odaki <akihiko.od...@daynix.com>
Reviewed-by: Markus Armbruster <arm...@redhat.com>
Message-ID: <20240524-xkb-v4-3-2de564e5c...@daynix.com>
[thuth: Improve commit message according to Markus' suggestions]
Signed-off-by: Thomas Huth <th...@redhat.com>
---
include/qapi/clone-visitor.h | 37 +++++++++++++++++++++++-------------
qapi/qapi-clone-visitor.c | 30 ++++-------------------------
2 files changed, 28 insertions(+), 39 deletions(-)
diff --git a/include/qapi/clone-visitor.h b/include/qapi/clone-visitor.h
index adf9a788e2..ebc182b034 100644
--- a/include/qapi/clone-visitor.h
+++ b/include/qapi/clone-visitor.h
@@ -11,6 +11,7 @@
#ifndef QAPI_CLONE_VISITOR_H
#define QAPI_CLONE_VISITOR_H
+#include "qapi/error.h"
#include "qapi/visitor.h"
/*
@@ -20,11 +21,8 @@
*/
typedef struct QapiCloneVisitor QapiCloneVisitor;
-void *qapi_clone(const void *src, bool (*visit_type)(Visitor *, const char *,
- void **, Error **));
-void qapi_clone_members(void *dst, const void *src, size_t sz,
- bool (*visit_type_members)(Visitor *, void *,
- Error **));
+Visitor *qapi_clone_visitor_new(void);
+Visitor *qapi_clone_members_visitor_new(void);
/*
* Deep-clone QAPI object @src of the given @type, and return the result.
@@ -32,10 +30,18 @@ void qapi_clone_members(void *dst, const void *src, size_t
sz,
* Not usable on QAPI scalars (integers, strings, enums), nor on a
* QAPI object that references the 'any' type. Safe when @src is NULL.
*/
-#define QAPI_CLONE(type, src) \
- ((type *)qapi_clone(src, \
- (bool (*)(Visitor *, const char *, void **, \
- Error **))visit_type_ ## type))
+#define QAPI_CLONE(type, src) \
+ ({ \
+ Visitor *v_; \
+ type *dst_ = (type *) (src); /* Cast away const */ \
+ \
+ if (dst_) { \
+ v_ = qapi_clone_visitor_new(); \
+ visit_type_ ## type(v_, NULL, &dst_, &error_abort); \
+ visit_free(v_); \
+ } \
+ dst_; \
+ })
/*
* Copy deep clones of @type members from @src to @dst.
@@ -43,9 +49,14 @@ void qapi_clone_members(void *dst, const void *src, size_t
sz,
* Not usable on QAPI scalars (integers, strings, enums), nor on a
* QAPI object that references the 'any' type.
*/
-#define QAPI_CLONE_MEMBERS(type, dst, src) \
- qapi_clone_members(dst, src, sizeof(type), \
- (bool (*)(Visitor *, void *, \
- Error **))visit_type_ ## type ## _members)
+#define QAPI_CLONE_MEMBERS(type, dst, src) \
+ ({ \
+ Visitor *v_; \
+ \
+ v_ = qapi_clone_members_visitor_new(); \
+ *(type *)(dst) = *(src); \
+ visit_type_ ## type ## _members(v_, (type *)(dst), &error_abort); \
+ visit_free(v_); \
+ })
#endif
diff --git a/qapi/qapi-clone-visitor.c b/qapi/qapi-clone-visitor.c
index c45c5caa3b..bbf953698f 100644
--- a/qapi/qapi-clone-visitor.c
+++ b/qapi/qapi-clone-visitor.c
@@ -149,7 +149,7 @@ static void qapi_clone_free(Visitor *v)
g_free(v);
}
-static Visitor *qapi_clone_visitor_new(void)
+Visitor *qapi_clone_visitor_new(void)
{
QapiCloneVisitor *v;
@@ -174,31 +174,9 @@ static Visitor *qapi_clone_visitor_new(void)
return &v->visitor;
}
-void *qapi_clone(const void *src, bool (*visit_type)(Visitor *, const char *,
- void **, Error **))
+Visitor *qapi_clone_members_visitor_new(void)
{
- Visitor *v;
- void *dst = (void *) src; /* Cast away const */
-
- if (!src) {
- return NULL;
- }
-
- v = qapi_clone_visitor_new();
- visit_type(v, NULL, &dst, &error_abort);
- visit_free(v);
- return dst;
-}
-
-void qapi_clone_members(void *dst, const void *src, size_t sz,
- bool (*visit_type_members)(Visitor *, void *,
- Error **))
-{
- Visitor *v;
-
- v = qapi_clone_visitor_new();
- memcpy(dst, src, sz);
+ Visitor *v = qapi_clone_visitor_new();
to_qcv(v)->depth++;
- visit_type_members(v, dst, &error_abort);
- visit_free(v);
+ return v;
}
--
2.45.1
