On Tue, Nov 25, 2025 at 08:02:55PM +0100, Markus Armbruster wrote: > Peter Xu <[email protected]> writes: > > > On Tue, Nov 25, 2025 at 12:46:01PM +0100, Markus Armbruster wrote: > >> Daniel P. Berrangé <[email protected]> writes: > >> > >> > On Tue, Nov 25, 2025 at 08:40:07AM +0100, Markus Armbruster wrote: > >> >> g_autoptr(T) is quite useful when the object's extent matches the > >> >> function's. > >> >> > >> >> This isn't the case for an Error object the function propagates to its > >> >> caller. It is the case for an Error object the function reports or > >> >> handles itself. However, the functions to report Error also free it. > > > > I'd confess I didn't pay enough attention on how the error API was designed > > deliberately to always free the Error objects before almost whenever > > possible. But I see now, thanks for the write up. > > You're welcome! > > >> >> > >> >> Thus, g_autoptr(Error) is rarely applicable. We have just three > >> >> instances out of >1100 local Error variables, all in migration code. > >> >> > >> >> Two want to move the error to the MigrationState for later handling / > >> >> reporting. Since migrate_set_error() doesn't move, but stores a copy, > >> >> the original needs to be freed, and g_autoptr() is correct there. We > >> >> have 17 more that instead manually free with error_free() or > >> >> error_report_err() right after migrate_set_error(). > >> >> > >> >> We recently discussed storing a copy vs. move the original: > >> >> > >> >> From: Peter Xu <[email protected]> > >> >> Subject: Re: [PATCH 0/3] migration: Error fixes and improvements > >> >> Date: Mon, 17 Nov 2025 11:03:37 -0500 > >> >> Message-ID: <[email protected]> > >> >> > >> >> The two g_autoptr() gave me pause when I investigated this topic, simply > >> >> because they deviate from the common pattern migrate_set_error(s, err) > >> >> followed by error_free() or error_report_err(). > >> >> > >> >> The third one became wrong when I cleaned up the reporting (missed in > >> >> the cleanup patch, fixed in the patch I'm replying to). I suspect my > >> >> mistake escaped review for the same reason I made it: g_autoptr(Error) > >> >> is unusual and not visible in the patch hunk. > >> >> > >> >> Would you like me to replace the two correct uses of g_autoptr(Error) by > >> >> more common usage? > > > > Works for me. > > > > Now I also think it should be good migrate_set_error() follow QEMU's Error > > API design if we decide to stick with it freeing errors in such APIs. > > > > Said that, I wonder if you think we could still consider passing Error** > > into migrate_set_error(), though, which will be a merged solution of > > current Error API and what Marc-Andre proposed on resetting pointers to > > avoid any possible UAF, which I would still slightly prefer personally. > > > > If we rework migrate_set_error() to take ownership first, then we can > > naturally drop the two use cases, and remove the cleanup function. > > > > Markus, please also let me know if you want me to do it. > > I think the first step should replace the two g_autoptr() by > error_free(), then delete g_autoptr() support. > > A possible second step is to replace migrate_set_error() by a function > that takes ownership. "Replace" because I think migrate_set_error() > would be a bad name for such a function. What's a better name? Naming > is hard... migrate_error_propagate_to_state()? Because there's > similarity: > > error_propagate(errp, err); > > stores @err in @errp, or else frees it, and > > migrate_error_propagate_to_state(s, err)
I took this one but dropped to_state to make it shorter (and also dropped "s" to make it g_clear_pointer() friendly). > > stores @err in @s, or else frees it. > > We could also forgo encapsulation and simply use > > error_propagate(&s->error, err); > > Matter of taste, which means migration maintainers decide. > > I can do just the first step, or both. Up to you. I sent the patches here for both of the issues discussed (I should still owe some other patches; I'll do them separately..): https://lore.kernel.org/r/[email protected] Comments more than welcomed. Thanks, -- Peter Xu
