Re: [Qemu-devel] [PULL v3 00/38] QAPI patches for 2018-03-12, 2.12 softfreeze

2018-03-19 Thread Eric Blake 

On 03/19/2018 01:43 PM, Peter Maydell wrote:

On 19 March 2018 at 16:41, Eric Blake  wrote:

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging 
(2018-03-19 11:44:26 +)

are available in the Git repository at:

   git://repo.or.cz/qemu/ericb.git tags/pull-qapi-2018-03-12-v3

for you to fetch changes up to ebf1105a7086897da6963edefdb247c80f605424:

   qapi: Pass '-u' when doing non-silent diff (2018-03-19 11:32:36 -0500)

in v3:
rebase to master (a few more qobject_to_qdict() uses crept in)
squash in Peter Xu's fixup for test failures
[if tests still fail, then I will send a v4 without OOB from 2.12]
sending only the patches that changed from v2




The assert seems to have gone away,


Progress! Peter's OOB patches are working; your ubsan errors are from a 
different part of the series.



but I get over 10,000 new
clang sanitizer runtime errors like

   /visitor/input/large_number: OK
   /visitor/input/number_keyval:OK
   /visitor/input/number_str_keyval:OK
   /visitor/input/number_str_fail:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:550:12:
runtime error: member access within null pointer of type 'QNum' (aka
'struct QNum')
OK



Here's some backtraces for some of those:

/visitor/input/int_keyval:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:188:12:
runtime error: member access within null pointer of type 'QString'
(aka 'struct QString')
 #0 0x56375e642549 in qobject_input_get_keyval
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:188:12
 #1 0x56375e63f76b in qobject_input_type_int64_keyval
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:409:23
 #2 0x56375e63c13d in visit_type_int
/home/petmay01/linaro/qemu-for-merges/qapi/qapi-visit-core.c:150:5


Max, this is the qobject_to() macro that is making ubsan gripe :(

qstr = qobject_to(QString, qobj);

which partially expands to

qstr = container_of(qobject_check_type(qobj,
   QTYPE_CAST_TO_QString)) ?: QOBJECT((QString *)NULL), QString, base);

I'm guessing that container_of(NULL, type, base) is what ubsan is 
griping at?  Can we rewrite qobject_to() to only call container_of() if 
qobject_check_type() returns non-NULL?


--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PULL v3 00/38] QAPI patches for 2018-03-12, 2.12 softfreeze

2018-03-19 Thread Peter Maydell 
On 19 March 2018 at 16:41, Eric Blake  wrote:
> The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
>
>   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging 
> (2018-03-19 11:44:26 +)
>
> are available in the Git repository at:
>
>   git://repo.or.cz/qemu/ericb.git tags/pull-qapi-2018-03-12-v3
>
> for you to fetch changes up to ebf1105a7086897da6963edefdb247c80f605424:
>
>   qapi: Pass '-u' when doing non-silent diff (2018-03-19 11:32:36 -0500)
>
> in v3:
> rebase to master (a few more qobject_to_qdict() uses crept in)
> squash in Peter Xu's fixup for test failures
> [if tests still fail, then I will send a v4 without OOB from 2.12]
> sending only the patches that changed from v2
>
> 
> qapi patches for 2018-03-12, 2.12 softfreeze
>
> - Marc-André Lureau: 0/4 qapi: generate a literal qobject for introspection
> - Max Reitz: 0/7 block: Handle null backing link
> - Daniel P. Berrange: chardev: tcp: postpone TLS work until machine done
> - Peter Xu: 00/23 QMP: out-of-band (OOB) execution support
> - Vladimir Sementsov-Ogievskiy: 0/2 block latency histogram
> - Eric Blake: qapi: Pass '-u' when doing non-silent diff

The assert seems to have gone away, but I get over 10,000 new
clang sanitizer runtime errors like

  /visitor/input/large_number: OK
  /visitor/input/number_keyval:OK
  /visitor/input/number_str_keyval:OK
  /visitor/input/number_str_fail:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:550:12:
runtime error: member access within null pointer of type 'QNum' (aka
'struct QNum')
OK
  /visitor/input/size_str_keyval:  OK
  /visitor/input/size_str_fail:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:433:12:
runtime error: member access within null pointer of type 'QNum' (aka
'struct QNum')
OK
  /visitor/input/string:   OK
  /visitor/input/enum: OK
  /visitor/input/struct:   OK
  /visitor/input/struct-nested:OK
  /visitor/input/list: OK
  /visitor/input/any:  OK
  /visitor/input/null: OK
  /visitor/input/union-flat:   OK
  /visitor/input/alternate:OK
  /visitor/input/errors:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:521:12:
runtime error: member access within null pointer of type 'QString'
(aka 'struct QString')
OK
  /visitor/input/wrong-type:   OK
  /visitor/input/alternate-number: OK
  /visitor/input/qapi-introspect:  OK


Here's some backtraces for some of those:

/visitor/input/int_keyval:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:188:12:
runtime error: member access within null pointer of type 'QString'
(aka 'struct QString')
#0 0x56375e642549 in qobject_input_get_keyval
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:188:12
#1 0x56375e63f76b in qobject_input_type_int64_keyval
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:409:23
#2 0x56375e63c13d in visit_type_int
/home/petmay01/linaro/qemu-for-merges/qapi/qapi-visit-core.c:150:5
#3 0x56375e61a025 in test_visitor_in_int_keyval
/home/petmay01/linaro/qemu-for-merges/tests/test-qobject-input-visitor.c:187:5
#4 0x7f84d08df7da  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x6f7da)
#5 0x7f84d08df9a2  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x6f9a2)
#6 0x7f84d08df9a2  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x6f9a2)
#7 0x7f84d08dfbad in g_test_run_suite
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x6fbad)
#8 0x7f84d08dfbd0 in g_test_run
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x6fbd0)
#9 0x56375e619ab6 in main
/home/petmay01/linaro/qemu-for-merges/tests/test-qobject-input-visitor.c:1385:5
#10 0x7f84cea7482f in __libc_start_main
/build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#11 0x56375e5f6f88 in _start
(/home/petmay01/linaro/qemu-for-merges/build/clang/tests/test-qobject-input-visitor+0xabf88)

OK

/visitor/input/int_str_fail:
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:398:12:
runtime error: member access within null pointer of type 'QNum' (aka
'struct QNum')
#0 0x56375e63ec7e in qobject_input_type_int64
/home/petmay01/linaro/qemu-for-merges/qapi/qobject-input-visitor.c:398:12
#1 0x56375e63c13d in visit_type_int