From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=44743 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PQMW7-0007SG-3w
	for qemu-devel@nongnu.org; Wed, 08 Dec 2010 11:05:20 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <ryanh@us.ibm.com>) id 1PQMW5-0001Vc-La
	for qemu-devel@nongnu.org; Wed, 08 Dec 2010 11:05:18 -0500
Received: from e33.co.us.ibm.com ([32.97.110.151]:40073)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <ryanh@us.ibm.com>) id 1PQMW5-0001V2-GO
	for qemu-devel@nongnu.org; Wed, 08 Dec 2010 11:05:17 -0500
Received: from d03relay03.boulder.ibm.com (d03relay03.boulder.ibm.com
	[9.17.195.228])
	by e33.co.us.ibm.com (8.14.4/8.13.1) with ESMTP id oB8FxMiW023432
	for <qemu-devel@nongnu.org>; Wed, 8 Dec 2010 08:59:22 -0700
Received: from d03av01.boulder.ibm.com (d03av01.boulder.ibm.com [9.17.195.167])
	by d03relay03.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id
	oB8G55d8018504
	for <qemu-devel@nongnu.org>; Wed, 8 Dec 2010 09:05:06 -0700
Received: from d03av01.boulder.ibm.com (loopback [127.0.0.1])
	by d03av01.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP
	id oB8G55AX007369
	for <qemu-devel@nongnu.org>; Wed, 8 Dec 2010 09:05:05 -0700
Date: Wed, 8 Dec 2010 10:05:00 -0600
From: Ryan Harper <ryanh@us.ibm.com>
Message-ID: <20101208160500.GQ22381@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] blockdev: check dinfo ptr before using
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, Markus Armbruster <armbru@redhat.com>, Luiz Capitulino <lcapitulino@redhat.com>

If a user decides to punish a guest by revoking its block device via
drive_del, and subsequently also attempts to remove the pci device
backing it, and the device is using blockdev_auto_del() then we get a
segfault when we attempt to access dinfo->auto_del.[1]

The fix is to check if drive_get_by_blockdev() actually returns a valid
dinfo pointer or not.

1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
   (qemu) drive_del block1
   (qemu) pci_del 5
   *segfault*

Signed-off-by: Ryan Harper <ryanh@us.ibm.com>

-- 
Ryan Harper
Software Engineer; Linux Technology Center
IBM Corp., Austin, Tx
ryanh@us.ibm.com


diff --git a/blockdev.c b/blockdev.c
index f6ac439..3b3b82d 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -30,14 +30,16 @@ void blockdev_mark_auto_del(BlockDriverState *bs)
 {
     DriveInfo *dinfo = drive_get_by_blockdev(bs);
 
-    dinfo->auto_del = 1;
+    if (dinfo) {
+        dinfo->auto_del = 1;
+    }
 }
 
 void blockdev_auto_del(BlockDriverState *bs)
 {
     DriveInfo *dinfo = drive_get_by_blockdev(bs);
 
-    if (dinfo->auto_del) {
+    if (dinfo && dinfo->auto_del) {
         drive_uninit(dinfo);
     }
 }