From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34287) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X0bWl-000556-RU for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:09:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X0bWf-0006uS-9c for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:09:39 -0400 Received: from mx1.redhat.com ([209.132.183.28]:10399) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X0bWf-0006uJ-2e for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:09:33 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s5RJ9WrC022966 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 27 Jun 2014 15:09:32 -0400 From: Kevin Wolf Date: Fri, 27 Jun 2014 21:08:35 +0200 Message-Id: <1403896146-3063-17-git-send-email-kwolf@redhat.com> In-Reply-To: <1403896146-3063-1-git-send-email-kwolf@redhat.com> References: <1403896146-3063-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 16/47] qemu_opts_append: Play nicely with QemuOptsList's head List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com From: Michal Privoznik When running a libvirt test suite I've noticed the qemu-img is crashing occasionally. Tracing the problem down led me to the following valgrind output: qemu.git $ valgrind -q ./qemu-img create -f qed -obacking_file=/dev/null,backing_fmt=raw qed ==14881== Invalid write of size 8 ==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692) ==14881== by 0x130782: bdrv_img_create (block.c:5531) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' cluster_size=65536 ==14881== Invalid write of size 8 ==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750) ==14881== by 0x130BF3: bdrv_img_create (block.c:5638) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== The problem is apparently in the qemu_opts_append(). Well, if it gets called twice or more. On the first call, when @dst is NULL some initialization is done during which @dst->head list gets initialized. The list is initialized in a way, so that the list tail points at the list head. However, the next time qemu_opts_append() is called for new options to be added, g_realloc() may move @dst to a new address making the old list tail point at an invalid address. If that's the case, we must update the list pointers. Signed-off-by: Michal Privoznik Reviewed-by: Eric Blake Signed-off-by: Kevin Wolf --- util/qemu-option.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/util/qemu-option.c b/util/qemu-option.c index 43de3ad..6dc27ce 100644 --- a/util/qemu-option.c +++ b/util/qemu-option.c @@ -1111,6 +1111,7 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, size_t num_opts, num_dst_opts; QemuOptDesc *desc; bool need_init = false; + bool need_head_update; if (!list) { return dst; @@ -1121,6 +1122,12 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, */ if (!dst) { need_init = true; + need_head_update = true; + } else { + /* Moreover, even if dst is not NULL, the realloc may move it to a + * different address in which case we may get a stale tail pointer + * in dst->head. */ + need_head_update = QTAILQ_EMPTY(&dst->head); } num_opts = count_opts_list(dst); @@ -1131,9 +1138,11 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst, if (need_init) { dst->name = NULL; dst->implied_opt_name = NULL; - QTAILQ_INIT(&dst->head); dst->merge_lists = false; } + if (need_head_update) { + QTAILQ_INIT(&dst->head); + } dst->desc[num_dst_opts].name = NULL; /* append list->desc to dst->desc */ -- 1.8.3.1