[Qemu-devel] [PATCH] curl: Don't deref NULL pointer in call to aio_poll.

[Qemu-devel] [PATCH] curl: Don't deref NULL pointer in call to aio_poll.

[Richard W.M. Jones]

The original code in block/curl.c dereferences state *after* checking
that it is NULL.  That's obviously wrong, and indeed I can easily
provoke a segfault when talking to a VMware vCenter server.

I'm not as sure that this fix is the correct one, so please review it
carefully.  However it does at least fix the above segfault.

Rich.

[Qemu-devel] [PATCH] curl: Don't deref NULL pointer in call to aio_poll.

[Richard W.M. Jones]

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
---
 block/curl.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index 46f1082..8b69f28 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -355,7 +355,7 @@ static void curl_multi_timeout_do(void *arg)
 #endif
 }
 
-static CURLState *curl_init_state(BDRVCURLState *s)
+static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
 {
     CURLState *state = NULL;
     int i, j;
@@ -373,7 +373,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
             break;
         }
         if (!state) {
-            aio_poll(state->s->aio_context, true);
+            aio_poll(bdrv_get_aio_context(bs), true);
         }
     } while(!state);
 
@@ -552,7 +552,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     DPRINTF("CURL: Opening %s\n", file);
     s->aio_context = bdrv_get_aio_context(bs);
     s->url = g_strdup(file);
-    state = curl_init_state(s);
+    state = curl_init_state(bs, s);
     if (!state)
         goto out_noclean;
 
@@ -636,7 +636,7 @@ static void curl_readv_bh_cb(void *p)
     }
 
     // No cache found, so let's start a new request
-    state = curl_init_state(s);
+    state = curl_init_state(acb->common.bs, s);
     if (!state) {
         acb->common.cb(acb->common.opaque, -EIO);
         qemu_aio_release(acb);
-- 
2.0.4

Re: [Qemu-devel] [PATCH] curl: Don't deref NULL pointer in call to aio_poll.

[Paolo Bonzini]

Il 27/08/2014 19:31, Richard W.M. Jones ha scritto:
> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
> ---
>  block/curl.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/block/curl.c b/block/curl.c
> index 46f1082..8b69f28 100644
> --- a/block/curl.c
> +++ b/block/curl.c
> @@ -355,7 +355,7 @@ static void curl_multi_timeout_do(void *arg)
>  #endif
>  }
>  
> -static CURLState *curl_init_state(BDRVCURLState *s)
> +static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
>  {
>      CURLState *state = NULL;
>      int i, j;
> @@ -373,7 +373,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
>              break;
>          }
>          if (!state) {
> -            aio_poll(state->s->aio_context, true);
> +            aio_poll(bdrv_get_aio_context(bs), true);
>          }
>      } while(!state);
>  
> @@ -552,7 +552,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
>      DPRINTF("CURL: Opening %s\n", file);
>      s->aio_context = bdrv_get_aio_context(bs);
>      s->url = g_strdup(file);
> -    state = curl_init_state(s);
> +    state = curl_init_state(bs, s);
>      if (!state)
>          goto out_noclean;
>  
> @@ -636,7 +636,7 @@ static void curl_readv_bh_cb(void *p)
>      }
>  
>      // No cache found, so let's start a new request
> -    state = curl_init_state(s);
> +    state = curl_init_state(acb->common.bs, s);
>      if (!state) {
>          acb->common.cb(acb->common.opaque, -EIO);
>          qemu_aio_release(acb);
> 

This looks good, thanks.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

Re: [Qemu-devel] [PATCH] curl: Don't deref NULL pointer in call to aio_poll.

[Fam Zheng]

On Wed, 08/27 18:31, Richard W.M. Jones wrote:
> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>

It would be better to add the cover letter explanation as the commit message of
the patch too.

> ---
>  block/curl.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/block/curl.c b/block/curl.c
> index 46f1082..8b69f28 100644
> --- a/block/curl.c
> +++ b/block/curl.c
> @@ -355,7 +355,7 @@ static void curl_multi_timeout_do(void *arg)
>  #endif
>  }
>  
> -static CURLState *curl_init_state(BDRVCURLState *s)
> +static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
>  {
>      CURLState *state = NULL;
>      int i, j;
> @@ -373,7 +373,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
>              break;
>          }
>          if (!state) {
> -            aio_poll(state->s->aio_context, true);
> +            aio_poll(bdrv_get_aio_context(bs), true);
>          }
>      } while(!state);
>  
> @@ -552,7 +552,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
>      DPRINTF("CURL: Opening %s\n", file);
>      s->aio_context = bdrv_get_aio_context(bs);
>      s->url = g_strdup(file);
> -    state = curl_init_state(s);
> +    state = curl_init_state(bs, s);
>      if (!state)
>          goto out_noclean;
>  
> @@ -636,7 +636,7 @@ static void curl_readv_bh_cb(void *p)
>      }
>  
>      // No cache found, so let's start a new request
> -    state = curl_init_state(s);
> +    state = curl_init_state(acb->common.bs, s);
>      if (!state) {
>          acb->common.cb(acb->common.opaque, -EIO);
>          qemu_aio_release(acb);
> -- 
> 2.0.4
> 
>