From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49704) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XMuhE-0002bk-SB for qemu-devel@nongnu.org; Thu, 28 Aug 2014 04:04:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XMuh4-0001yk-GU for qemu-devel@nongnu.org; Thu, 28 Aug 2014 04:04:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:12628) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XMuh4-0001yX-9O for qemu-devel@nongnu.org; Thu, 28 Aug 2014 04:04:30 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s7S84SZg003882 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 28 Aug 2014 04:04:28 -0400 From: "Richard W.M. Jones" Date: Thu, 28 Aug 2014 09:04:21 +0100 Message-Id: <1409213061-15562-2-git-send-email-rjones@redhat.com> In-Reply-To: <1409213061-15562-1-git-send-email-rjones@redhat.com> References: <1409213061-15562-1-git-send-email-rjones@redhat.com> Subject: [Qemu-devel] [PATCH v2] curl: Don't deref NULL pointer in call to aio_poll. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, famz@redhat.com, stefanha@redhat.com In commit 63f0f45f2e89b60ff8245fec81328ddfde42a303 the following mechanical change was made: if (!state) { - qemu_aio_wait(); + aio_poll(state->s->aio_context, true); } The new code now checks if state is NULL and then dereferences it ('state->s') which is obviously incorrect. This commit replaces state->s->aio_context with bdrv_get_aio_context(bs), fixing this problem. The two other hunks are concerned with getting the BlockDriverState pointer bs to where it is needed. The original bug causes a segfault when using libguestfs to access a VMware vCenter Server and doing any kind of complex read-heavy operations. With this commit the segfault goes away. Signed-off-by: Richard W.M. Jones Reviewed-by: Paolo Bonzini --- block/curl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/curl.c b/block/curl.c index d4b85d2..f59615d 100644 --- a/block/curl.c +++ b/block/curl.c @@ -352,7 +352,7 @@ static void curl_multi_timeout_do(void *arg) #endif } -static CURLState *curl_init_state(BDRVCURLState *s) +static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s) { CURLState *state = NULL; int i, j; @@ -370,7 +370,7 @@ static CURLState *curl_init_state(BDRVCURLState *s) break; } if (!state) { - aio_poll(state->s->aio_context, true); + aio_poll(bdrv_get_aio_context(bs), true); } } while(!state); @@ -541,7 +541,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags, DPRINTF("CURL: Opening %s\n", file); s->aio_context = bdrv_get_aio_context(bs); s->url = g_strdup(file); - state = curl_init_state(s); + state = curl_init_state(bs, s); if (!state) goto out_noclean; @@ -625,7 +625,7 @@ static void curl_readv_bh_cb(void *p) } // No cache found, so let's start a new request - state = curl_init_state(s); + state = curl_init_state(acb->common.bs, s); if (!state) { acb->common.cb(acb->common.opaque, -EIO); qemu_aio_release(acb); -- 2.0.4