From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47277) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNP58-0000GE-2a for qemu-devel@nongnu.org; Fri, 29 Aug 2014 12:31:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XNP52-00033X-W4 for qemu-devel@nongnu.org; Fri, 29 Aug 2014 12:31:22 -0400 Received: from mx1.redhat.com ([209.132.183.28]:23640) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XNP52-000338-MR for qemu-devel@nongnu.org; Fri, 29 Aug 2014 12:31:16 -0400 From: Stefan Hajnoczi Date: Fri, 29 Aug 2014 17:30:00 +0100 Message-Id: <1409329803-20744-33-git-send-email-stefanha@redhat.com> In-Reply-To: <1409329803-20744-1-git-send-email-stefanha@redhat.com> References: <1409329803-20744-1-git-send-email-stefanha@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PULL 32/35] curl: Don't deref NULL pointer in call to aio_poll. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , "Richard W.M. Jones" , Stefan Hajnoczi From: "Richard W.M. Jones" In commit 63f0f45f2e89b60ff8245fec81328ddfde42a303 the following mechanical change was made: if (!state) { - qemu_aio_wait(); + aio_poll(state->s->aio_context, true); } The new code now checks if state is NULL and then dereferences it ('state->s') which is obviously incorrect. This commit replaces state->s->aio_context with bdrv_get_aio_context(bs), fixing this problem. The two other hunks are concerned with getting the BlockDriverState pointer bs to where it is needed. The original bug causes a segfault when using libguestfs to access a VMware vCenter Server and doing any kind of complex read-heavy operations. With this commit the segfault goes away. Signed-off-by: Richard W.M. Jones Reviewed-by: Paolo Bonzini Reviewed-by: Beno=C3=AEt Canet Signed-off-by: Stefan Hajnoczi --- block/curl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/curl.c b/block/curl.c index 9051bc0..0258339 100644 --- a/block/curl.c +++ b/block/curl.c @@ -357,7 +357,7 @@ static void curl_multi_timeout_do(void *arg) #endif } =20 -static CURLState *curl_init_state(BDRVCURLState *s) +static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s= ) { CURLState *state =3D NULL; int i, j; @@ -375,7 +375,7 @@ static CURLState *curl_init_state(BDRVCURLState *s) break; } if (!state) { - aio_poll(state->s->aio_context, true); + aio_poll(bdrv_get_aio_context(bs), true); } } while(!state); =20 @@ -566,7 +566,7 @@ static int curl_open(BlockDriverState *bs, QDict *opt= ions, int flags, DPRINTF("CURL: Opening %s\n", file); s->aio_context =3D bdrv_get_aio_context(bs); s->url =3D g_strdup(file); - state =3D curl_init_state(s); + state =3D curl_init_state(bs, s); if (!state) goto out_noclean; =20 @@ -651,7 +651,7 @@ static void curl_readv_bh_cb(void *p) } =20 // No cache found, so let's start a new request - state =3D curl_init_state(s); + state =3D curl_init_state(acb->common.bs, s); if (!state) { acb->common.cb(acb->common.opaque, -EIO); qemu_aio_release(acb); --=20 1.9.3