From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54783) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anNcy-0003V8-HY for qemu-devel@nongnu.org; Tue, 05 Apr 2016 05:50:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anNcx-00017Q-HY for qemu-devel@nongnu.org; Tue, 05 Apr 2016 05:50:28 -0400 Received: from mail-wm0-x22d.google.com ([2a00:1450:400c:c09::22d]:35227) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anNcx-00016g-7u for qemu-devel@nongnu.org; Tue, 05 Apr 2016 05:50:27 -0400 Received: by mail-wm0-x22d.google.com with SMTP id 191so18373805wmq.0 for ; Tue, 05 Apr 2016 02:50:27 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Tue, 5 Apr 2016 11:50:06 +0200 Message-Id: <1459849818-26649-4-git-send-email-pbonzini@redhat.com> In-Reply-To: <1459849818-26649-1-git-send-email-pbonzini@redhat.com> References: <1459849818-26649-1-git-send-email-pbonzini@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PULL 03/15] memory: fix segv on qemu_ram_free(block=0x0) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Paolo Bonzini From: Marc-André Lureau Since f1060c55bf1377b4, the pointer is directly passed to qemu_ram_free(). However, on initialization failure, it may be called with a NULL pointer. Return immediately in this case. This fixes a SEGV when memory initialization failed, for example permission denied on open backing store /dev/hugepages, with -object memory-backend-file,mem-path=/dev/hugepages. Program received signal SIGSEGV, Segmentation fault. 0x00005555556e67e7 in qemu_ram_free (block=0x0) at /home/elmarco/src/qemu/exec.c:1775 Signed-off-by: Marc-André Lureau Message-Id: <1459250451-29984-1-git-send-email-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini --- exec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/exec.c b/exec.c index f46e596..c4f9036 100644 --- a/exec.c +++ b/exec.c @@ -1773,6 +1773,10 @@ static void reclaim_ramblock(RAMBlock *block) void qemu_ram_free(RAMBlock *block) { + if (!block) { + return; + } + qemu_mutex_lock_ramlist(); QLIST_REMOVE_RCU(block, next); ram_list.mru_block = NULL; -- 2.5.5