From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45180) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c3gJE-0001Xn-H0 for qemu-devel@nongnu.org; Mon, 07 Nov 2016 04:33:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c3gJD-0000DW-Om for qemu-devel@nongnu.org; Mon, 07 Nov 2016 04:33:44 -0500 From: Paolo Bonzini Date: Mon, 7 Nov 2016 10:33:33 +0100 Message-Id: <1478511214-31045-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1478511214-31045-1-git-send-email-pbonzini@redhat.com> References: <1478511214-31045-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 1/2] aio-posix: avoid NULL pointer dereference in aio_epoll_update List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-block@nongnu.org, famz@redhat.com, kwolf@redhat.com aio_epoll_update dereferences parameter "node", but it could have been NULL if deleting an fd handler that was not registered in the first place. Signed-off-by: Paolo Bonzini --- aio-posix.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/aio-posix.c b/aio-posix.c index 4ef34dd..ec908f7 100644 --- a/aio-posix.c +++ b/aio-posix.c @@ -217,21 +217,24 @@ void aio_set_fd_handler(AioContext *ctx, /* Are we deleting the fd handler? */ if (!io_read && !io_write) { - if (node) { - g_source_remove_poll(&ctx->source, &node->pfd); - - /* If the lock is held, just mark the node as deleted */ - if (ctx->walking_handlers) { - node->deleted = 1; - node->pfd.revents = 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the walking_handlers lock. - */ - QLIST_REMOVE(node, node); - deleted = true; - } + if (node == NULL) { + return; + } + + node->pfd.events = 0; + g_source_remove_poll(&ctx->source, &node->pfd); + + /* If the lock is held, just mark the node as deleted */ + if (ctx->walking_handlers) { + node->deleted = 1; + node->pfd.revents = 0; + } else { + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up after + * releasing the walking_handlers lock. + */ + QLIST_REMOVE(node, node); + deleted = true; } } else { if (node == NULL) { -- 2.7.4