From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38285) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c4At9-00063Y-2H for qemu-devel@nongnu.org; Tue, 08 Nov 2016 13:12:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c4At8-0000YY-81 for qemu-devel@nongnu.org; Tue, 08 Nov 2016 13:12:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:53152) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c4At8-0000YP-2N for qemu-devel@nongnu.org; Tue, 08 Nov 2016 13:12:50 -0500 From: Stefan Hajnoczi Date: Tue, 8 Nov 2016 18:12:41 +0000 Message-Id: <1478628762-31050-3-git-send-email-stefanha@redhat.com> In-Reply-To: <1478628762-31050-1-git-send-email-stefanha@redhat.com> References: <1478628762-31050-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL 2/3] aio-posix: avoid NULL pointer dereference in aio_epoll_update List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Paolo Bonzini , Stefan Hajnoczi From: Paolo Bonzini aio_epoll_update dereferences parameter "node", but it could have been NULL if deleting an fd handler that was not registered in the first place. Signed-off-by: Paolo Bonzini Reviewed-by: Fam Zheng Message-id: 20161108135524.25927-2-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi --- aio-posix.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/aio-posix.c b/aio-posix.c index 4ef34dd..304b016 100644 --- a/aio-posix.c +++ b/aio-posix.c @@ -217,21 +217,23 @@ void aio_set_fd_handler(AioContext *ctx, /* Are we deleting the fd handler? */ if (!io_read && !io_write) { - if (node) { - g_source_remove_poll(&ctx->source, &node->pfd); + if (node == NULL) { + return; + } - /* If the lock is held, just mark the node as deleted */ - if (ctx->walking_handlers) { - node->deleted = 1; - node->pfd.revents = 0; - } else { - /* Otherwise, delete it for real. We can't just mark it as - * deleted because deleted nodes are only cleaned up after - * releasing the walking_handlers lock. - */ - QLIST_REMOVE(node, node); - deleted = true; - } + g_source_remove_poll(&ctx->source, &node->pfd); + + /* If the lock is held, just mark the node as deleted */ + if (ctx->walking_handlers) { + node->deleted = 1; + node->pfd.revents = 0; + } else { + /* Otherwise, delete it for real. We can't just mark it as + * deleted because deleted nodes are only cleaned up after + * releasing the walking_handlers lock. + */ + QLIST_REMOVE(node, node); + deleted = true; } } else { if (node == NULL) { -- 2.7.4