From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33125) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dX8WI-0001af-M9 for qemu-devel@nongnu.org; Mon, 17 Jul 2017 12:05:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dX8WH-0004Kx-St for qemu-devel@nongnu.org; Mon, 17 Jul 2017 12:05:14 -0400 Date: Mon, 17 Jul 2017 18:05:03 +0200 From: Kevin Wolf Message-ID: <20170717160503.GL5301@noname.redhat.com> References: <20170717130130.29211-1-ppandit@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170717130130.29211-1-ppandit@redhat.com> Subject: Re: [Qemu-devel] [Qemu-block] [PATCH v1] ide: check BlockBackend object in ide_cancel_dma_sync List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P Cc: Qemu Developers , qemu-block@nongnu.org, Chensongnian , Prasad J Pandit Am 17.07.2017 um 15:01 hat P J P geschrieben: > From: Prasad J Pandit > > When cancelling pending DMA requests in ide_cancel_dma_sync, > the s->blk object could be null, leading to a null dereference. > Add check to avoid it. > > blk_bs (blk=0x0) at block/block-backend.c:389 > blk_drain (blk=0x0) at block/block-backend.c:1232 > ide_cancel_dma_sync (s=0x7f203241c1a8) at hw/ide/core.c:684 > bmdma_cmd_writeb (bm=0x7f203241cf20, val=104) at hw/ide/pci.c:237 > bmdma_write (opaque=0x7f203241cf20, addr=0, val=104, size=1) at hw/ide/piix.c:77 > > Reported-by: Chensongnian > Signed-off-by: Prasad J Pandit > --- > hw/ide/core.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > Update: add call stack trace leading the null dereference. I think Stefan didn't only mean a stack trace, but an actual instruction how to reproduce this. VM configuration, what actions to take, etc. In fact, I will add that we will probably want a qtest case as a regression test anyway, and tests are always great for describing how to reproduce a problem, too. Kevin