* [Qemu-devel] [PATCH] blockdev: check dinfo ptr before using
@ 2010-12-08 16:05 Ryan Harper
2010-12-08 18:36 ` [Qemu-devel] " Luiz Capitulino
2010-12-10 15:05 ` Kevin Wolf
0 siblings, 2 replies; 3+ messages in thread
From: Ryan Harper @ 2010-12-08 16:05 UTC (permalink / raw)
To: qemu-devel; +Cc: Kevin Wolf, Markus Armbruster, Luiz Capitulino
If a user decides to punish a guest by revoking its block device via
drive_del, and subsequently also attempts to remove the pci device
backing it, and the device is using blockdev_auto_del() then we get a
segfault when we attempt to access dinfo->auto_del.[1]
The fix is to check if drive_get_by_blockdev() actually returns a valid
dinfo pointer or not.
1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
(qemu) drive_del block1
(qemu) pci_del 5
*segfault*
Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
--
Ryan Harper
Software Engineer; Linux Technology Center
IBM Corp., Austin, Tx
ryanh@us.ibm.com
diff --git a/blockdev.c b/blockdev.c
index f6ac439..3b3b82d 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -30,14 +30,16 @@ void blockdev_mark_auto_del(BlockDriverState *bs)
{
DriveInfo *dinfo = drive_get_by_blockdev(bs);
- dinfo->auto_del = 1;
+ if (dinfo) {
+ dinfo->auto_del = 1;
+ }
}
void blockdev_auto_del(BlockDriverState *bs)
{
DriveInfo *dinfo = drive_get_by_blockdev(bs);
- if (dinfo->auto_del) {
+ if (dinfo && dinfo->auto_del) {
drive_uninit(dinfo);
}
}
^ permalink raw reply related [flat|nested] 3+ messages in thread* [Qemu-devel] Re: [PATCH] blockdev: check dinfo ptr before using
2010-12-08 16:05 [Qemu-devel] [PATCH] blockdev: check dinfo ptr before using Ryan Harper
@ 2010-12-08 18:36 ` Luiz Capitulino
2010-12-10 15:05 ` Kevin Wolf
1 sibling, 0 replies; 3+ messages in thread
From: Luiz Capitulino @ 2010-12-08 18:36 UTC (permalink / raw)
To: Ryan Harper; +Cc: Kevin Wolf, qemu-devel, Markus Armbruster
On Wed, 8 Dec 2010 10:05:00 -0600
Ryan Harper <ryanh@us.ibm.com> wrote:
> If a user decides to punish a guest by revoking its block device via
> drive_del, and subsequently also attempts to remove the pci device
> backing it, and the device is using blockdev_auto_del() then we get a
> segfault when we attempt to access dinfo->auto_del.[1]
>
> The fix is to check if drive_get_by_blockdev() actually returns a valid
> dinfo pointer or not.
>
> 1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
> (qemu) drive_del block1
> (qemu) pci_del 5
> *segfault*
>
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
Fixes my test case:
Tested-by: Luiz Capitulino <lcapitulino@redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Qemu-devel] Re: [PATCH] blockdev: check dinfo ptr before using
2010-12-08 16:05 [Qemu-devel] [PATCH] blockdev: check dinfo ptr before using Ryan Harper
2010-12-08 18:36 ` [Qemu-devel] " Luiz Capitulino
@ 2010-12-10 15:05 ` Kevin Wolf
1 sibling, 0 replies; 3+ messages in thread
From: Kevin Wolf @ 2010-12-10 15:05 UTC (permalink / raw)
To: Ryan Harper; +Cc: Luiz Capitulino, qemu-devel, Markus Armbruster
Am 08.12.2010 17:05, schrieb Ryan Harper:
> If a user decides to punish a guest by revoking its block device via
> drive_del, and subsequently also attempts to remove the pci device
> backing it, and the device is using blockdev_auto_del() then we get a
> segfault when we attempt to access dinfo->auto_del.[1]
>
> The fix is to check if drive_get_by_blockdev() actually returns a valid
> dinfo pointer or not.
>
> 1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
> (qemu) drive_del block1
> (qemu) pci_del 5
> *segfault*
>
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
Thanks, applied to the block branch.
Kevin
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-12-10 15:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-12-08 16:05 [Qemu-devel] [PATCH] blockdev: check dinfo ptr before using Ryan Harper
2010-12-08 18:36 ` [Qemu-devel] " Luiz Capitulino
2010-12-10 15:05 ` Kevin Wolf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).