[Qemu-devel] [PATCH] Don't allow multiwrites against a block device without underlying medium

[Qemu-devel] [PATCH] Don't allow multiwrites against a block device without underlying medium

[Ryan Harper]

If the block device has been closed, we no longer have a medium to submit
IO against, check for this before submitting io.  This prevents a segfault
further in the code where we dereference elements of the block driver.

Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
---
 block.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/block.c b/block.c
index 92dd3fe..534e1bc 100644
--- a/block.c
+++ b/block.c
@@ -2407,6 +2407,11 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
         return 0;
     }
 
+    /* don't submit writes if we don't have a medium */
+    if (bs->drv == NULL) {
+       return -1;
+    }
+
     // Create MultiwriteCB structure
     mcb = qemu_mallocz(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
     mcb->num_requests = 0;
-- 
1.7.1


-- 
Ryan Harper
Software Engineer; Linux Technology Center
IBM Corp., Austin, Tx
ryanh@us.ibm.com

Re: [Qemu-devel] [PATCH] Don't allow multiwrites against a block device without underlying medium

[Stefan Hajnoczi]

On Wed, Mar 2, 2011 at 3:04 PM, Ryan Harper <ryanh@us.ibm.com> wrote:
> If the block device has been closed, we no longer have a medium to submit
> IO against, check for this before submitting io.  This prevents a segfault
> further in the code where we dereference elements of the block driver.
>
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
> ---
>  block.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/block.c b/block.c
> index 92dd3fe..534e1bc 100644
> --- a/block.c
> +++ b/block.c
> @@ -2407,6 +2407,11 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
>         return 0;
>     }
>
> +    /* don't submit writes if we don't have a medium */
> +    if (bs->drv == NULL) {
> +       return -1;
> +    }
> +

Most other bdrv_*() calls will error out immediately if !bs->drv.
Here you check only after returning success for num_reqs == 0.  I
don't think it makes a huge difference and can see how these semantics
are handy (saves caller checking for num_reqs == 0), but I wanted to
point it out.

More importantly, we're not obeying the contract of this function
here.  reqs[].error must be set to -ENOMEDIUM before returning -1.
Otherwise the caller thinks that reqs[] callbacks will still be
invoked in the future and cannot complete those requests.

Stefan