From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7DCA0C433FE for ; Tue, 22 Nov 2022 08:22:07 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oxOX6-0006wX-PU; Tue, 22 Nov 2022 03:21:32 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oxOX4-0006ua-PJ for qemu-devel@nongnu.org; Tue, 22 Nov 2022 03:21:30 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oxOX2-0005eX-4t for qemu-devel@nongnu.org; Tue, 22 Nov 2022 03:21:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1669105285; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=LJET6U1wvzfXGuglHfbp/kKovkU5+uMmgv+/Blod9m4=; b=Z5yo6oey0LNM9E5aYUx5X4hsHiwN097MU93bEO+NxakwYuk8S1uzOAhbY/nswzhO8YwY4x gPk/aKaBsZYmNbZglWV82YGM7ZvU48rXXG5pronsf/fnfOMHcubcuhtfyZb4KypODuTc/n yGGPFt4od76hx+OVkBgMdbQDAllyQqM= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-319-5IQzWneBN2qQZtxz1CQQCg-1; Tue, 22 Nov 2022 03:21:18 -0500 X-MC-Unique: 5IQzWneBN2qQZtxz1CQQCg-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A2539802D32; Tue, 22 Nov 2022 08:21:17 +0000 (UTC) Received: from redhat.com (unknown [10.39.192.218]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CB77140C6E16; Tue, 22 Nov 2022 08:21:16 +0000 (UTC) Date: Tue, 22 Nov 2022 09:21:13 +0100 From: Kevin Wolf To: Stefan Hajnoczi Cc: qemu-devel@nongnu.org, qemu-block@nongnu.org, Hanna Reitz , Jonathan Cameron Subject: Re: [PATCH for-7.2] block-backend: avoid bdrv_unregister_buf() NULL pointer deref Message-ID: References: <20221121211923.1993171-1-stefanha@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221121211923.1993171-1-stefanha@redhat.com> X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 Received-SPF: pass client-ip=170.10.129.124; envelope-from=kwolf@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Am 21.11.2022 um 22:19 hat Stefan Hajnoczi geschrieben: > bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL > leads to undefined behavior. > > Jonathan Cameron reported this following NULL pointer dereference when a > VM with a virtio-blk device and a memory-backend-file object is > terminated: > 1. qemu_cleanup() closes all drives, setting blk->root to NULL > 2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM > block notifier callback because the memory-backend-file is destroyed. > 3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar > notifier callback and undefined behavior occurs. > > Fixes: baf422684d73 ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint") > Co-authored-by: Jonathan Cameron > Signed-off-by: Stefan Hajnoczi Reviewed-by: Kevin Wolf This raises some questions, though. What happens if the graph isn't static between creation and deletion of the device? Do we need to do something with registered buffers when a node is attached to or detached from an existing device? Kevin