[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 32/35] curl: Don't deref NULL pointer in call to aio_
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL 32/35] curl: Don't deref NULL pointer in call to aio_poll. |
Date: |
Fri, 29 Aug 2014 17:30:00 +0100 |
From: "Richard W.M. Jones" <address@hidden>
In commit 63f0f45f2e89b60ff8245fec81328ddfde42a303 the following
mechanical change was made:
if (!state) {
- qemu_aio_wait();
+ aio_poll(state->s->aio_context, true);
}
The new code now checks if state is NULL and then dereferences it
('state->s') which is obviously incorrect.
This commit replaces state->s->aio_context with
bdrv_get_aio_context(bs), fixing this problem. The two other hunks
are concerned with getting the BlockDriverState pointer bs to where it
is needed.
The original bug causes a segfault when using libguestfs to access a
VMware vCenter Server and doing any kind of complex read-heavy
operations. With this commit the segfault goes away.
Signed-off-by: Richard W.M. Jones <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Reviewed-by: BenoƮt Canet <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
block/curl.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/block/curl.c b/block/curl.c
index 9051bc0..0258339 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -357,7 +357,7 @@ static void curl_multi_timeout_do(void *arg)
#endif
}
-static CURLState *curl_init_state(BDRVCURLState *s)
+static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
{
CURLState *state = NULL;
int i, j;
@@ -375,7 +375,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
break;
}
if (!state) {
- aio_poll(state->s->aio_context, true);
+ aio_poll(bdrv_get_aio_context(bs), true);
}
} while(!state);
@@ -566,7 +566,7 @@ static int curl_open(BlockDriverState *bs, QDict *options,
int flags,
DPRINTF("CURL: Opening %s\n", file);
s->aio_context = bdrv_get_aio_context(bs);
s->url = g_strdup(file);
- state = curl_init_state(s);
+ state = curl_init_state(bs, s);
if (!state)
goto out_noclean;
@@ -651,7 +651,7 @@ static void curl_readv_bh_cb(void *p)
}
// No cache found, so let's start a new request
- state = curl_init_state(s);
+ state = curl_init_state(acb->common.bs, s);
if (!state) {
acb->common.cb(acb->common.opaque, -EIO);
qemu_aio_release(acb);
--
1.9.3
- [Qemu-devel] [PULL 22/35] sheepdog: fix a core dump while do auto-reconnecting, (continued)
- [Qemu-devel] [PULL 22/35] sheepdog: fix a core dump while do auto-reconnecting, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 21/35] aio-win32: add support for sockets, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 23/35] nbd: Drop nbd_can_read(), Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 24/35] block: Add AIO context notifiers, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 26/35] block: fix overlapping multiwrite requests, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 27/35] qemu-iotests: add multiwrite test cases, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 25/35] nbd: Follow the BDS' AIO context, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 29/35] block: acquire AioContext in do_drive_del(), Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 28/35] linux-aio: avoid deadlock in nested aio_poll() calls, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 30/35] virtio-blk: allow drive_del with dataplane, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 32/35] curl: Don't deref NULL pointer in call to aio_poll.,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL 33/35] nfs: Fix leak of opts in nfs_file_open, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 31/35] curl: Allow a cookie or cookies to be sent with http/https requests., Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 34/35] blkverify: Fix leak of opts in blkverify_open, Stefan Hajnoczi, 2014/08/29
- [Qemu-devel] [PULL 35/35] quorum: Fix leak of opts in quorum_open, Stefan Hajnoczi, 2014/08/29