[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v3 3/8] block: Null pointer dereference in blk_r
From: |
Max Reitz |
Subject: |
Re: [Qemu-devel] [PATCH v3 3/8] block: Null pointer dereference in blk_root_get_parent_desc() |
Date: |
Fri, 12 Oct 2018 16:48:23 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.0 |
Hi,
On 31.08.18 20:16, Liam Merwick wrote:
> The dev_id returned by the call to blk_get_attached_dev_id() in
> blk_root_get_parent_desc() can be NULL (an internal call to
> object_get_canonical_path may have returned NULL) so it should
> be checked before dereferencing.
>
> Signed-off-by: Liam Merwick <address@hidden>
> Reviewed-by: Darren Kenny <address@hidden>
> Reviewed-by: Mark Kanda <address@hidden>
> ---
> block/block-backend.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/block-backend.c b/block/block-backend.c
> index fa120630be83..210eee75006a 100644
> --- a/block/block-backend.c
> +++ b/block/block-backend.c
> @@ -136,7 +136,7 @@ static char *blk_root_get_parent_desc(BdrvChild *child)
> }
>
> dev_id = blk_get_attached_dev_id(blk);
> - if (*dev_id) {
> + if (dev_id && *dev_id) {
> return dev_id;
I rather think that blk_get_attached_dev_id() needs attention first. It
returns an explicitly empty string if blk->dev is NULL. If NULL was a
valid return value, it should just return NULL there.
Besides this caller, there are two callers that pass the dev_id to
qapi_event_send_device_tray_moved(). Now in practice that allows the
string to be NULL, but there is a comment in visit_type_str() that says
one should not pass NULL.
So it's either changing blk_get_attached_dev_id() to return NULL when
there is no valid ID (instead of the empty string, and then we could
save ourselves the check "*dev_id" here and elsewhere), but then we have
to fix all callers.
Or we make it return an empty string if object_get_canonical_path()
returned NULL.
Max
> } else {
> /* TODO Callback into the BB owner for something more detailed */
>
signature.asc
Description: OpenPGP digital signature
- Re: [Qemu-devel] [PATCH v3 3/8] block: Null pointer dereference in blk_root_get_parent_desc(),
Max Reitz <=