[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH 1/2] aio-posix: avoid NULL pointer dereference i
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-block] [PATCH 1/2] aio-posix: avoid NULL pointer dereference in aio_epoll_update |
Date: |
Mon, 7 Nov 2016 14:58:04 +0000 |
User-agent: |
Mutt/1.7.1 (2016-10-04) |
On Mon, Nov 07, 2016 at 10:33:33AM +0100, Paolo Bonzini wrote:
> aio_epoll_update dereferences parameter "node", but it could have been NULL
> if deleting an fd handler that was not registered in the first place.
>
> Signed-off-by: Paolo Bonzini <address@hidden>
> ---
> aio-posix.c | 33 ++++++++++++++++++---------------
> 1 file changed, 18 insertions(+), 15 deletions(-)
>
> diff --git a/aio-posix.c b/aio-posix.c
> index 4ef34dd..ec908f7 100644
> --- a/aio-posix.c
> +++ b/aio-posix.c
> @@ -217,21 +217,24 @@ void aio_set_fd_handler(AioContext *ctx,
>
> /* Are we deleting the fd handler? */
> if (!io_read && !io_write) {
> - if (node) {
> - g_source_remove_poll(&ctx->source, &node->pfd);
> -
> - /* If the lock is held, just mark the node as deleted */
> - if (ctx->walking_handlers) {
> - node->deleted = 1;
> - node->pfd.revents = 0;
> - } else {
> - /* Otherwise, delete it for real. We can't just mark it as
> - * deleted because deleted nodes are only cleaned up after
> - * releasing the walking_handlers lock.
> - */
> - QLIST_REMOVE(node, node);
> - deleted = true;
> - }
> + if (node == NULL) {
> + return;
> + }
> +
> + node->pfd.events = 0;
^--- is this left over from debugging...
> + g_source_remove_poll(&ctx->source, &node->pfd);
> +
> + /* If the lock is held, just mark the node as deleted */
> + if (ctx->walking_handlers) {
> + node->deleted = 1;
> + node->pfd.revents = 0;
...the original code clears revents here?
signature.asc
Description: PGP signature