[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 15/32] block/mirror: fix NULL pointer dereference in mirror_wait_o
From: |
Hanna Reitz |
Subject: |
[PULL 15/32] block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts() |
Date: |
Wed, 15 Sep 2021 19:53:01 +0200 |
From: Stefano Garzarella <sgarzare@redhat.com>
In mirror_iteration() we call mirror_wait_on_conflicts() with
`self` parameter set to NULL.
Starting from commit d44dae1a7c we dereference `self` pointer in
mirror_wait_on_conflicts() without checks if it is not NULL.
Backtrace:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized
out>, bytes=<optimized out>)
at ../block/mirror.c:172
172 self->waiting_for_op = op;
[Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))]
(gdb) bt
#0 mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized
out>, bytes=<optimized out>)
at ../block/mirror.c:172
#1 0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=<optimized
out>) at ../block/mirror.c:491
#2 0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917
#3 0x00005610c5f046c6 in coroutine_trampoline (i0=<optimized out>,
i1=<optimized out>)
at ../util/coroutine-ucontext.c:173
#4 0x00007f0909975820 in ?? () at
../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91
from /usr/lib64/libc.so.6
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404
Fixes: d44dae1a7c ("block/mirror: fix active mirror dead-lock in
mirror_wait_on_conflicts")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20210910124533.288318-1-sgarzare@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
block/mirror.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/block/mirror.c b/block/mirror.c
index 98fc66eabf..85b781bc21 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -160,18 +160,25 @@ static void coroutine_fn
mirror_wait_on_conflicts(MirrorOp *self,
if (ranges_overlap(self_start_chunk, self_nb_chunks,
op_start_chunk, op_nb_chunks))
{
- /*
- * If the operation is already (indirectly) waiting for us, or
- * will wait for us as soon as it wakes up, then just go on
- * (instead of producing a deadlock in the former case).
- */
- if (op->waiting_for_op) {
- continue;
+ if (self) {
+ /*
+ * If the operation is already (indirectly) waiting for us,
+ * or will wait for us as soon as it wakes up, then just go
+ * on (instead of producing a deadlock in the former case).
+ */
+ if (op->waiting_for_op) {
+ continue;
+ }
+
+ self->waiting_for_op = op;
}
- self->waiting_for_op = op;
qemu_co_queue_wait(&op->waiting_requests, NULL);
- self->waiting_for_op = NULL;
+
+ if (self) {
+ self->waiting_for_op = NULL;
+ }
+
break;
}
}
--
2.31.1
- [PULL 00/32] Block patches, Hanna Reitz, 2021/09/15
- [PULL 01/32] gluster: Align block-status tail, Hanna Reitz, 2021/09/15
- [PULL 02/32] block: Drop BDS comment regarding bdrv_append(), Hanna Reitz, 2021/09/15
- [PULL 03/32] block: block-status cache for data regions, Hanna Reitz, 2021/09/15
- [PULL 05/32] block/file-posix: Do not force-cap *pnum, Hanna Reitz, 2021/09/15
- [PULL 04/32] block: Clarify that @bytes is no limit on *pnum, Hanna Reitz, 2021/09/15
- [PULL 07/32] block/iscsi: Do not force-cap *pnum, Hanna Reitz, 2021/09/15
- [PULL 06/32] block/gluster: Do not force-cap *pnum, Hanna Reitz, 2021/09/15
- [PULL 13/32] mirror-top-perms: Fix AbnormalShutdown path, Hanna Reitz, 2021/09/15
- [PULL 10/32] iotests/297: Drop 169 and 199 from the skip list, Hanna Reitz, 2021/09/15
- [PULL 15/32] block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts(),
Hanna Reitz <=
- [PULL 17/32] block: bdrv_inactivate_recurse(): check for permissions and fix crash, Hanna Reitz, 2021/09/15
- [PULL 09/32] iotests: Fix use-{list,dict}-literal warnings, Hanna Reitz, 2021/09/15
- [PULL 11/32] migrate-bitmaps-postcopy-test: Fix pylint warnings, Hanna Reitz, 2021/09/15
- [PULL 12/32] migrate-bitmaps-test: Fix pylint warnings, Hanna Reitz, 2021/09/15
- [PULL 16/32] tests: add migrate-during-backup, Hanna Reitz, 2021/09/15
- [PULL 14/32] iotests/297: Cover tests/, Hanna Reitz, 2021/09/15
- [PULL 08/32] iotests: Fix unspecified-encoding pylint warnings, Hanna Reitz, 2021/09/15
- [PULL 19/32] qcow2: refactor handle_dependencies() loop body, Hanna Reitz, 2021/09/15
- [PULL 18/32] simplebench: add img_bench_templater.py, Hanna Reitz, 2021/09/15
- [PULL 21/32] qemu-img: Allow target be aligned to sector size, Hanna Reitz, 2021/09/15