Re: [PULL 03/19] monitor: hmp_qemu_io: acquire aio contex, fix crash

[Peter Maydell]

On Fri, 14 May 2021 at 17:45, Max Reitz <mreitz@redhat.com> wrote:
>
> From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Hi; Coverity complains about this code (CID 1453194):

> diff --git a/qemu-io.c b/qemu-io.c
> index bf902302e9..57f07501df 100644
> --- a/qemu-io.c
> +++ b/qemu-io.c
> @@ -411,6 +411,19 @@ static void prep_fetchline(void *opaque)
>      *fetchable= 1;
>  }
>
> +static int do_qemuio_command(const char *cmd)
> +{
> +    int ret;
> +    AioContext *ctx =
> +        qemuio_blk ? blk_get_aio_context(qemuio_blk) : 
> qemu_get_aio_context();

Here we check whether qemuio_blk is NULL...

> +
> +    aio_context_acquire(ctx);
> +    ret = qemuio_command(qemuio_blk, cmd);

...but here we pass it to qemuio_command(), which assumes it must
be non-NULL (via calling command() which calls blk_is_available()).

Bug, or false positive ?

thanks
-- PMM