diff mbox

blockdev: check dinfo ptr before using

Message ID 20101208160500.GQ22381@us.ibm.com
State New
Headers show

Commit Message

Ryan Harper Dec. 8, 2010, 4:05 p.m. UTC 
If a user decides to punish a guest by revoking its block device via
drive_del, and subsequently also attempts to remove the pci device
backing it, and the device is using blockdev_auto_del() then we get a
segfault when we attempt to access dinfo->auto_del.[1]

The fix is to check if drive_get_by_blockdev() actually returns a valid
dinfo pointer or not.

1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
   (qemu) drive_del block1
   (qemu) pci_del 5
   *segfault*

Signed-off-by: Ryan Harper <ryanh@us.ibm.com>

Comments

Luiz Capitulino Dec. 8, 2010, 6:36 p.m. UTC | #1 
On Wed, 8 Dec 2010 10:05:00 -0600
Ryan Harper <ryanh@us.ibm.com> wrote:

> If a user decides to punish a guest by revoking its block device via
> drive_del, and subsequently also attempts to remove the pci device
> backing it, and the device is using blockdev_auto_del() then we get a
> segfault when we attempt to access dinfo->auto_del.[1]
> 
> The fix is to check if drive_get_by_blockdev() actually returns a valid
> dinfo pointer or not.
> 
> 1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
>    (qemu) drive_del block1
>    (qemu) pci_del 5
>    *segfault*
> 
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>

Fixes my test case:

Tested-by: Luiz Capitulino <lcapitulino@redhat.com>
Kevin Wolf Dec. 10, 2010, 3:05 p.m. UTC | #2 
Am 08.12.2010 17:05, schrieb Ryan Harper:
> If a user decides to punish a guest by revoking its block device via
> drive_del, and subsequently also attempts to remove the pci device
> backing it, and the device is using blockdev_auto_del() then we get a
> segfault when we attempt to access dinfo->auto_del.[1]
> 
> The fix is to check if drive_get_by_blockdev() actually returns a valid
> dinfo pointer or not.
> 
> 1. (qemu) pci_add auto storage file=images/test01.raw,if=virtio,id=block1,snapshot=on
>    (qemu) drive_del block1
>    (qemu) pci_del 5
>    *segfault*
> 
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>

Thanks, applied to the block branch.

Kevin
diff mbox

Patch

diff --git a/blockdev.c b/blockdev.c
index f6ac439..3b3b82d 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -30,14 +30,16 @@  void blockdev_mark_auto_del(BlockDriverState *bs)
 {
     DriveInfo *dinfo = drive_get_by_blockdev(bs);
 
-    dinfo->auto_del = 1;
+    if (dinfo) {
+        dinfo->auto_del = 1;
+    }
 }
 
 void blockdev_auto_del(BlockDriverState *bs)
 {
     DriveInfo *dinfo = drive_get_by_blockdev(bs);
 
-    if (dinfo->auto_del) {
+    if (dinfo && dinfo->auto_del) {
         drive_uninit(dinfo);
     }
 }