Message ID | 53F1E842.60009@msgid.tls.msk.ru |
---|---|
State | New |
Headers | show |
On Mon, Aug 18, 2014 at 03:49:22PM +0400, Michael Tokarev wrote: > 14.08.2014 11:29, zhanghailiang wrote: > > In function virtio_blk_handle_request, it may freed memory pointed by req, > > So do not access member of req after calling this function. > > > > Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> > > Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> > > --- > > hw/block/virtio-blk.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c > > index c241c50..54a853a 100644 > > --- a/hw/block/virtio-blk.c > > +++ b/hw/block/virtio-blk.c > > @@ -458,7 +458,7 @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq) > > static void virtio_blk_dma_restart_bh(void *opaque) > > { > > VirtIOBlock *s = opaque; > > - VirtIOBlockReq *req = s->rq; > > + VirtIOBlockReq *req = s->rq, *next = NULL; > > MultiReqBuffer mrb = { > > .num_writes = 0, > > }; > > @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque) > > s->rq = NULL; > > > > while (req) { > > + next = req->next; > > virtio_blk_handle_request(req, &mrb); > > - req = req->next; > > + req = next; > > } > > > > virtio_submit_multiwrite(s->bs, &mrb); > > So, finally, I've applied this patch: > > --- a/hw/block/virtio-blk.c > +++ b/hw/block/virtio-blk.c > @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque) > s->rq = NULL; > > while (req) { > + VirtIOBlockReq *next = req->next; > virtio_blk_handle_request(req, &mrb); > - req = req->next; > + req = next; > } > > virtio_submit_multiwrite(s->bs, &mrb); > > and dropped Stefan's Reviewed-by on the way ;) > > This is a bugfix after all ;) > > Thanks, > > /mjt By the way, could you please add Cc qemu-stable on bugfixes you have queued? These are likely appopriate for 2.1.1.
19.08.2014 00:17, Michael S. Tsirkin wrote: [] > By the way, could you please add Cc qemu-stable on bugfixes > you have queued? > These are likely appopriate for 2.1.1. Actually I've added Cc: qemu-stable@ in the commit message. So it will go to stable (or should) once I'll send a pull request. Thanks, /mjt
--- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque) s->rq = NULL; while (req) { + VirtIOBlockReq *next = req->next; virtio_blk_handle_request(req, &mrb); - req = req->next; + req = next; } virtio_submit_multiwrite(s->bs, &mrb);