block: Fix multiwrite error handling

Submitted by Kevin Wolf on April 1, 2010, 8:48 p.m.

Details

Message ID 1270154924-10400-1-git-send-email-kwolf@redhat.com
State New
Headers show

Commit Message

Kevin Wolf April 1, 2010, 8:48 p.m.
When two requests of the same multiwrite batch fail, the callback of all
requests in that batch were called twice. This could have any kind of nasty
effects, in my case it lead to use after free and eventually a segfault.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Comments

Aurelien Jarno April 9, 2010, 10:14 p.m.
On Thu, Apr 01, 2010 at 10:48:44PM +0200, Kevin Wolf wrote:
> When two requests of the same multiwrite batch fail, the callback of all
> requests in that batch were called twice. This could have any kind of nasty
> effects, in my case it lead to use after free and eventually a segfault.
> 
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Thanks, applied.

> ---
>  block.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/block.c b/block.c
> index 31610af..1c36e91 100644
> --- a/block.c
> +++ b/block.c
> @@ -1734,7 +1734,7 @@ static void multiwrite_cb(void *opaque, int ret)
>  {
>      MultiwriteCB *mcb = opaque;
>  
> -    if (ret < 0) {
> +    if (ret < 0 && !mcb->error) {
>          mcb->error = ret;
>          multiwrite_user_cb(mcb);
>      }
> -- 
> 1.6.6.1
> 
> 
> 
>

Patch hide | download patch | download mbox

diff --git a/block.c b/block.c
index 31610af..1c36e91 100644
--- a/block.c
+++ b/block.c
@@ -1734,7 +1734,7 @@  static void multiwrite_cb(void *opaque, int ret)
 {
     MultiwriteCB *mcb = opaque;
 
-    if (ret < 0) {
+    if (ret < 0 && !mcb->error) {
         mcb->error = ret;
         multiwrite_user_cb(mcb);
     }