Patchwork Don't allow multiwrites against a block device without underlying medium

login
register
mail settings
Submitter Ryan Harper
Date March 2, 2011, 3:04 p.m.
Message ID <20110302150422.GA13257@us.ibm.com>
Download mbox | patch
Permalink /patch/85093/
State New
Headers show

Comments

Ryan Harper - March 2, 2011, 3:04 p.m.
If the block device has been closed, we no longer have a medium to submit
IO against, check for this before submitting io.  This prevents a segfault
further in the code where we dereference elements of the block driver.

Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
---
 block.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)
Stefan Hajnoczi - March 3, 2011, 10:12 a.m.
On Wed, Mar 2, 2011 at 3:04 PM, Ryan Harper <ryanh@us.ibm.com> wrote:
> If the block device has been closed, we no longer have a medium to submit
> IO against, check for this before submitting io.  This prevents a segfault
> further in the code where we dereference elements of the block driver.
>
> Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
> ---
>  block.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/block.c b/block.c
> index 92dd3fe..534e1bc 100644
> --- a/block.c
> +++ b/block.c
> @@ -2407,6 +2407,11 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
>         return 0;
>     }
>
> +    /* don't submit writes if we don't have a medium */
> +    if (bs->drv == NULL) {
> +       return -1;
> +    }
> +

Most other bdrv_*() calls will error out immediately if !bs->drv.
Here you check only after returning success for num_reqs == 0.  I
don't think it makes a huge difference and can see how these semantics
are handy (saves caller checking for num_reqs == 0), but I wanted to
point it out.

More importantly, we're not obeying the contract of this function
here.  reqs[].error must be set to -ENOMEDIUM before returning -1.
Otherwise the caller thinks that reqs[] callbacks will still be
invoked in the future and cannot complete those requests.

Stefan

Patch

diff --git a/block.c b/block.c
index 92dd3fe..534e1bc 100644
--- a/block.c
+++ b/block.c
@@ -2407,6 +2407,11 @@  int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
         return 0;
     }
 
+    /* don't submit writes if we don't have a medium */
+    if (bs->drv == NULL) {
+       return -1;
+    }
+
     // Create MultiwriteCB structure
     mcb = qemu_mallocz(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
     mcb->num_requests = 0;