diff mbox series

[v2] block/monitor/block-hmp-cmds.c: Fix crash when execute hmp_commit

Message ID 20230424103902.45265-1-wangliangzz@126.com
State New
Headers show
Series [v2] block/monitor/block-hmp-cmds.c: Fix crash when execute hmp_commit | expand

Commit Message

Wang Liang April 24, 2023, 10:39 a.m. UTC 
From: Wang Liang <wangliangzz@inspur.com>

hmp_commit() calls blk_is_available() from a non-coroutine context (and in
the main loop). blk_is_available() is a co_wrapper_mixed_bdrv_rdlock
function, and in the non-coroutine context it calls AIO_WAIT_WHILE(),
which crashes if the aio_context lock is not taken before.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1615
Signed-off-by: Wang Liang <wangliangzz@inspur.com>
---
 block/monitor/block-hmp-cmds.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Comments

Kevin Wolf April 25, 2023, 12:09 p.m. UTC | #1 
Am 24.04.2023 um 12:39 hat wangliangzz@126.com geschrieben:
> From: Wang Liang <wangliangzz@inspur.com>
> 
> hmp_commit() calls blk_is_available() from a non-coroutine context (and in
> the main loop). blk_is_available() is a co_wrapper_mixed_bdrv_rdlock
> function, and in the non-coroutine context it calls AIO_WAIT_WHILE(),
> which crashes if the aio_context lock is not taken before.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1615
> Signed-off-by: Wang Liang <wangliangzz@inspur.com>

Thanks, applied to the block branch.

Kevin
diff mbox series

Patch

diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
index 2846083546..ca2599de44 100644
--- a/block/monitor/block-hmp-cmds.c
+++ b/block/monitor/block-hmp-cmds.c
@@ -214,15 +214,17 @@  void hmp_commit(Monitor *mon, const QDict *qdict)
             error_report("Device '%s' not found", device);
             return;
         }
-        if (!blk_is_available(blk)) {
-            error_report("Device '%s' has no medium", device);
-            return;
-        }
 
         bs = bdrv_skip_implicit_filters(blk_bs(blk));
         aio_context = bdrv_get_aio_context(bs);
         aio_context_acquire(aio_context);
 
+        if (!blk_is_available(blk)) {
+            error_report("Device '%s' has no medium", device);
+            aio_context_release(aio_context);
+            return;
+        }
+
         ret = bdrv_commit(bs);
 
         aio_context_release(aio_context);