mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts()

Browse Source 
In mirror_iteration() we call mirror_wait_on_conflicts() with
`self` parameter set to NULL.

Starting from commit d44dae1a7c we dereference `self` pointer in
mirror_wait_on_conflicts() without checks if it is not NULL.

Backtrace:
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
      at ../block/mirror.c:172
  172	                self->waiting_for_op = op;
  [Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))]
  (gdb) bt
  #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
      at ../block/mirror.c:172
  #1  0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=<optimized out>) at ../block/mirror.c:491
  #2  0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917
  #3  0x00005610c5f046c6 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>)
      at ../util/coroutine-ucontext.c:173
  #4  0x00007f0909975820 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91
      from /usr/lib64/libc.so.6

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404
Fixes: d44dae1a7c ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20210910124533.288318-1-sgarzare@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
This commit is contained in:
Stefano Garzarella 2021-09-10 14:45:33 +02:00 committed by Hanna Reitz
parent 098d983ea5
commit 66fed30c9c
1 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
block/mirror.c
View File

@ -160,18 +160,25 @@ static void coroutine_fn mirror_wait_on_conflicts(MirrorOp *self,
if (ranges_overlap(self_start_chunk, self_nb_chunks, if (ranges_overlap(self_start_chunk, self_nb_chunks,
op_start_chunk, op_nb_chunks)) op_start_chunk, op_nb_chunks))
{ {
if (self) {
/* /*
* If the operation is already (indirectly) waiting for us, or * If the operation is already (indirectly) waiting for us,
* will wait for us as soon as it wakes up, then just go on * or will wait for us as soon as it wakes up, then just go
* (instead of producing a deadlock in the former case). * on (instead of producing a deadlock in the former case).
*/ */
if (op->waiting_for_op) { if (op->waiting_for_op) {
continue; continue;
} }
self->waiting_for_op = op; self->waiting_for_op = op;
}
qemu_co_queue_wait(&op->waiting_requests, NULL); qemu_co_queue_wait(&op->waiting_requests, NULL);
if (self) {
self->waiting_for_op = NULL; self->waiting_for_op = NULL;
}
break; break;
} }
} }