mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

block-backend: avoid bdrv_unregister_buf() NULL pointer deref

Browse Source 
bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL
leads to undefined behavior.

Jonathan Cameron reported this following NULL pointer dereference when a
VM with a virtio-blk device and a memory-backend-file object is
terminated:
1. qemu_cleanup() closes all drives, setting blk->root to NULL
2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM
   block notifier callback because the memory-backend-file is destroyed.
3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar
   notifier callback and undefined behavior occurs.

Fixes: baf422684d ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint")
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221121211923.1993171-1-stefanha@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2022-11-21 16:19:23 -05:00
parent 86fdb0582c
commit 7103895123
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
block/block-backend.c
View File

@ -2576,14 +2576,25 @@ static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp)
{
BlockDriverState *bs = blk_bs(blk);
GLOBAL_STATE_CODE();
return bdrv_register_buf(blk_bs(blk), host, size, errp);
if (bs) {
return bdrv_register_buf(bs, host, size, errp);
}
return true;
}
void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
{
BlockDriverState *bs = blk_bs(blk);
GLOBAL_STATE_CODE();
bdrv_unregister_buf(blk_bs(blk), host, size);
if (bs) {
bdrv_unregister_buf(bs, host, size);
}
}
int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,