[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [Qemu-devel] [PATCH] ide: check BlockBackend object in
From: |
John Snow |
Subject: |
Re: [Qemu-block] [Qemu-devel] [PATCH] ide: check BlockBackend object in ide_cancel_dma_sync |
Date: |
Wed, 19 Jul 2017 14:49:51 -0400 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 |
On 07/14/2017 06:00 AM, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> When cancelling pending DMA requests in ide_cancel_dma_sync,
> the s->blk object could be null, leading to a null dereference.
> Add check to avoid it.
>
> Reported-by: Chensongnian <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
> hw/ide/core.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/ide/core.c b/hw/ide/core.c
> index 0b48b64..04474b3 100644
> --- a/hw/ide/core.c
> +++ b/hw/ide/core.c
> @@ -681,8 +681,10 @@ void ide_cancel_dma_sync(IDEState *s)
> #ifdef DEBUG_IDE
> printf("%s: draining all remaining requests", __func__);
> #endif
> - blk_drain(s->blk);
> - assert(s->bus->dma->aiocb == NULL);
> + if (s->blk) {
> + blk_drain(s->blk);
> + assert(s->bus->dma->aiocb == NULL);
> + }
> }
> }
>
>
I guess this occurs through
ide_exec_cmd
cmd_device_reset
ide_cancel_dma_sync
though if s->blk does not exist, we should usually not be able to
address this device with a reset command as such. (core.c:2021) -- but
this is only for secondary devices. I guess we don't guard against
nonexistent primary devices......?
Further, how do we have s->bus->dma->aiocb if there's no blk device?
What DMA request did we accept...?
Can you please submit a stack that illustrates the code path followed so
this fix can be properly verified and tested?
Thanks,
--John