[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Null dereference in bdrv_unregister_buf() probably memory-backend-file r
From: |
Jonathan Cameron |
Subject: |
Null dereference in bdrv_unregister_buf() probably memory-backend-file related? |
Date: |
Mon, 21 Nov 2022 16:21:32 +0000 |
First CC list is a guess as I haven't managed to root cause where things are
going wrong yet.
Originally hit this whilst rebasing some CXL patches on v7.2.0-rc1.
CXL makes extensive use of memory-backends and most my tests happen
to use memory-backend-file
Issue seen on arm64 and x86 though helpfully on x86 the crash appears in an
entirely
unrelated location (though the 'fix' works).
Fairly minimal test command line.
qemu-system-aarch64 \
-M virt \
-drive if=none,file=full.qcow2,format=qcow2,id=hd \
-device virtio-blk,drive=hd \
-object
memory-backend-file,id=cxl-mem1,mem-path=/tmp/cxltest.raw,size=256M,align=256M \
Powerdown the machine or ctrl-c during boot gives a segfault.
On arm64 it was in a stable location that made at least some sense in that
bs in the below snippet is NULL.
I added the follow work around and the segfault goes away...
[PATCH] temp
---
block/io.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/block/io.c b/block/io.c
index b9424024f9..750e1366aa 100644
--- a/block/io.c
+++ b/block/io.c
@@ -3324,6 +3324,9 @@ void bdrv_unregister_buf(BlockDriverState *bs, void
*host, size_t size)
{
BdrvChild *child;
+ if (!bs) {
+ return;
+ }
GLOBAL_STATE_CODE();
if (bs->drv && bs->drv->bdrv_unregister_buf) {
bs->drv->bdrv_unregister_buf(bs, host, size);
--
2.37.2
Not present on v7.1.0 . I'll start a bisection shortly but may take a while.
- Null dereference in bdrv_unregister_buf() probably memory-backend-file related?,
Jonathan Cameron <=