dcavalca / rpms / qemu

Forked from rpms/qemu a year ago
Clone

Blame 0005-curl-Don-t-deref-NULL-pointer-in-call-to-aio_poll.patch

723d95
From 1ea3e3a38b5bdb144a7206654c51f8f4768077f3 Mon Sep 17 00:00:00 2001
f2a088
From: "Richard W.M. Jones" <rjones@redhat.com>
f2a088
Date: Thu, 28 Aug 2014 09:04:21 +0100
f2a088
Subject: [PATCH] curl: Don't deref NULL pointer in call to aio_poll.
f2a088
MIME-Version: 1.0
f2a088
Content-Type: text/plain; charset=UTF-8
f2a088
Content-Transfer-Encoding: 8bit
f2a088
f2a088
In commit 63f0f45f2e89b60ff8245fec81328ddfde42a303 the following
f2a088
mechanical change was made:
f2a088
f2a088
         if (!state) {
f2a088
-            qemu_aio_wait();
f2a088
+            aio_poll(state->s->aio_context, true);
f2a088
         }
f2a088
f2a088
The new code now checks if state is NULL and then dereferences it
f2a088
('state->s') which is obviously incorrect.
f2a088
f2a088
This commit replaces state->s->aio_context with
f2a088
bdrv_get_aio_context(bs), fixing this problem.  The two other hunks
f2a088
are concerned with getting the BlockDriverState pointer bs to where it
f2a088
is needed.
f2a088
f2a088
The original bug causes a segfault when using libguestfs to access a
f2a088
VMware vCenter Server and doing any kind of complex read-heavy
f2a088
operations.  With this commit the segfault goes away.
f2a088
f2a088
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
f2a088
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
f2a088
Reviewed-by: BenoƮt Canet <benoit.canet@nodalink.com>
f2a088
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
723d95
(cherry picked from commit a2f468e48f8b6559ec9123e94948bc373b788941)
f2a088
---
f2a088
 block/curl.c | 8 ++++----
f2a088
 1 file changed, 4 insertions(+), 4 deletions(-)
f2a088
f2a088
diff --git a/block/curl.c b/block/curl.c
723d95
index 537e257..d28b701 100644
f2a088
--- a/block/curl.c
f2a088
+++ b/block/curl.c
f2a088
@@ -357,7 +357,7 @@ static void curl_multi_timeout_do(void *arg)
f2a088
 #endif
f2a088
 }
f2a088
 
f2a088
-static CURLState *curl_init_state(BDRVCURLState *s)
f2a088
+static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
f2a088
 {
f2a088
     CURLState *state = NULL;
f2a088
     int i, j;
f2a088
@@ -375,7 +375,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
f2a088
             break;
f2a088
         }
f2a088
         if (!state) {
f2a088
-            aio_poll(state->s->aio_context, true);
f2a088
+            aio_poll(bdrv_get_aio_context(bs), true);
f2a088
         }
f2a088
     } while(!state);
f2a088
 
f2a088
@@ -566,7 +566,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
f2a088
     DPRINTF("CURL: Opening %s\n", file);
f2a088
     s->aio_context = bdrv_get_aio_context(bs);
f2a088
     s->url = g_strdup(file);
f2a088
-    state = curl_init_state(s);
f2a088
+    state = curl_init_state(bs, s);
f2a088
     if (!state)
f2a088
         goto out_noclean;
f2a088
 
f2a088
@@ -651,7 +651,7 @@ static void curl_readv_bh_cb(void *p)
f2a088
     }
f2a088
 
f2a088
     // No cache found, so let's start a new request
f2a088
-    state = curl_init_state(s);
f2a088
+    state = curl_init_state(acb->common.bs, s);
f2a088
     if (!state) {
f2a088
         acb->common.cb(acb->common.opaque, -EIO);
f2a088
         qemu_aio_release(acb);