block/mirror: check backing in bdrv_mirror_top_flush

[Qemu-devel] [PATCH] block/mirror: check backing in bdrv_mirror_top_flush

Vladimir Sementsov-Ogievskiy posted 1 patch 6 years, 6 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20170929152255.5431-1-vsementsov@virtuozzo.com

Test checkpatch passed

Test docker passed

Test s390x passed

block/mirror.c | 4 ++++
1 file changed, 4 insertions(+)

Expand all Fold all

[Qemu-devel] [PATCH] block/mirror: check backing in bdrv_mirror_top_flush

Posted by Vladimir Sementsov-Ogievskiy 6 years, 6 months ago

Backing may be zero after failed bdrv_append in mirror_start_job,
which leads to SIGSEGV.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
---

similar SIGSEGV.
looks like (I guess by code, don't have full back-trace because of
coroutine switch on bdrv_flush):
mirror_start_job,
  bdrv_append failed, backing is not set 
  bdrv_unref
    bdrv_delete
      bdrv_close
        bdrv_flush
         ...
         bdrv_mirror_top_flush 
           Segmentation fault on
           return bdrv_co_flush(bs->backing->bs);
           as bs->backing = 0

 block/mirror.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/block/mirror.c b/block/mirror.c
index 6f5cb9f26c..f17c0d8726 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -1056,6 +1056,10 @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
 
 static int coroutine_fn bdrv_mirror_top_flush(BlockDriverState *bs)
 {
+    if (bs->backing == NULL) {
+        /* we can be here after failed bdrv_append in mirror_start_job */
+        return 0;
+    }
     return bdrv_co_flush(bs->backing->bs);
 }
 
-- 
2.11.1

Re: [Qemu-devel] [PATCH] block/mirror: check backing in bdrv_mirror_top_flush

Posted by Max Reitz 6 years, 6 months ago

On 2017-09-29 17:22, Vladimir Sementsov-Ogievskiy wrote:
> Backing may be zero after failed bdrv_append in mirror_start_job,
> which leads to SIGSEGV.
> 
> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
> ---
> 
> similar SIGSEGV.
> looks like (I guess by code, don't have full back-trace because of
> coroutine switch on bdrv_flush):
> mirror_start_job,
>   bdrv_append failed, backing is not set 
>   bdrv_unref
>     bdrv_delete
>       bdrv_close
>         bdrv_flush
>          ...
>          bdrv_mirror_top_flush 
>            Segmentation fault on
>            return bdrv_co_flush(bs->backing->bs);
>            as bs->backing = 0
> 
>  block/mirror.c | 4 ++++
>  1 file changed, 4 insertions(+)

Thanks, applied to my block branch:

https://github.com/XanClic/qemu/commits/block

Max