diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2022-11-21 16:19:23 -0500 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2022-11-29 18:15:26 -0500 |
| commit | 7103895123d580bbe93e341241d200e75d8996a1 (patch) | |
| tree | e805b02834ad199f47a6b4f61a7fbc8427819793 /hw/virtio/vhost-user.c | |
| parent | 86fdb0582c653a9824183679403a85f588260d62 (diff) | |
| download | focaccia-qemu-7103895123d580bbe93e341241d200e75d8996a1.tar.gz focaccia-qemu-7103895123d580bbe93e341241d200e75d8996a1.zip | |
block-backend: avoid bdrv_unregister_buf() NULL pointer deref
bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL
leads to undefined behavior.
Jonathan Cameron reported this following NULL pointer dereference when a
VM with a virtio-blk device and a memory-backend-file object is
terminated:
1. qemu_cleanup() closes all drives, setting blk->root to NULL
2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM
block notifier callback because the memory-backend-file is destroyed.
3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar
notifier callback and undefined behavior occurs.
Fixes: baf422684d73 ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint")
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221121211923.1993171-1-stefanha@redhat.com>
Diffstat (limited to 'hw/virtio/vhost-user.c')
0 files changed, 0 insertions, 0 deletions