diff mbox series

[03/21] block/file-posix: Fix laio_init() error handling crash bug

Message ID 20191130194240.10517-4-armbru@redhat.com (mailing list archive)
State New, archived
Headers show
Series Error handling fixes, may contain 4.2 material | expand

Commit Message

Markus Armbruster Nov. 30, 2019, 7:42 p.m. UTC 
raw_aio_attach_aio_context() passes uninitialized Error *local_err by
reference to laio_init() via aio_setup_linux_aio().  When laio_init()
fails, it passes it on to error_setg_errno(), tripping error_setv()'s
assertion unless @local_err is null by dumb luck.

Fix by initializing @local_err properly.

Fixes: ed6e2161715c527330f936d44af4c547f25f687e
Cc: Nishanth Aravamudan <naravamudan@digitalocean.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 block/file-posix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Stefan Hajnoczi Dec. 2, 2019, 10:04 a.m. UTC | #1 
On Sat, Nov 30, 2019 at 08:42:22PM +0100, Markus Armbruster wrote:
> raw_aio_attach_aio_context() passes uninitialized Error *local_err by
> reference to laio_init() via aio_setup_linux_aio().  When laio_init()
> fails, it passes it on to error_setg_errno(), tripping error_setv()'s
> assertion unless @local_err is null by dumb luck.
> 
> Fix by initializing @local_err properly.
> 
> Fixes: ed6e2161715c527330f936d44af4c547f25f687e
> Cc: Nishanth Aravamudan <naravamudan@digitalocean.com>
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>  block/file-posix.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Worth including in QEMU 4.2.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Kevin Wolf Dec. 2, 2019, 12:22 p.m. UTC | #2 
Am 30.11.2019 um 20:42 hat Markus Armbruster geschrieben:
> raw_aio_attach_aio_context() passes uninitialized Error *local_err by
> reference to laio_init() via aio_setup_linux_aio().  When laio_init()
> fails, it passes it on to error_setg_errno(), tripping error_setv()'s
> assertion unless @local_err is null by dumb luck.
> 
> Fix by initializing @local_err properly.
> 
> Fixes: ed6e2161715c527330f936d44af4c547f25f687e
> Cc: Nishanth Aravamudan <naravamudan@digitalocean.com>
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>

Reviewed-by: Kevin Wolf <kwolf@redhat.com>
diff mbox series

Patch

diff --git a/block/file-posix.c b/block/file-posix.c
index 1f0f61a02b..1b805bd938 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1973,7 +1973,7 @@  static void raw_aio_attach_aio_context(BlockDriverState *bs,
 #ifdef CONFIG_LINUX_AIO
     BDRVRawState *s = bs->opaque;
     if (s->use_linux_aio) {
-        Error *local_err;
+        Error *local_err = NULL;
         if (!aio_setup_linux_aio(new_context, &local_err)) {
             error_reportf_err(local_err, "Unable to use native AIO, "
                                          "falling back to thread pool: ");