[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 23/28] qcow2: Fix dangling pointer after reopen for 'file'
From: |
Kevin Wolf |
Subject: |
[PULL 23/28] qcow2: Fix dangling pointer after reopen for 'file' |
Date: |
Fri, 9 Jul 2021 14:50:30 +0200 |
Without an external data file, s->data_file is a second pointer with the
same value as bs->file. When changing bs->file to a different BdrvChild
and freeing the old BdrvChild, s->data_file must also be updated,
otherwise it points to freed memory and causes crashes.
This problem was caught by iotests case 245.
Fixes: df2b7086f169239ebad5d150efa29c9bb6d4f820
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210708114709.206487-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
block/qcow2.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/block/qcow2.c b/block/qcow2.c
index 0cac2eda36..9f1b6461c8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1926,6 +1926,7 @@ static void qcow2_refresh_limits(BlockDriverState *bs,
Error **errp)
static int qcow2_reopen_prepare(BDRVReopenState *state,
BlockReopenQueue *queue, Error **errp)
{
+ BDRVQcow2State *s = state->bs->opaque;
Qcow2ReopenState *r;
int ret;
@@ -1956,6 +1957,16 @@ static int qcow2_reopen_prepare(BDRVReopenState *state,
}
}
+ /*
+ * Without an external data file, s->data_file points to the same BdrvChild
+ * as bs->file. It needs to be resynced after reopen because bs->file may
+ * be changed. We can't use it in the meantime.
+ */
+ if (!has_data_file(state->bs)) {
+ assert(s->data_file == state->bs->file);
+ s->data_file = NULL;
+ }
+
return 0;
fail:
@@ -1966,7 +1977,16 @@ fail:
static void qcow2_reopen_commit(BDRVReopenState *state)
{
+ BDRVQcow2State *s = state->bs->opaque;
+
qcow2_update_options_commit(state->bs, state->opaque);
+ if (!s->data_file) {
+ /*
+ * If we don't have an external data file, s->data_file was cleared by
+ * qcow2_reopen_prepare() and needs to be updated.
+ */
+ s->data_file = state->bs->file;
+ }
g_free(state->opaque);
}
@@ -1990,6 +2010,15 @@ static void qcow2_reopen_commit_post(BDRVReopenState
*state)
static void qcow2_reopen_abort(BDRVReopenState *state)
{
+ BDRVQcow2State *s = state->bs->opaque;
+
+ if (!s->data_file) {
+ /*
+ * If we don't have an external data file, s->data_file was cleared by
+ * qcow2_reopen_prepare() and needs to be restored.
+ */
+ s->data_file = state->bs->file;
+ }
qcow2_update_options_abort(state->bs, state->opaque);
g_free(state->opaque);
}
--
2.31.1
- [PULL 12/28] export/fuse: Give SET_ATTR_SIZE its own branch, (continued)
- [PULL 12/28] export/fuse: Give SET_ATTR_SIZE its own branch, Kevin Wolf, 2021/07/09
- [PULL 13/28] export/fuse: Let permissions be adjustable, Kevin Wolf, 2021/07/09
- [PULL 14/28] iotests/308: Test +w on read-only FUSE exports, Kevin Wolf, 2021/07/09
- [PULL 15/28] iotests/fuse-allow-other: Test allow-other, Kevin Wolf, 2021/07/09
- [PULL 17/28] MAINTAINERS: add block/rbd.c reviewer, Kevin Wolf, 2021/07/09
- [PULL 16/28] block/rbd: fix type of task->complete, Kevin Wolf, 2021/07/09
- [PULL 18/28] vhost-user: Fix backends without multiqueue support, Kevin Wolf, 2021/07/09
- [PULL 19/28] blockdev: fix drive-backup transaction endless drained section, Kevin Wolf, 2021/07/09
- [PULL 20/28] qcow2: Prohibit backing file changes in 'qemu-img amend', Kevin Wolf, 2021/07/09
- [PULL 21/28] qemu-img: Require -F with -b backing image, Kevin Wolf, 2021/07/09
- [PULL 23/28] qcow2: Fix dangling pointer after reopen for 'file',
Kevin Wolf <=
- [PULL 24/28] block: Add bdrv_reopen_queue_free(), Kevin Wolf, 2021/07/09
- [PULL 22/28] qemu-img: Improve error for rebase without backing format, Kevin Wolf, 2021/07/09
- [PULL 25/28] block: Acquire AioContexts during bdrv_reopen_multiple(), Kevin Wolf, 2021/07/09
- [PULL 26/28] block: Support multiple reopening with x-blockdev-reopen, Kevin Wolf, 2021/07/09
- [PULL 27/28] iotests: Test reopening multiple devices at the same time, Kevin Wolf, 2021/07/09
- [PULL 28/28] block: Make blockdev-reopen stable API, Kevin Wolf, 2021/07/09
- Re: [PULL 00/28] Block layer patches, Peter Maydell, 2021/07/10