diff options
author | Fam Zheng <famz@redhat.com> | 2018-07-03 10:37:56 +0800 |
---|---|---|
committer | Jeff Cody <jcody@redhat.com> | 2018-07-02 23:23:45 -0400 |
commit | d4d3e5a0d53a57282955e8a3ed7acc1ca90552d9 (patch) | |
tree | 02d2967cc330109319d345ef27bdcc17459c2b39 /block/io.c | |
parent | ab08440a4ee09032d1a9cb22fdcab23bc7e1c656 (diff) | |
download | qemu-d4d3e5a0d53a57282955e8a3ed7acc1ca90552d9.zip qemu-d4d3e5a0d53a57282955e8a3ed7acc1ca90552d9.tar.gz qemu-d4d3e5a0d53a57282955e8a3ed7acc1ca90552d9.tar.bz2 |
block: Fix parameter checking in bdrv_co_copy_range_internal
src may be NULL if BDRV_REQ_ZERO_WRITE flag is set, in this case only
check dst and dst->bs. This bug was introduced when moving in the
request tracking code from bdrv_co_copy_range, in 37aec7d75eb.
This especially fixes the possible segfault when initializing src_bs
with a NULL src.
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 20180703023758.14422-2-famz@redhat.com
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Diffstat (limited to 'block/io.c')
-rw-r--r-- | block/io.c | 29 |
1 files changed, 15 insertions, 14 deletions
@@ -2897,18 +2897,11 @@ static int coroutine_fn bdrv_co_copy_range_internal(BdrvChild *src, bool recurse_src) { BdrvTrackedRequest src_req, dst_req; - BlockDriverState *src_bs = src->bs; - BlockDriverState *dst_bs = dst->bs; int ret; - if (!src || !dst || !src->bs || !dst->bs) { + if (!dst || !dst->bs) { return -ENOMEDIUM; } - ret = bdrv_check_byte_request(src->bs, src_offset, bytes); - if (ret) { - return ret; - } - ret = bdrv_check_byte_request(dst->bs, dst_offset, bytes); if (ret) { return ret; @@ -2917,16 +2910,24 @@ static int coroutine_fn bdrv_co_copy_range_internal(BdrvChild *src, return bdrv_co_pwrite_zeroes(dst, dst_offset, bytes, flags); } + if (!src || !src->bs) { + return -ENOMEDIUM; + } + ret = bdrv_check_byte_request(src->bs, src_offset, bytes); + if (ret) { + return ret; + } + if (!src->bs->drv->bdrv_co_copy_range_from || !dst->bs->drv->bdrv_co_copy_range_to || src->bs->encrypted || dst->bs->encrypted) { return -ENOTSUP; } - bdrv_inc_in_flight(src_bs); - bdrv_inc_in_flight(dst_bs); - tracked_request_begin(&src_req, src_bs, src_offset, + bdrv_inc_in_flight(src->bs); + bdrv_inc_in_flight(dst->bs); + tracked_request_begin(&src_req, src->bs, src_offset, bytes, BDRV_TRACKED_READ); - tracked_request_begin(&dst_req, dst_bs, dst_offset, + tracked_request_begin(&dst_req, dst->bs, dst_offset, bytes, BDRV_TRACKED_WRITE); wait_serialising_requests(&src_req); @@ -2944,8 +2945,8 @@ static int coroutine_fn bdrv_co_copy_range_internal(BdrvChild *src, } tracked_request_end(&src_req); tracked_request_end(&dst_req); - bdrv_dec_in_flight(src_bs); - bdrv_dec_in_flight(dst_bs); + bdrv_dec_in_flight(src->bs); + bdrv_dec_in_flight(dst->bs); return ret; } |