From 5d186eb03eb37b257e29a4731ca484362d5fc4e4 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Wed, 27 Mar 2013 17:28:18 +0100 Subject: block: Fix direct use of protocols as driver for bdrv_open() bdrv_open_common() implements direct use of protocols by copying the pre-opened BlockDriverStates to bs using bdrv_swap(). It did however first set some fields in bs, which end up in file after the swap. When bdrv_open() destroys file, it appears to be open, and because it isn't, qemu could segfault while trying to close it. Reorder the operations to return immediately in such cases so that file is correctly detected as closed. Signed-off-by: Kevin Wolf Signed-off-by: Stefan Hajnoczi --- block.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) (limited to 'block.c') diff --git a/block.c b/block.c index 16a92a4..0ae2e93 100644 --- a/block.c +++ b/block.c @@ -680,6 +680,18 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file, trace_bdrv_open_common(bs, filename, flags, drv->format_name); + if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv)) { + return -ENOTSUP; + } + + /* bdrv_open() with directly using a protocol as drv. This layer is already + * opened, so assign it to bs (while file becomes a closed BlockDriverState) + * and return immediately. */ + if (file != NULL && drv->bdrv_file_open) { + bdrv_swap(file, bs); + return 0; + } + bs->open_flags = flags; bs->buffer_alignment = 512; @@ -694,10 +706,6 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file, bs->filename[0] = '\0'; } - if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv)) { - return -ENOTSUP; - } - bs->drv = drv; bs->opaque = g_malloc0(drv->instance_size); @@ -708,13 +716,9 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file, /* Open the image, either directly or using a protocol */ if (drv->bdrv_file_open) { - if (file != NULL) { - bdrv_swap(file, bs); - ret = 0; - } else { - assert(drv->bdrv_parse_filename || filename != NULL); - ret = drv->bdrv_file_open(bs, filename, options, open_flags); - } + assert(file == NULL); + assert(drv->bdrv_parse_filename || filename != NULL); + ret = drv->bdrv_file_open(bs, filename, options, open_flags); } else { assert(file != NULL); bs->file = file; -- cgit v1.1