16.11.2018 17:29, Stefan Hajnoczi wrote: > On Tue, Oct 16, 2018 at 04:20:18PM +0300, Vladimir Sementsov-Ogievskiy wrote: >> Theoretically possible that we finish the skipping loop with bs = NULL >> and the following code will crash trying to dereference it. Fix that. >> >> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@virtuozzo.com> >> --- >> migration/block-dirty-bitmap.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c >> index 477826330c..6de808f95f 100644 >> --- a/migration/block-dirty-bitmap.c >> +++ b/migration/block-dirty-bitmap.c >> @@ -288,6 +288,10 @@ static int init_dirty_bitmap_migration(void) >> bs = backing_bs(bs); >> } >> >> + if (!bs || bs->implicit) { > > Why is it necessary to check bs->implicit? >
to be sure, that it is not implicit, as previous loop may finish with implicit = true and bs!= NULL, if drv == NULL. (hmm, may be we want to check drv too?) same thing is in bdrv_query_info, without any checks, and in bdrv_block_device_info with assert(bs). -- Best regards, Vladimir