On 24.11.2023 16:06, Kevin Wolf wrote:
Am 24.11.2023 um 12:30 hat Dmitry Frolov geschrieben:
blk_bs() may return NULL, which will be dereferenced without a check in
bdrv_commit().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Frolov <fro...@swemel.ru>
Do you have a reproducer for a crash?
Actually, there was no crash. This problem was found by static analyzer.
As far as I can see, it will not be dereferenced, because
blk_is_available() returns false and we return an error before
calling bdrv_commit():
As I see, there are 2 reasons, why blk_bs() may return NULL:
blk->root == NULL or blk->root->bs == NULL
At the same time, blk_is_available() checks for blk_co_is_inserted(blk) and
blk_dev_is_tray_open(blk).
Does it also guarantee that blk->root and blk->root->bs are not NULL?
This is not really obvious.
Maybe, in this case, it makes sense to check blk->root before of checking
blk_is_available()?
QEMU 8.1.91 monitor - type 'help' for more information
(qemu) info block
ide1-cd0: [not inserted]
Attached to: /machine/unattached/device[6]
Removable device: not locked, tray closed
floppy0: [not inserted]
Attached to: /machine/unattached/device[16]
Removable device: not locked, tray closed
sd0: [not inserted]
Removable device: not locked, tray closed
(qemu) commit ide1-cd0
Device 'ide1-cd0' has no medium
Kevin
