On Fri, Jun 22, 2018 at 12:37:00PM -0700, Nishanth Aravamudan wrote: > laio_init() can fail for a couple of reasons, which will lead to a NULL > pointer dereference in laio_attach_aio_context(). > > To solve this, add a aio_setup_linux_aio() function which is called > early in raw_open_common. If this fails, propagate the error up. The > signature of aio_get_linux_aio() was not modified, because it seems > preferable to return the actual errno from the possible failing > initialization calls. > > Additionally, when the AioContext changes, we need to associate a > LinuxAioState with the new AioContext. Use the bdrv_attach_aio_context > callback and call the new aio_setup_linux_aio(), which will allocate a > new AioContext if needed, and return errors on failures. If it fails for > any reason, fallback to threaded AIO with an error message, as the > device is already in-use by the guest. > > Add an assert that aio_get_linux_aio() cannot return NULL. > > Signed-off-by: Nishanth Aravamudan <naravamu...@digitalocean.com> > > --- > > Test case 1: > Set /proc/sys/fs/max-aio-nr to 0. Start a guest with an aio=native > disk. > > Result: laio_init() returns NULL due to not being able to allocate > any AIO contexts. This NULL is assigned to ctx->linux_aio and > dereferenced in aio_get_linux_aio. > > Test case 2: > Set /proc/sys/fs/max-aio-nr to 128. Start a guest with an aio=native > disk and one in-use I/O thread. > > Result: laio_init() returns NULL due to not being able to allocate > additional AIO contexts for the I/O thread. This NULL is assigned to > ctx->linux_aio and dereferenced in aio_get_linux_aio. > > Changes from v3 -> v4 (thanks to Fam Zheng and Kevin Wolf for review): > > Squash patch 2/2 into 1/2. > Differentiate the possible reasons for laio_init() failing and use an > Error ** to propagate the errno to the caller. > > Changes from v2 -> v3 (thanks to Eric Blake and Kevin Wolf for review): > > Use a boolean false rather than 0 in assignment to use_linux_aio. > Drop ending '.' from error_report() calls. > Fix typo in commit message (propogates -> propagates). > Move aio_setup_linux_aio call to raw_open_common. > > Changes from v1 -> v2 (thanks to Kevin Wolf for review): > > Rather than affect virtio-scsi/blk at all, make all the changes internal > to file-posix.c. Thanks to Kevin Wolf for the suggested change. > > block/file-posix.c | 33 ++++++++++++++++++++++++++++----- > block/linux-aio.c | 12 +++++++++--- > include/block/aio.h | 3 +++ > include/block/raw-aio.h | 2 +- > stubs/linux-aio.c | 2 +- > util/async.c | 14 +++++++++++--- > 6 files changed, 53 insertions(+), 13 deletions(-)
Thanks, applied to my block tree: https://github.com/stefanha/qemu/commits/block Stefan
signature.asc
Description: PGP signature