On 21/11/22 22:19, Stefan Hajnoczi wrote:
bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL leads to undefined behavior.Jonathan Cameron reported this following NULL pointer dereference when a VM with a virtio-blk device and a memory-backend-file object is terminated: 1. qemu_cleanup() closes all drives, setting blk->root to NULL 2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM block notifier callback because the memory-backend-file is destroyed. 3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar notifier callback and undefined behavior occurs. Fixes: baf422684d73 ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint") Co-authored-by: Jonathan Cameron <jonathan.came...@huawei.com> Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> --- block/block-backend.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org>
