On Tue, 22 Nov 2022 at 03:22, Kevin Wolf <kw...@redhat.com> wrote: > > Am 21.11.2022 um 22:19 hat Stefan Hajnoczi geschrieben: > > bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL > > leads to undefined behavior. > > > > Jonathan Cameron reported this following NULL pointer dereference when a > > VM with a virtio-blk device and a memory-backend-file object is > > terminated: > > 1. qemu_cleanup() closes all drives, setting blk->root to NULL > > 2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM > > block notifier callback because the memory-backend-file is destroyed. > > 3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar > > notifier callback and undefined behavior occurs. > > > > Fixes: baf422684d73 ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization > > hint") > > Co-authored-by: Jonathan Cameron <jonathan.came...@huawei.com> > > Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> > > Reviewed-by: Kevin Wolf <kw...@redhat.com> > > This raises some questions, though. What happens if the graph isn't > static between creation and deletion of the device? Do we need to do > something with registered buffers when a node is attached to or detached > from an existing device?
I think you are right. Graph changes need to be handled. Right now they aren't. Stefan