[Qemu-devel] [Bug 1240669] Re: sd_init() generates SIGSEGV when passed NULL

[Devin Boyer]

** Description changed:

  Ran into a bug following the following tutorial:
- http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/ 
+ http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/
  
  I built QEMU from a clone of master and became stuck at the beginning
  part of the tutorial where only u-boot.bin is exectuted.
  
- 
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf
 
- See the modifications to sd.c specifically. 
+ 
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf
+ See the modifications to sd.c specifically.
  
  When sd_init (sd.c) is called from pl181_init(), bs is potentially null:
- s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false); 
+ s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
  
- sd_init()  :
+ sd_init():
+ 
  SDState *sd_init(BlockDriverState *bs, bool is_spi) 
  { 
      SDState *sd; 
+  
+     if (bdrv_is_read_only(bs)) { 
+         fprintf(stderr, "sd_init: Cannot use read-only drive\n"); 
+         return NULL; 
+     } 
   
      sd = (SDState *) g_malloc0(sizeof(SDState)); 
      sd->buf = qemu_blockalign(bs, 512); 
      sd->spi = is_spi; 
      sd->enable = true; 
      sd_reset(sd, bs); 
      if (sd->bdrv) { 
          bdrv_attach_dev_nofail(sd->bdrv, sd); 
          bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd); 
      } 
      vmstate_register(NULL, -1, &sd_vmstate, sd); 
      return sd; 
  }
  
- Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a
- SEGSIGV.
  
- int bdrv_is_read_only(BlockDriverState *bs)                                   
                        
- {                                                                             
                        
-     return bs->read_only;                                                     
                        
- } 
+ Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a 
SEGSIGV.
+ 
+ int bdrv_is_read_only(BlockDriverState *bs)
+ {
+     return bs->read_only;
+ }
  
  Checking out tag v1.6.1 reverted the problem.  Thanks!

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1240669

Title:
  sd_init() generates SIGSEGV when passed NULL

Status in QEMU:
  New

Bug description:
  Ran into a bug following the following tutorial:
  http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/

  I built QEMU from a clone of master and became stuck at the beginning
  part of the tutorial where only u-boot.bin is exectuted.

  
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf
  See the modifications to sd.c specifically.

  When sd_init (sd.c) is called from pl181_init(), bs is potentially null:
  s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);

  sd_init():

  SDState *sd_init(BlockDriverState *bs, bool is_spi) 
  { 
      SDState *sd; 
   
      if (bdrv_is_read_only(bs)) { 
          fprintf(stderr, "sd_init: Cannot use read-only drive\n"); 
          return NULL; 
      } 
   
      sd = (SDState *) g_malloc0(sizeof(SDState)); 
      sd->buf = qemu_blockalign(bs, 512); 
      sd->spi = is_spi; 
      sd->enable = true; 
      sd_reset(sd, bs); 
      if (sd->bdrv) { 
          bdrv_attach_dev_nofail(sd->bdrv, sd); 
          bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd); 
      } 
      vmstate_register(NULL, -1, &sd_vmstate, sd); 
      return sd; 
  }

  
  Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a 
SEGSIGV.

  int bdrv_is_read_only(BlockDriverState *bs)
  {
      return bs->read_only;
  }

  Checking out tag v1.6.1 reverted the problem.  Thanks!

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1240669/+subscriptions