Re: [Qemu-devel] [Bug 1240669] Re: sd_init() generates SIGSEGV when passed NULL

[Stefan Weil]

Am 16.10.2013 22:10, schrieb Devin Boyer:
> ** Description changed:
>
>   Ran into a bug following the following tutorial:
> - http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/ 
> + http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/
>   
>   I built QEMU from a clone of master and became stuck at the beginning
>   part of the tutorial where only u-boot.bin is exectuted.
>   
> - 
> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf
>  
> - See the modifications to sd.c specifically. 
> + 
> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf
> + See the modifications to sd.c specifically.
>   
>   When sd_init (sd.c) is called from pl181_init(), bs is potentially null:
> - s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false); 
> + s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
>   
> - sd_init()  :
> + sd_init():
> + 
>   SDState *sd_init(BlockDriverState *bs, bool is_spi) 
>   { 
>       SDState *sd; 
> +  
> +     if (bdrv_is_read_only(bs)) { 
> +         fprintf(stderr, "sd_init: Cannot use read-only drive\n"); 
> +         return NULL; 
> +     } 
>    
>       sd = (SDState *) g_malloc0(sizeof(SDState)); 
>       sd->buf = qemu_blockalign(bs, 512); 
>       sd->spi = is_spi; 
>       sd->enable = true; 
>       sd_reset(sd, bs); 
>       if (sd->bdrv) { 
>           bdrv_attach_dev_nofail(sd->bdrv, sd); 
>           bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd); 
>       } 
>       vmstate_register(NULL, -1, &sd_vmstate, sd); 
>       return sd; 
>   }
>   
> - Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a
> - SEGSIGV.
>   
> - int bdrv_is_read_only(BlockDriverState *bs)                                 
>                           
> - {                                                                           
>                           
> -     return bs->read_only;                                                   
>                           
> - } 
> + Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a 
> SEGSIGV.
> + 
> + int bdrv_is_read_only(BlockDriverState *bs)
> + {
> +     return bs->read_only;
> + }
>   
>   Checking out tag v1.6.1 reverted the problem.  Thanks!
>

See http://lists.nongnu.org/archive/html/qemu-devel/2013-10/msg02075.html
for a possible fix.

Regards,
SW