[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 16/47] qemu_opts_append: Play nicely with QemuOptsLis
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 16/47] qemu_opts_append: Play nicely with QemuOptsList's head |
Date: |
Fri, 27 Jun 2014 21:08:35 +0200 |
From: Michal Privoznik <address@hidden>
When running a libvirt test suite I've noticed the qemu-img is
crashing occasionally. Tracing the problem down led me to the
following valgrind output:
qemu.git $ valgrind -q ./qemu-img create -f qed
-obacking_file=/dev/null,backing_fmt=raw qed
==14881== Invalid write of size 8
==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692)
==14881== by 0x130782: bdrv_img_create (block.c:5531)
==14881== by 0x118DE0: img_create (qemu-img.c:462)
==14881== by 0x11E7E4: main (qemu-img.c:2830)
==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd
==14881== at 0x4C2CA5E: realloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129)
==14881== by 0x13075E: bdrv_img_create (block.c:5528)
==14881== by 0x118DE0: img_create (qemu-img.c:462)
==14881== by 0x11E7E4: main (qemu-img.c:2830)
==14881==
Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw'
cluster_size=65536
==14881== Invalid write of size 8
==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750)
==14881== by 0x130BF3: bdrv_img_create (block.c:5638)
==14881== by 0x118DE0: img_create (qemu-img.c:462)
==14881== by 0x11E7E4: main (qemu-img.c:2830)
==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd
==14881== at 0x4C2CA5E: realloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129)
==14881== by 0x13075E: bdrv_img_create (block.c:5528)
==14881== by 0x118DE0: img_create (qemu-img.c:462)
==14881== by 0x11E7E4: main (qemu-img.c:2830)
==14881==
The problem is apparently in the qemu_opts_append(). Well, if it
gets called twice or more. On the first call, when @dst is NULL
some initialization is done during which @dst->head list gets
initialized. The list is initialized in a way, so that the list
tail points at the list head. However, the next time
qemu_opts_append() is called for new options to be added,
g_realloc() may move @dst to a new address making the old list tail
point at an invalid address. If that's the case, we must update the
list pointers.
Signed-off-by: Michal Privoznik <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
util/qemu-option.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/util/qemu-option.c b/util/qemu-option.c
index 43de3ad..6dc27ce 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -1111,6 +1111,7 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst,
size_t num_opts, num_dst_opts;
QemuOptDesc *desc;
bool need_init = false;
+ bool need_head_update;
if (!list) {
return dst;
@@ -1121,6 +1122,12 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst,
*/
if (!dst) {
need_init = true;
+ need_head_update = true;
+ } else {
+ /* Moreover, even if dst is not NULL, the realloc may move it to a
+ * different address in which case we may get a stale tail pointer
+ * in dst->head. */
+ need_head_update = QTAILQ_EMPTY(&dst->head);
}
num_opts = count_opts_list(dst);
@@ -1131,9 +1138,11 @@ QemuOptsList *qemu_opts_append(QemuOptsList *dst,
if (need_init) {
dst->name = NULL;
dst->implied_opt_name = NULL;
- QTAILQ_INIT(&dst->head);
dst->merge_lists = false;
}
+ if (need_head_update) {
+ QTAILQ_INIT(&dst->head);
+ }
dst->desc[num_dst_opts].name = NULL;
/* append list->desc to dst->desc */
--
1.8.3.1
- [Qemu-devel] [PULL 04/47] qemu-iotests: Test 0-length image for mirror, (continued)
- [Qemu-devel] [PULL 04/47] qemu-iotests: Test 0-length image for mirror, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 08/47] block: Move bdrv_fill_options() call to bdrv_open(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 07/47] block: Create bdrv_fill_options(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 09/47] block: Move json: parsing to bdrv_fill_options(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 11/47] block: Use common driver selection code for bdrv_open_file(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 12/47] block: Inline bdrv_file_open(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 10/47] block: Always pass driver name through options QDict, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 13/47] block: Remove second bdrv_open() recursion, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 14/47] block: Catch backing files assigned to non-COW drivers, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 18/47] block: add qemu-iotest for resize base during live commit, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 16/47] qemu_opts_append: Play nicely with QemuOptsList's head,
Kevin Wolf <=
- [Qemu-devel] [PULL 17/47] block: check for RESIZE blocker in the QMP command, not bdrv_truncate(), Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 15/47] block: Remove a special case for protocols, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 19/47] quorum: Add the rewrite-corrupted parameter to quorum, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 20/47] block: Add node-name argument to drive-mirror, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 22/47] virtio-blk: Convert VirtIOBlockReq.elem to pointer, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 23/47] virtio-blk: Drop bounce buffer from dataplane code, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 24/47] virtio-blk: Drop VirtIOBlockRequest.read, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 25/47] virtio-blk: Replace VirtIOBlockRequest with VirtIOBlockReq, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 26/47] virtio-blk: Use VirtIOBlockReq.in to drop VirtIOBlockReq.inhdr, Kevin Wolf, 2014/06/27
- [Qemu-devel] [PULL 30/47] block: make bdrv_query_stats() static, Kevin Wolf, 2014/06/27