[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 14/14] scsi: Add assertion for use-after-free errors
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PATCH 14/14] scsi: Add assertion for use-after-free errors |
Date: |
Fri, 4 May 2012 10:45:54 +0200 |
From: Stefan Weil <address@hidden>
The QEMU emulation which is currently used with Raspberry PI images
(qemu-system-arm -M versatilepb ...) accesses memory which was freed.
Valgrind output (extract):
==17857== Invalid write of size 4
==17857== at 0x24EB06: scsi_req_unref (scsi-bus.c:1273)
==17857== by 0x24FFAE: scsi_read_complete (scsi-disk.c:277)
==17857== by 0x152ACC: bdrv_co_em_bh (block.c:3363)
==17857== by 0x13D49C: qemu_bh_poll (async.c:71)
==17857== by 0x211A8C: main_loop_wait (main-loop.c:503)
==17857== by 0x207954: main_loop (vl.c:1555)
==17857== by 0x20E9C9: main (vl.c:3653)
==17857== Address 0x1c54383c is 12 bytes inside a block of size 260 free'd
==17857== at 0x4824B3A: free (vg_replace_malloc.c:366)
==17857== by 0x20ADFA: free_and_trace (vl.c:2250)
==17857== by 0x4899FC5: g_free (in /lib/libglib-2.0.so.0.2400.1)
==17857== by 0x24EB3B: scsi_req_unref (scsi-bus.c:1277)
==17857== by 0x24F003: scsi_req_complete (scsi-bus.c:1383)
==17857== by 0x25022A: scsi_read_data (scsi-disk.c:334)
==17857== by 0x24EB9F: scsi_req_continue (scsi-bus.c:1289)
==17857== by 0x1C7787: lsi_do_dma (lsi53c895a.c:575)
==17857== by 0x1C8CDA: lsi_execute_script (lsi53c895a.c:1147)
==17857== by 0x1C74EA: lsi_resume_script (lsi53c895a.c:510)
==17857== by 0x1C7ECD: lsi_transfer_data (lsi53c895a.c:746)
==17857== by 0x24EC90: scsi_req_data (scsi-bus.c:1307)
(There are some more similar messages.)
This patch adds an assertion which also detects those errors:
Calling scsi_req_unref is not allowed when the previous call
of that function has decremented refcount to 0, because in this
case req was freed.
Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi-bus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index add1d4f..8ab9bcd 100644
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -1291,6 +1291,7 @@ SCSIRequest *scsi_req_ref(SCSIRequest *req)
void scsi_req_unref(SCSIRequest *req)
{
+ assert(req->refcount > 0);
if (--req->refcount == 0) {
if (req->ops->free_req) {
req->ops->free_req(req);
--
1.7.9.3
- Re: [Qemu-devel] [PATCH 06/14] scsi: change "removable" field to host many features, (continued)
[Qemu-devel] [PATCH 07/14] scsi-disk: add dpofua property, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 08/14] scsi: do not report bogus overruns for commands in the 0x00-0x1F range, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 09/14] scsi: parse 16-byte tape CDBs, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 11/14] scsi: do not require a minimum allocation length for REQUEST SENSE, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 12/14] scsi: set VALID bit to 0 in fixed format sense data, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 13/14] scsi: remove useless debug messages, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 10/14] scsi: do not require a minimum allocation length for INQUIRY, Paolo Bonzini, 2012/05/04
[Qemu-devel] [PATCH 14/14] scsi: Add assertion for use-after-free errors,
Paolo Bonzini <=
Re: [Qemu-devel] [PULL 00/14] SCSI changes for 1.1, Anthony Liguori, 2012/05/08