Re: Null dereference in bdrv_unregister_buf() probably memory-backend-file related?

[Stefan Hajnoczi]

On Mon, 21 Nov 2022 at 11:22, Jonathan Cameron via
<qemu-devel@nongnu.org> wrote:
>
> First CC list is a guess as I haven't managed to root cause where things are
> going wrong yet.
>
> Originally hit this whilst rebasing some CXL patches on v7.2.0-rc1.
> CXL makes extensive use of memory-backends and most my tests happen
> to use memory-backend-file
>
> Issue seen on arm64 and x86 though helpfully on x86 the crash appears in an 
> entirely
> unrelated location (though the 'fix' works).
>
> Fairly minimal test command line.
>
> qemu-system-aarch64 \
>     -M virt  \
>     -drive if=none,file=full.qcow2,format=qcow2,id=hd \
>     -device virtio-blk,drive=hd \
>     -object 
> memory-backend-file,id=cxl-mem1,mem-path=/tmp/cxltest.raw,size=256M,align=256M
>  \
>
> Powerdown the machine or ctrl-c during boot gives a segfault.
> On arm64 it was in a stable location that made at least some sense in that
> bs in the below snippet is NULL.
>
> I added the follow work around and the segfault goes away...
>
>  [PATCH] temp
>
> ---
>  block/io.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/block/io.c b/block/io.c
> index b9424024f9..750e1366aa 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -3324,6 +3324,9 @@ void bdrv_unregister_buf(BlockDriverState *bs, void 
> *host, size_t size)
>  {
>      BdrvChild *child;
>
> +    if (!bs) {
> +        return;
> +    }
>      GLOBAL_STATE_CODE();
>      if (bs->drv && bs->drv->bdrv_unregister_buf) {
>          bs->drv->bdrv_unregister_buf(bs, host, size);

bdrv_*() APIs generally don't accept NULL bs arguments.

I think blk_unregister_buf() needs to handle the blk_bs() NULL return
value. Can you confirm that the parent function is
blk_unregister_buf()?

This bug may have been introduced by commit baf422684d73 ("virtio-blk:
use BDRV_REQ_REGISTERED_BUF optimization hint").

Stefan