Re: [PATCH] block/monitor: blk_bs() return value check

[Дмитрий Фролов]

On 24.11.2023 16:06, Kevin Wolf wrote:
> Am 24.11.2023 um 12:30 hat Dmitry Frolov geschrieben:
> > blk_bs() may return NULL, which will be dereferenced without a check in
> > bdrv_commit().
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
> Do you have a reproducer for a crash?
Actually, there was no crash. This problem was found by static analyzer.
> As far as I can see, it will not be dereferenced, because
> blk_is_available() returns false and we return an error before
> calling bdrv_commit():
As I see, there are 2 reasons, why blk_bs() may return NULL:
blk->root == NULL or blk->root->bs == NULL
At the same time, blk_is_available() checks for blk_co_is_inserted(blk) and
blk_dev_is_tray_open(blk).
Does it also guarantee that blk->root and blk->root->bs are not NULL?
This is not really obvious.

Maybe, in this case, it makes sense to check blk->root before of checking
blk_is_available()?
>      QEMU 8.1.91 monitor - type 'help' for more information
>      (qemu) info block
>      ide1-cd0: [not inserted]
>          Attached to:      /machine/unattached/device[6]
>          Removable device: not locked, tray closed
>
>      floppy0: [not inserted]
>          Attached to:      /machine/unattached/device[16]
>          Removable device: not locked, tray closed
>
>      sd0: [not inserted]
>          Removable device: not locked, tray closed
>      (qemu) commit ide1-cd0
>      Device 'ide1-cd0' has no medium
>
> Kevin