[libvirt] [PATCH] qemu: Fix crash when using shared cdrom or floppy disk without source

How to reproduce the crash: * Start a guest with a disk like: <disk type='block' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hdc' bus='ide'/> <readonly/> <shareable/> <address type='drive' controller='0' bus='1' target='0' unit='0'/> </disk> It's caused by disk->src for this disk is NULL. This patch fixes it. --- src/qemu/qemu_process.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index a2ce007..d1872c0 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3837,7 +3837,9 @@ int qemuProcessStart(virConnectPtr conn, _("Raw I/O is not supported on this platform")); #endif - if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && disk->shared) { + if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && + disk->shared && + disk->src) { if (qemuAddSharedDisk(driver->sharedDisks, disk->src) < 0) goto cleanup; @@ -4246,7 +4248,9 @@ void qemuProcessStop(virQEMUDriverPtr driver, for (i = 0; i < vm->def->ndisks; i++) { virDomainDiskDefPtr disk = vm->def->disks[i]; - if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && disk->shared) { + if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && + disk->shared && + disk->src) { ignore_value(qemuRemoveSharedDisk(driver->sharedDisks, disk->src)); } } -- 1.7.7.6

On Thu, Feb 07, 2013 at 09:04:18PM +0800, Osier Yang wrote:
How to reproduce the crash:
* Start a guest with a disk like:
<disk type='block' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hdc' bus='ide'/> <readonly/> <shareable/> <address type='drive' controller='0' bus='1' target='0' unit='0'/> </disk>
It's caused by disk->src for this disk is NULL. This patch fixes it. --- src/qemu/qemu_process.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index a2ce007..d1872c0 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3837,7 +3837,9 @@ int qemuProcessStart(virConnectPtr conn, _("Raw I/O is not supported on this platform")); #endif
- if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && disk->shared) { + if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && + disk->shared && + disk->src) { if (qemuAddSharedDisk(driver->sharedDisks, disk->src) < 0) goto cleanup;
@@ -4246,7 +4248,9 @@ void qemuProcessStop(virQEMUDriverPtr driver, for (i = 0; i < vm->def->ndisks; i++) { virDomainDiskDefPtr disk = vm->def->disks[i];
- if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && disk->shared) { + if (disk->type == VIR_DOMAIN_DISK_TYPE_BLOCK && + disk->shared && + disk->src) { ignore_value(qemuRemoveSharedDisk(driver->sharedDisks, disk->src)); } }
ACK, though this isn't the only crash in this code - the crash I reported occurs when you issue a 'change media' request on a CDROM. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
participants (2)
-
Daniel P. Berrange
-
Osier Yang