All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths
@ 2018-06-21 22:21 Nishanth Aravamudan
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
  2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
  0 siblings, 2 replies; 8+ messages in thread
From: Nishanth Aravamudan @ 2018-06-21 22:21 UTC (permalink / raw)
  To: naravamudan
  Cc: Eric Blake, Kevin Wolf, John Snow, Max Reitz, Stefan Hajnoczi,
	Fam Zheng, Paolo Bonzini, qemu-block, qemu-devel

laio_init() can fail for a couple of reasons, which will lead to a NULL
pointer dereference in laio_attach_aio_context(), called from
aio_get_linux_aio().

Test case 1:
    Set /proc/sys/fs/max-aio-nr to 0. Start a guest with an aio=native
    disk.

    Result: laio_init() returns NULL due to not being able to allocate
    any AIO contexts. This NULL is assigned to ctx->linux_aio and
    dereferenced in aio_get_linux_aio.

Test case 2:
    Set /proc/sys/fs/max-aio-nr to 128. Start a guest with an aio=native
    disk and one in-use I/O thread.

    Result: laio_init() returns NULL due to not being able to allocate
    additional AIO contexts for the I/O thread. This NULL is assigned to
    ctx->linux_aio and dereferenced in aio_get_linux_aio.

Thanks to Jon Snow, Eric Blake and Kevin Wolf for review comments on v1
and v2.

Nishanth Aravamudan (2):
  linux-aio: properly bubble up errors from initialization
  file-posix: reconfigure aio on iothread start

 block/file-posix.c      | 33 ++++++++++++++++++++++++++++-----
 block/linux-aio.c       | 15 ++++++++++-----
 include/block/aio.h     |  3 +++
 include/block/raw-aio.h |  2 +-
 stubs/linux-aio.c       |  2 +-
 util/async.c            | 16 +++++++++++++---
 6 files changed, 56 insertions(+), 15 deletions(-)

-- 
2.17.1

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2018-06-22 17:12 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-21 22:21 [Qemu-devel] [PATCH v3 0/2] linux-aio: fix two NULL pointer dereferences failure paths Nishanth Aravamudan
2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 1/2] linux-aio: properly bubble up errors from initialization Nishanth Aravamudan
2018-06-22  2:21   ` Fam Zheng
2018-06-22 17:12     ` Nishanth Aravamudan
2018-06-21 22:21 ` [Qemu-devel] [PATCH v3 2/2] block/file-posix: reconfigure aio on iothread start Nishanth Aravamudan
2018-06-22  2:25   ` Fam Zheng
2018-06-22  9:02     ` Kevin Wolf
2018-06-22 17:12       ` Nishanth Aravamudan

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.