[Qemu-commits] [qemu/qemu] 6d7591: block: fix null-pointer bug on error case in block...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 6d759117d3fd28e38c49c56c9de206cc718d32fa
      
https://github.com/qemu/qemu/commit/6d759117d3fd28e38c49c56c9de206cc718d32fa
  Author: Jeff Cody <address@hidden>
  Date:   2013-01-17 (Thu, 17 Jan 2013)

  Changed paths:
    M block/commit.c

  Log Message:
  -----------
  block: fix null-pointer bug on error case in block commit

This is a bug that was caught by a coverity run by Markus.  In
the error case when we errored out to exit_restore_open early in the
function, 'overlay_bs' was still NULL at that point, although it is
used to look up flags and perform a bdrv_reopen().

Move the overlay_bs lookup to where it is needed, and check for NULL
before restoring the flags.  Also get rid of the unneeded parameter
initialization.

Reported-By: Markus Armbruster <address@hidden>
Signed-off-by: Jeff Cody <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 6bf3ee07ff55aa795010a8e071826f38e9a26112
      
https://github.com/qemu/qemu/commit/6bf3ee07ff55aa795010a8e071826f38e9a26112
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-17 (Thu, 17 Jan 2013)

  Changed paths:
    M hw/ide/pci.c

  Log Message:
  -----------
  ide: Remove wrong assertion

The Bus Master IDE Active bit (BM_STATUS_DMAING) is not only set when
the request is still in flight, but also when it has completed and the
size of the physical memory regions in the PRDT was larger than the
transfer size.

Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 2ea9b58f0bc62445b7ace2381b4c4db7d5597e19
      
https://github.com/qemu/qemu/commit/2ea9b58f0bc62445b7ace2381b4c4db7d5597e19
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-17 (Thu, 17 Jan 2013)

  Changed paths:
    M aio-posix.c
    M aio-win32.c
    M include/block/aio.h
    M tests/test-aio.c

  Log Message:
  -----------
  aio: Fix return value of aio_poll()

aio_poll() must return true if any work is still pending, even if it
didn't make progress, so that bdrv_drain_all() doesn't stop waiting too
early. The possibility of stopping early occasionally lead to a failed
assertion in bdrv_drain_all(), when some in-flight request was missed
and the function didn't really drain all requests.

In order to make that change, the return value as specified in the
function comment must change for blocking = false; fortunately, the
return value of blocking = false callers is only used in test cases, so
this change shouldn't cause any trouble.

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: bcbbd234d42f1111e42b91376db61922d42e7e9e
      
https://github.com/qemu/qemu/commit/bcbbd234d42f1111e42b91376db61922d42e7e9e
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-17 (Thu, 17 Jan 2013)

  Changed paths:
    M block/win32-aio.c

  Log Message:
  -----------
  win32-aio: Fix vectored reads

Copying data in the right direction really helps a lot!

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: e8bccad5ac6095b5af7946cd72d9aacb57f7c0a3
      
https://github.com/qemu/qemu/commit/e8bccad5ac6095b5af7946cd72d9aacb57f7c0a3
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-17 (Thu, 17 Jan 2013)

  Changed paths:
    M block/win32-aio.c

  Log Message:
  -----------
  win32-aio: Fix memory leak

The buffer is allocated for both reads and writes, and obviously it
should be freed even if an error occurs.

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 3249dbe661ba6ef108ecde97c54b4a4104d719c3
      
https://github.com/qemu/qemu/commit/3249dbe661ba6ef108ecde97c54b4a4104d719c3
  Author: Michael Tokarev <address@hidden>
  Date:   2013-01-18 (Fri, 18 Jan 2013)

  Changed paths:
    M block/win32-aio.c

  Log Message:
  -----------
  win32-aio: use iov utility functions instead of open-coding them

We have iov_from_buf() and iov_to_buf(), use them instead of
open-coding these in block/win32-aio.c

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: cd7fdfe59f4f965665dcd9868fe3764f5256d6aa
      
https://github.com/qemu/qemu/commit/cd7fdfe59f4f965665dcd9868fe3764f5256d6aa
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2013-01-18 (Fri, 18 Jan 2013)

  Changed paths:
    M hw/dataplane/virtio-blk.c

  Log Message:
  -----------
  dataplane: avoid reentrancy during virtio_blk_data_plane_stop()

When dataplane is stopping, the s->vdev->binding->set_host_notifier(...,
false) call can invoke the virtqueue handler if an ioeventfd
notification is pending.  This causes hw/virtio-blk.c to invoke
virtio_blk_data_plane_start() before virtio_blk_data_plane_stop()
returns!

The result is that we try to restart dataplane while trying to stop it
and the following assertion is raised:

  msix_set_mask_notifier: Assertion `!dev->msix_mask_notifier' failed.

Although the code was intended to prevent this scenario, the s->started
boolean isn't enough.  Add s->stopping so that we can postpone clearing
s->started until we've completely stopped dataplane.

This way, virtqueue handler calls during virtio_blk_data_plane_stop()
are ignored.  When dataplane is legitimately started again later we
already self-kick ourselves to resume processing.

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: cf139388ad5b39228793f34eea99e0ea9a2924aa
      
https://github.com/qemu/qemu/commit/cf139388ad5b39228793f34eea99e0ea9a2924aa
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2013-01-18 (Fri, 18 Jan 2013)

  Changed paths:
    M hw/virtio-blk.c

  Log Message:
  -----------
  dataplane: support viostor virtio-pci status bit setting

The viostor virtio-blk driver for Windows does not use the
VIRTIO_CONFIG_S_DRIVER bit.  It only sets the VIRTIO_CONFIG_S_DRIVER_OK
bit.

The viostor driver refreshes the virtio-pci status byte sometimes while
the guest is running.  We misinterpret 0x4 (VIRTIO_CONFIG_S_DRIVER_OK)
as an indication that virtio-blk-data-plane should be stopped since 0x2
(VIRTIO_CONFIG_S_DRIVER) is missing.  The result is that the device
becomes unresponsive.

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 8b17ed4caa7e015324a4ecbe3c863e32458d840a
      
https://github.com/qemu/qemu/commit/8b17ed4caa7e015324a4ecbe3c863e32458d840a
  Author: Anthony Liguori <address@hidden>
  Date:   2013-01-20 (Sun, 20 Jan 2013)

  Changed paths:
    M aio-posix.c
    M aio-win32.c
    M block/commit.c
    M block/win32-aio.c
    M hw/dataplane/virtio-blk.c
    M hw/ide/pci.c
    M hw/virtio-blk.c
    M include/block/aio.h
    M tests/test-aio.c

  Log Message:
  -----------
  Merge remote-tracking branch 'stefanha/block' into staging

# By Kevin Wolf (4) and others
# Via Stefan Hajnoczi
* stefanha/block:
  dataplane: support viostor virtio-pci status bit setting
  dataplane: avoid reentrancy during virtio_blk_data_plane_stop()
  win32-aio: use iov utility functions instead of open-coding them
  win32-aio: Fix memory leak
  win32-aio: Fix vectored reads
  aio: Fix return value of aio_poll()
  ide: Remove wrong assertion
  block: fix null-pointer bug on error case in block commit


Compare: https://github.com/qemu/qemu/compare/b54c2873e731...8b17ed4caa7e