Re: [Qemu-stable] [PATCH v6 2/3] block: Fix NULL deference for unaligned write if qiov is NULL

[Fam Zheng]

On Tue, 05/12 13:18, Stefan Hajnoczi wrote:
> On Tue, May 12, 2015 at 02:09:31PM +0800, Fam Zheng wrote:
> > +static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
> > +                                                int64_t offset,
> > +                                                unsigned int bytes,
> > +                                                BdrvRequestFlags flags)
> > +{
> > +    BdrvTrackedRequest req;
> > +    uint8_t *buf = NULL;
> > +    QEMUIOVector local_qiov;
> > +    struct iovec iov;
> > +    uint64_t align = MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
> > +    unsigned int head_padding_bytes, tail_padding_bytes;
> > +    int ret;
> > +
> > +    head_padding_bytes = offset & (align - 1);
> > +    tail_padding_bytes = align - ((offset + bytes) & (align - 1));
> > +    tracked_request_begin(&req, bs, offset, bytes, true);
> > +
> > +    mark_request_serialising(&req, align);
> 
> This is only necessary if (head_padding_bytes || tail_padding_bytes).
> Serialized requests are more expensive so let's only do it when
> necessary.
> 
> > +    wait_serialising_requests(&req);
> > +
> > +    assert(flags & BDRV_REQ_ZERO_WRITE);
> > +    if (head_padding_bytes || tail_padding_bytes) {
> > +        buf = qemu_blockalign(bs, align);
> > +        iov = (struct iovec) {
> > +            .iov_base   = buf,
> > +            .iov_len    = align,
> > +        };
> > +        qemu_iovec_init_external(&local_qiov, &iov, 1);
> > +    }
> > +    if (head_padding_bytes) {
> > +        uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
> > +
> > +        /* RMW the unaligned part before head. */
> > +        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_HEAD);
> > +        ret = bdrv_aligned_preadv(bs, &req, offset & ~(align - 1), align,
> > +                                  align, &local_qiov, 0);
> > +        if (ret < 0) {
> > +            goto fail;
> > +        }
> > +        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
> > +
> > +        memset(buf + head_padding_bytes, 0, zero_bytes);
> > +        ret = bdrv_aligned_pwritev(bs, &req, offset & ~(align - 1), align,
> > +                                   &local_qiov,
> > +                                   flags & ~BDRV_REQ_ZERO_WRITE);
> > +        if (ret < 0) {
> > +            goto fail;
> > +        }
> > +        offset += zero_bytes;
> > +        bytes -= zero_bytes;
> > +    }
> > +
> > +    assert((offset & (align - 1)) == 0);
> > +    if (bytes >= align) {
> > +        /* Write the aligned part in the middle. */
> > +        uint64_t aligned_bytes = bytes & ~(align - 1);
> > +        ret = bdrv_aligned_pwritev(bs, &req, offset, aligned_bytes,
> > +                                   NULL, flags);
> > +        if (ret < 0) {
> > +            goto fail;
> > +        }
> > +        bytes -= aligned_bytes;
> > +        offset += aligned_bytes;
> > +    }
> > +
> > +    assert((offset & (align - 1)) == 0);
> > +    if (bytes) {
> > +        assert(align == tail_padding_bytes + bytes);
> > +        /* RMW the unaligned part after tail. */
> > +        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_TAIL);
> > +        ret = bdrv_aligned_preadv(bs, &req, offset, align,
> > +                                  align, &local_qiov, 0);
> > +        if (ret < 0) {
> > +            goto fail;
> > +        }
> > +        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
> > +
> > +        memset(buf, 0, bytes);
> > +        printf("tail part %ld %d\n", offset, bytes);
> 
> Please drop the debug printf.
> 
> > +        ret = bdrv_aligned_pwritev(bs, &req, offset, align,
> > +                                   &local_qiov, flags & 
> > ~BDRV_REQ_ZERO_WRITE);
> > +    }
> > +fail:
> > +    tracked_request_end(&req);
> > +    if (buf) {
> > +        qemu_vfree(buf);
> > +    }
> 
> if (buf) is unnecessary.  qemu_vfree(NULL) is a nop.

OK, will fix them.

Thanks,
Fam