f2a088a4af
* Fix crash in curl driver. * Add curl timeout option. * Add curl cookie option. - Add upstream commit hashes to patches.
80 lines
2.5 KiB
Diff
80 lines
2.5 KiB
Diff
From a2f468e48f8b6559ec9123e94948bc373b788941 Mon Sep 17 00:00:00 2001
|
|
From: "Richard W.M. Jones" <rjones@redhat.com>
|
|
Date: Thu, 28 Aug 2014 09:04:21 +0100
|
|
Subject: [PATCH] curl: Don't deref NULL pointer in call to aio_poll.
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
In commit 63f0f45f2e89b60ff8245fec81328ddfde42a303 the following
|
|
mechanical change was made:
|
|
|
|
if (!state) {
|
|
- qemu_aio_wait();
|
|
+ aio_poll(state->s->aio_context, true);
|
|
}
|
|
|
|
The new code now checks if state is NULL and then dereferences it
|
|
('state->s') which is obviously incorrect.
|
|
|
|
This commit replaces state->s->aio_context with
|
|
bdrv_get_aio_context(bs), fixing this problem. The two other hunks
|
|
are concerned with getting the BlockDriverState pointer bs to where it
|
|
is needed.
|
|
|
|
The original bug causes a segfault when using libguestfs to access a
|
|
VMware vCenter Server and doing any kind of complex read-heavy
|
|
operations. With this commit the segfault goes away.
|
|
|
|
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
|
|
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
---
|
|
block/curl.c | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/block/curl.c b/block/curl.c
|
|
index 9051bc0..0258339 100644
|
|
--- a/block/curl.c
|
|
+++ b/block/curl.c
|
|
@@ -357,7 +357,7 @@ static void curl_multi_timeout_do(void *arg)
|
|
#endif
|
|
}
|
|
|
|
-static CURLState *curl_init_state(BDRVCURLState *s)
|
|
+static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
|
|
{
|
|
CURLState *state = NULL;
|
|
int i, j;
|
|
@@ -375,7 +375,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
|
|
break;
|
|
}
|
|
if (!state) {
|
|
- aio_poll(state->s->aio_context, true);
|
|
+ aio_poll(bdrv_get_aio_context(bs), true);
|
|
}
|
|
} while(!state);
|
|
|
|
@@ -566,7 +566,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
|
|
DPRINTF("CURL: Opening %s\n", file);
|
|
s->aio_context = bdrv_get_aio_context(bs);
|
|
s->url = g_strdup(file);
|
|
- state = curl_init_state(s);
|
|
+ state = curl_init_state(bs, s);
|
|
if (!state)
|
|
goto out_noclean;
|
|
|
|
@@ -651,7 +651,7 @@ static void curl_readv_bh_cb(void *p)
|
|
}
|
|
|
|
// No cache found, so let's start a new request
|
|
- state = curl_init_state(s);
|
|
+ state = curl_init_state(acb->common.bs, s);
|
|
if (!state) {
|
|
acb->common.cb(acb->common.opaque, -EIO);
|
|
qemu_aio_release(acb);
|
|
--
|
|
2.0.4
|
|
|