Commit 113fe792 authored by Jeff Cody's avatar Jeff Cody Committed by Kevin Wolf
Browse files

block/nfs: fix mutex assertion in nfs_file_close() 



Commit c096358e introduced assertion
checks for when qemu_mutex() functions are called without the
corresponding qemu_mutex_init() having initialized the mutex.

This uncovered a latent bug in qemu's nfs driver - in
nfs_client_close(), the NFSClient structure is overwritten with zeros,
prior to the mutex being destroyed.

Go ahead and destroy the mutex in nfs_client_close(), and change where
we call qemu_mutex_init() so that it is correctly balanced.

There are also a couple of memory leaks obscured by the memset, so this
fixes those as well.

Finally, we should be able to get rid of the memset(), as it isn't
necessary.

Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarJeff Cody <jcody@redhat.com>
Reviewed-by: default avatarPeter Lieven <pl@kamp.de>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarJohn Snow <jsnow@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent ea22b7a2

block/nfs.c

+8 −3
Original line number Diff line number Diff line
@@ -433,19 +433,23 @@ static void nfs_client_close(NFSClient *client) 
    if (client->context) {

        if (client->fh) {

            nfs_close(client->context, client->fh);

            client->fh = NULL;

        }

        aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),

                           false, NULL, NULL, NULL, NULL);

        nfs_destroy_context(client->context);

        client->context = NULL;

    }

    memset(client, 0, sizeof(NFSClient));

    g_free(client->path);

    qemu_mutex_destroy(&client->mutex);

    qapi_free_NFSServer(client->server);

    client->server = NULL;

}



static void nfs_file_close(BlockDriverState *bs)

{

    NFSClient *client = bs->opaque;

    nfs_client_close(client);

    qemu_mutex_destroy(&client->mutex);

}



static NFSServer *nfs_config(QDict *options, Error **errp)
@@ -498,6 +502,7 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options, 
    struct stat st;

    char *file = NULL, *strp = NULL;



    qemu_mutex_init(&client->mutex);

    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);

    qemu_opts_absorb_qdict(opts, options, &local_err);

    if (local_err) {
@@ -660,7 +665,7 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags, 
    if (ret < 0) {

        return ret;

    }

    qemu_mutex_init(&client->mutex);



    bs->total_sectors = ret;

    ret = 0;

    return ret;