Commit a7607150 authored Jun 25, 2014 by Michal Privoznik Committed by Kevin Wolf Jun 26, 2014

qemu_opts_append: Play nicely with QemuOptsList's head



When running a libvirt test suite I've noticed the qemu-img is
crashing occasionally. Tracing the problem down led me to the
following valgrind output:

qemu.git $ valgrind -q ./qemu-img create -f qed -obacking_file=/dev/null,backing_fmt=raw qed
==14881== Invalid write of size 8
==14881==    at 0x1D263F: qemu_opts_create (qemu-option.c:692)
==14881==    by 0x130782: bdrv_img_create (block.c:5531)
==14881==    by 0x118DE0: img_create (qemu-img.c:462)
==14881==    by 0x11E7E4: main (qemu-img.c:2830)
==14881==  Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd
==14881==    at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14881==    by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==14881==    by 0x1D38D8: qemu_opts_append (qemu-option.c:1129)
==14881==    by 0x13075E: bdrv_img_create (block.c:5528)
==14881==    by 0x118DE0: img_create (qemu-img.c:462)
==14881==    by 0x11E7E4: main (qemu-img.c:2830)
==14881==
Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' cluster_size=65536
==14881== Invalid write of size 8
==14881==    at 0x1D28BE: qemu_opts_del (qemu-option.c:750)
==14881==    by 0x130BF3: bdrv_img_create (block.c:5638)
==14881==    by 0x118DE0: img_create (qemu-img.c:462)
==14881==    by 0x11E7E4: main (qemu-img.c:2830)
==14881==  Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd
==14881==    at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14881==    by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==14881==    by 0x1D38D8: qemu_opts_append (qemu-option.c:1129)
==14881==    by 0x13075E: bdrv_img_create (block.c:5528)
==14881==    by 0x118DE0: img_create (qemu-img.c:462)
==14881==    by 0x11E7E4: main (qemu-img.c:2830)
==14881==

The problem is apparently in the qemu_opts_append(). Well, if it
gets called twice or more. On the first call, when @dst is NULL
some initialization is done during which @dst->head list gets
initialized. The list is initialized in a way, so that the list
tail points at the list head. However, the next time
qemu_opts_append() is called for new options to be added,
g_realloc() may move @dst to a new address making the old list tail
point at an invalid address. If that's the case, we must update the
list pointers.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

parent 20cca275

util/qemu-option.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -1111,6 +1111,7 @@ QemuOptsList qemu_opts_append(QemuOptsList dst,
		size_t num_opts, num_dst_opts;
		QemuOptDesc *desc;
		bool need_init = false;
		bool need_head_update;

		if (!list) {
		return dst;
		@@ -1121,6 +1122,12 @@ QemuOptsList qemu_opts_append(QemuOptsList dst,
		*/
		if (!dst) {
		need_init = true;
		need_head_update = true;
		} else {
		/* Moreover, even if dst is not NULL, the realloc may move it to a
		* different address in which case we may get a stale tail pointer
		* in dst->head. */
		need_head_update = QTAILQ_EMPTY(&dst->head);
		}

		num_opts = count_opts_list(dst);
		@@ -1131,9 +1138,11 @@ QemuOptsList qemu_opts_append(QemuOptsList dst,
		if (need_init) {
		dst->name = NULL;
		dst->implied_opt_name = NULL;
		QTAILQ_INIT(&dst->head);
		dst->merge_lists = false;
		}
		if (need_head_update) {
		QTAILQ_INIT(&dst->head);
		}
		dst->desc[num_dst_opts].name = NULL;

		/* append list->desc to dst->desc */