On Mon, Aug 18, 2014 at 03:49:22PM +0400, Michael Tokarev wrote:
> 14.08.2014 11:29, zhanghailiang wrote:
> > In function virtio_blk_handle_request, it may freed memory pointed by req,
> > So do not access member of req after calling this function.
> >
> > Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
> > Signed-off-by: zhanghailiang <zhang.zhanghaili...@huawei.com>
> > ---
> > hw/block/virtio-blk.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
> > index c241c50..54a853a 100644
> > --- a/hw/block/virtio-blk.c
> > +++ b/hw/block/virtio-blk.c
> > @@ -458,7 +458,7 @@ static void virtio_blk_handle_output(VirtIODevice
> > *vdev, VirtQueue *vq)
> > static void virtio_blk_dma_restart_bh(void *opaque)
> > {
> > VirtIOBlock *s = opaque;
> > - VirtIOBlockReq *req = s->rq;
> > + VirtIOBlockReq *req = s->rq, *next = NULL;
> > MultiReqBuffer mrb = {
> > .num_writes = 0,
> > };
> > @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque)
> > s->rq = NULL;
> >
> > while (req) {
> > + next = req->next;
> > virtio_blk_handle_request(req, &mrb);
> > - req = req->next;
> > + req = next;
> > }
> >
> > virtio_submit_multiwrite(s->bs, &mrb);
>
> So, finally, I've applied this patch:
>
> --- a/hw/block/virtio-blk.c
> +++ b/hw/block/virtio-blk.c
> @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque)
> s->rq = NULL;
>
> while (req) {
> + VirtIOBlockReq *next = req->next;
> virtio_blk_handle_request(req, &mrb);
> - req = req->next;
> + req = next;
> }
>
> virtio_submit_multiwrite(s->bs, &mrb);
>
> and dropped Stefan's Reviewed-by on the way ;)
>
> This is a bugfix after all ;)
>
> Thanks,
>
> /mjt
By the way, could you please add Cc qemu-stable on bugfixes
you have queued?
These are likely appopriate for 2.1.1.
--
MST
