Skip to content
  • Stefano Garzarella's avatar
    block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts() · 66fed30c
    Stefano Garzarella authored and Hanna Czenczek's avatar Hanna Czenczek committed
    In mirror_iteration() we call mirror_wait_on_conflicts() with
    `self` parameter set to NULL.
    
    Starting from commit d44dae1a we dereference `self` pointer in
    mirror_wait_on_conflicts() without checks if it is not NULL.
    
    Backtrace:
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
          at ../block/mirror.c:172
      172	                self->waiting_for_op = op;
      [Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))]
      (gdb) bt
      #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
          at ../block/mirror.c:172
      #1  0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=<optimized out>) at ../block/mirror.c:491
      #2  0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917
      #3  0x00005610c5f046c6 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>)
          at ../util/coroutine-ucontext.c:173
      #4  0x00007f0909975820 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91
          from /usr/lib64/libc.so.6
    
    Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404
    Fixes: d44dae1a
    
     ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts")
    Signed-off-by: Stefano Garzarella's avatarStefano Garzarella <sgarzare@redhat.com>
    Message-Id: <20210910124533.288318-1-sgarzare@redhat.com>
    Reviewed-by: default avatarVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
    Signed-off-by: default avatarHanna Reitz <hreitz@redhat.com>
    66fed30c