starred/qemu-qemu-1
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-05 21:46:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

block: Fix crash after setting latency historygram with single bin

Browse Source 
Passing an empty list of boundaries to block-latency-histogram-set sets
up a state that leads to a NULL pointer dereference when the next
request should be accounted for. This is not a useful configuration, so
just error out if the user tries to set it.

The crash can easily be reproduced with the following script:

    qmp() {
    cat <<EOF
    {'execute':'qmp_capabilities'}
    {'execute':'block-latency-histogram-set',
     'arguments': {'id':'ide0','boundaries':[]}}
    {'execute':'cont'}
    EOF
    }

    qmp | ./qemu-system-x86_64 -S -qmp stdio \
        -drive if=none,format=raw,file=null-co:// \
        -device ide-hd,drive=none0,id=ide0

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20260331102608.60882-1-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Kevin Wolf
2026-03-31 12:26:08 +02:00
parent 99bfc1c754
commit a55402d5c3
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
block/accounting.c
View File

@@ -185,6 +185,15 @@ int block_latency_histogram_set(BlockAcctStats *stats, enum BlockAcctType type,
prev = entry->value; prev = entry->value;
} }
/*
* block_latency_histogram_account() assumes that it can always access
* hist->boundaries[0], so require at least one boundary. A histogram with
* a single bin is useless anyway.
*/
if (new_nbins <= 1) {
return -EINVAL;
}
hist->nbins = new_nbins; hist->nbins = new_nbins;
g_free(hist->boundaries); g_free(hist->boundaries);
hist->boundaries = g_new(uint64_t, hist->nbins - 1); hist->boundaries = g_new(uint64_t, hist->nbins - 1);