From 9156245ec49b36d934ed09d49ffbd5dd37285374 Mon Sep 17 00:00:00 2001 From: Vladimir Sementsov-Ogievskiy Date: Thu, 7 Dec 2017 18:50:57 +0300 Subject: [PATCH 1/2] nbd/server: add additional assert to nbd_export_put This place is not obvious, nbd_export_close may theoretically reduce refcount to 0. It may happen if someone calls nbd_export_put on named export not through nbd_export_set_name when refcount is 1. Signed-off-by: Vladimir Sementsov-Ogievskiy Reviewed-by: Eric Blake Reviewed-by: Max Reitz Message-Id: <20171207155102.66622-2-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake --- nbd/server.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nbd/server.c b/nbd/server.c index e443b3cf5c..6cf2eeb2c1 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -1190,6 +1190,12 @@ void nbd_export_put(NBDExport *exp) nbd_export_close(exp); } + /* nbd_export_close() may theoretically reduce refcount to 0. It may happen + * if someone calls nbd_export_put() on named export not through + * nbd_export_set_name() when refcount is 1. So, let's assert that + * it is > 0. + */ + assert(exp->refcount > 0); if (--exp->refcount == 0) { assert(exp->name == NULL); assert(exp->description == NULL); From 420a4e955909788263a33d11600839e93480dfd3 Mon Sep 17 00:00:00 2001 From: Vladimir Sementsov-Ogievskiy Date: Wed, 22 Nov 2017 13:19:57 +0300 Subject: [PATCH 2/2] nbd: rename nbd_option and nbd_opt_reply Rename nbd_option and nbd_opt_reply to NBDOption and NBDOptionReply to correspond to Qemu coding style and other structures here. Signed-off-by: Vladimir Sementsov-Ogievskiy Reviewed-by: Eric Blake Message-Id: <20171122101958.17065-5-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake --- include/block/nbd.h | 8 ++++---- nbd/client.c | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/include/block/nbd.h b/include/block/nbd.h index 113c707a5e..978e443366 100644 --- a/include/block/nbd.h +++ b/include/block/nbd.h @@ -28,20 +28,20 @@ /* Handshake phase structs - this struct is passed on the wire */ -struct nbd_option { +struct NBDOption { uint64_t magic; /* NBD_OPTS_MAGIC */ uint32_t option; /* NBD_OPT_* */ uint32_t length; } QEMU_PACKED; -typedef struct nbd_option nbd_option; +typedef struct NBDOption NBDOption; -struct nbd_opt_reply { +struct NBDOptionReply { uint64_t magic; /* NBD_REP_MAGIC */ uint32_t option; /* NBD_OPT_* */ uint32_t type; /* NBD_REP_* */ uint32_t length; } QEMU_PACKED; -typedef struct nbd_opt_reply nbd_opt_reply; +typedef struct NBDOptionReply NBDOptionReply; /* Transmission phase structs * diff --git a/nbd/client.c b/nbd/client.c index eea236ca06..89f80f9590 100644 --- a/nbd/client.c +++ b/nbd/client.c @@ -66,7 +66,7 @@ static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt, uint32_t len, const char *data, Error **errp) { - nbd_option req; + NBDOption req; QEMU_BUILD_BUG_ON(sizeof(req) != 16); if (len == -1) { @@ -109,7 +109,7 @@ static void nbd_send_opt_abort(QIOChannel *ioc) * payload. Return 0 if successful, -1 with errp set if it is * impossible to continue. */ static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt, - nbd_opt_reply *reply, Error **errp) + NBDOptionReply *reply, Error **errp) { QEMU_BUILD_BUG_ON(sizeof(*reply) != 20); if (nbd_read(ioc, reply, sizeof(*reply), errp) < 0) { @@ -146,7 +146,7 @@ static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt, * can fall back to other approaches), or -1 with errp set for other * errors. */ -static int nbd_handle_reply_err(QIOChannel *ioc, nbd_opt_reply *reply, +static int nbd_handle_reply_err(QIOChannel *ioc, NBDOptionReply *reply, Error **errp) { char *msg = NULL; @@ -239,7 +239,7 @@ static int nbd_handle_reply_err(QIOChannel *ioc, nbd_opt_reply *reply, static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match, Error **errp) { - nbd_opt_reply reply; + NBDOptionReply reply; uint32_t len; uint32_t namelen; char name[NBD_MAX_NAME_SIZE + 1]; @@ -325,7 +325,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match, static int nbd_opt_go(QIOChannel *ioc, const char *wantname, NBDExportInfo *info, Error **errp) { - nbd_opt_reply reply; + NBDOptionReply reply; uint32_t len = strlen(wantname); uint16_t type; int error; @@ -517,7 +517,7 @@ static int nbd_receive_query_exports(QIOChannel *ioc, */ static int nbd_request_simple_option(QIOChannel *ioc, int opt, Error **errp) { - nbd_opt_reply reply; + NBDOptionReply reply; int error; if (nbd_send_option_request(ioc, opt, 0, NULL, errp) < 0) {