Michal Privoznik a760715095 qemu_opts_append: Play nicely with QemuOptsList's head ... When running a libvirt test suite I've noticed the qemu-img is crashing occasionally. Tracing the problem down led me to the following valgrind output: qemu.git $ valgrind -q ./qemu-img create -f qed -obacking_file=/dev/null,backing_fmt=raw qed ==14881== Invalid write of size 8 ==14881== at 0x1D263F: qemu_opts_create (qemu-option.c:692) ==14881== by 0x130782: bdrv_img_create (block.c:5531) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Formatting 'qed', fmt=qed size=0 backing_file='/dev/null' backing_fmt='raw' cluster_size=65536 ==14881== Invalid write of size 8 ==14881== at 0x1D28BE: qemu_opts_del (qemu-option.c:750) ==14881== by 0x130BF3: bdrv_img_create (block.c:5638) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== Address 0x11fedd38 is 24 bytes inside a block of size 232 free'd ==14881== at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14881== by 0x592D35E: g_realloc (in /usr/lib64/libglib-2.0.so.0.3800.2) ==14881== by 0x1D38D8: qemu_opts_append (qemu-option.c:1129) ==14881== by 0x13075E: bdrv_img_create (block.c:5528) ==14881== by 0x118DE0: img_create (qemu-img.c:462) ==14881== by 0x11E7E4: main (qemu-img.c:2830) ==14881== The problem is apparently in the qemu_opts_append(). Well, if it gets called twice or more. On the first call, when @dst is NULL some initialization is done during which @dst->head list gets initialized. The list is initialized in a way, so that the list tail points at the list head. However, the next time qemu_opts_append() is called for new options to be added, g_realloc() may move @dst to a new address making the old list tail point at an invalid address. If that's the case, we must update the list pointers. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>		2014-06-26 15:53:52 +02:00
..
acl.c
aes.c	util: Add InvMixColumns	2014-06-16 13:24:33 +02:00
bitmap.c
bitops.c
compatfd.c
crc32c.c
cutils.c
envlist.c
error.c
event_notifier-posix.c
event_notifier-win32.c
fifo8.c
getauxval.c	qemu/osdep: Remove the need for qemu_init_auxval	2014-06-23 07:32:27 -07:00
hbitmap.c
hexdump.c
host-utils.c
iov.c	util: add return value to qemu_iovec_concat_iov	2014-06-18 08:47:10 +02:00
Makefile.objs	tcg-ppc: Merge cache-utils into the backend	2014-06-23 07:32:30 -07:00
module.c
notify.c
osdep.c
oslib-posix.c	memory: move preallocation code out of exec.c	2014-06-19 18:44:19 +03:00
oslib-win32.c	pc,pci,virtio,hotplug fixes, enhancements	2014-06-20 18:01:24 +01:00
path.c
qemu-config.c	qapi: output def_value_str when query command line options	2014-06-16 17:23:20 +08:00
qemu-error.c
qemu-openpty.c
qemu-option.c	qemu_opts_append: Play nicely with QemuOptsList's head	2014-06-26 15:53:52 +02:00
qemu-progress.c
qemu-sockets.c	qapi event: convert SPICE events	2014-06-23 11:12:28 -04:00
qemu-thread-posix.c
qemu-thread-win32.c
qemu-timer-common.c
readline.c
rfifolock.c
throttle.c
unicode.c
uri.c