aboutsummaryrefslogtreecommitdiff
path: root/qemu-img.c
diff options
context:
space:
mode:
authorsochin.jiang <sochin.jiang@huawei.com>2017-06-15 14:47:33 +0800
committerMax Reitz <mreitz@redhat.com>2017-06-26 14:54:46 +0200
commit4172a00373b2c81374293becc02b16b7f8c76659 (patch)
treefd448d57f39b13a48460c626bc6d3a49e6e7ccca /qemu-img.c
parentf5a5ca796932d04cb2a1cb9382a55f72795b3e06 (diff)
fix: avoid an infinite loop or a dangling pointer problem in img_commit
img_commit could fall into an infinite loop calling run_block_job() if its blockjob fails on any I/O error, fix this already known problem. Signed-off-by: sochin.jiang <sochin.jiang@huawei.com> Message-id: 1497509253-28941-1-git-send-email-sochin.jiang@huawei.com Signed-off-by: Max Reitz <mreitz@redhat.com>
Diffstat (limited to 'qemu-img.c')
-rw-r--r--qemu-img.c20
1 files changed, 13 insertions, 7 deletions
diff --git a/qemu-img.c b/qemu-img.c
index 0ad698d7f1..e70d5155e4 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -887,22 +887,28 @@ static void common_block_job_cb(void *opaque, int ret)
static void run_block_job(BlockJob *job, Error **errp)
{
AioContext *aio_context = blk_get_aio_context(job->blk);
+ int ret = 0;
- /* FIXME In error cases, the job simply goes away and we access a dangling
- * pointer below. */
aio_context_acquire(aio_context);
+ block_job_ref(job);
do {
aio_poll(aio_context, true);
qemu_progress_print(job->len ?
((float)job->offset / job->len * 100.f) : 0.0f, 0);
- } while (!job->ready);
+ } while (!job->ready && !job->completed);
- block_job_complete_sync(job, errp);
+ if (!job->completed) {
+ ret = block_job_complete_sync(job, errp);
+ } else {
+ ret = job->ret;
+ }
+ block_job_unref(job);
aio_context_release(aio_context);
- /* A block job may finish instantaneously without publishing any progress,
- * so just signal completion here */
- qemu_progress_print(100.f, 0);
+ /* publish completion progress only when success */
+ if (!ret) {
+ qemu_progress_print(100.f, 0);
+ }
}
static int img_commit(int argc, char **argv)