aboutsummaryrefslogtreecommitdiff
path: root/qemu-io.c
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2011-10-31 11:36:32 +0100
committerKevin Wolf <kwolf@redhat.com>2011-11-04 14:23:36 +0100
commitf2360620fbebc24a0e2d58d0038ed3a007d28521 (patch)
tree1a86cb8b4fb91fd1a20378f3f5aa47fb03f01002 /qemu-io.c
parent932eacc158c064935c7bab920c88a93a629e1ca4 (diff)
qemu-io: Handle create_iovec errors
Callers of create_iovec() didn't check for failure and continued with uninitialised data in error cases. This patch adds checks to each call. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'qemu-io.c')
-rw-r--r--qemu-io.c28
1 files changed, 24 insertions, 4 deletions
diff --git a/qemu-io.c b/qemu-io.c
index 5af887e057..1c49d447aa 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -596,6 +596,9 @@ static int readv_f(int argc, char **argv)
nr_iov = argc - optind;
buf = create_iovec(&qiov, &argv[optind], nr_iov, 0xab);
+ if (buf == NULL) {
+ return 0;
+ }
gettimeofday(&t1, NULL);
cnt = do_aio_readv(&qiov, offset, &total);
@@ -850,6 +853,9 @@ static int writev_f(int argc, char **argv)
nr_iov = argc - optind;
buf = create_iovec(&qiov, &argv[optind], nr_iov, pattern);
+ if (buf == NULL) {
+ return 0;
+ }
gettimeofday(&t1, NULL);
cnt = do_aio_writev(&qiov, offset, &total);
@@ -950,8 +956,8 @@ static int multiwrite_f(int argc, char **argv)
}
}
- reqs = g_malloc(nr_reqs * sizeof(*reqs));
- buf = g_malloc(nr_reqs * sizeof(*buf));
+ reqs = g_malloc0(nr_reqs * sizeof(*reqs));
+ buf = g_malloc0(nr_reqs * sizeof(*buf));
qiovs = g_malloc(nr_reqs * sizeof(*qiovs));
for (i = 0; i < nr_reqs; i++) {
@@ -985,8 +991,12 @@ static int multiwrite_f(int argc, char **argv)
nr_iov = j - optind;
/* Build request */
+ buf[i] = create_iovec(&qiovs[i], &argv[optind], nr_iov, pattern);
+ if (buf[i] == NULL) {
+ goto out;
+ }
+
reqs[i].qiov = &qiovs[i];
- buf[i] = create_iovec(reqs[i].qiov, &argv[optind], nr_iov, pattern);
reqs[i].sector = offset >> 9;
reqs[i].nb_sectors = reqs[i].qiov->size >> 9;
@@ -1014,7 +1024,9 @@ static int multiwrite_f(int argc, char **argv)
out:
for (i = 0; i < nr_reqs; i++) {
qemu_io_free(buf[i]);
- qemu_iovec_destroy(&qiovs[i]);
+ if (reqs[i].qiov != NULL) {
+ qemu_iovec_destroy(&qiovs[i]);
+ }
}
g_free(buf);
g_free(reqs);
@@ -1185,6 +1197,10 @@ static int aio_read_f(int argc, char **argv)
nr_iov = argc - optind;
ctx->buf = create_iovec(&ctx->qiov, &argv[optind], nr_iov, 0xab);
+ if (ctx->buf == NULL) {
+ free(ctx);
+ return 0;
+ }
gettimeofday(&ctx->t1, NULL);
acb = bdrv_aio_readv(bs, ctx->offset >> 9, &ctx->qiov,
@@ -1280,6 +1296,10 @@ static int aio_write_f(int argc, char **argv)
nr_iov = argc - optind;
ctx->buf = create_iovec(&ctx->qiov, &argv[optind], nr_iov, pattern);
+ if (ctx->buf == NULL) {
+ free(ctx);
+ return 0;
+ }
gettimeofday(&ctx->t1, NULL);
acb = bdrv_aio_writev(bs, ctx->offset >> 9, &ctx->qiov,