From b278dc132d1ba787d68c98533f85f807034f5f2e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 28 Feb 2012 12:58:04 +0100 Subject: [PATCH 06/12] ide: fail I/O to empty disk RH-Author: Paolo Bonzini Message-id: <1330433884-21738-1-git-send-email-pbonzini@redhat.com> Patchwork-id: 37673 O-Subject: [RHEL 6.3 qemu-kvm PATCH] ide: fail I/O to empty disk Bugzilla: 751937 RH-Acked-by: Laszlo Ersek RH-Acked-by: Markus Armbruster RH-Acked-by: Kevin Wolf Bugzilla: 751937 Upstream status: in Kevin's block branch Brew build: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=4092755 Requesting a read or a write operation on an empty disk can lead to QEMU dumping core. Also fix a few braces here and there. Doesn't reproduce always, but it survived a 24-hours iofuzz run in QE's tests. Signed-off-by: Paolo Bonzini --- hw/ide/core.c | 24 ++++++++++++++++++++---- 1 files changed, 20 insertions(+), 4 deletions(-) Signed-off-by: Michal Novotny --- hw/ide/core.c | 24 ++++++++++++++++++++---- 1 files changed, 20 insertions(+), 4 deletions(-) diff --git a/hw/ide/core.c b/hw/ide/core.c index 8843972..4ed5b57 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -1129,6 +1129,9 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */ goto abort_cmd; } + if (!s->bs) { + goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); s->req_nb_sectors = 1; ide_sector_read(s); @@ -1139,6 +1142,9 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) case WIN_WRITE_ONCE: case CFA_WRITE_SECT_WO_ERASE: case WIN_WRITE_VERIFY: + if (!s->bs) { + goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); s->error = 0; s->status = SEEK_STAT | READY_STAT; @@ -1149,8 +1155,12 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) case WIN_MULTREAD_EXT: lba48 = 1; case WIN_MULTREAD: - if (!s->mult_sectors) + if (!s->bs) { goto abort_cmd; + } + if (!s->mult_sectors) { + goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); s->req_nb_sectors = s->mult_sectors; ide_sector_read(s); @@ -1159,8 +1169,12 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) lba48 = 1; case WIN_MULTWRITE: case CFA_WRITE_MULTI_WO_ERASE: - if (!s->mult_sectors) + if (!s->bs) { goto abort_cmd; + } + if (!s->mult_sectors) { + goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); s->error = 0; s->status = SEEK_STAT | READY_STAT; @@ -1175,8 +1189,9 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) lba48 = 1; case WIN_READDMA: case WIN_READDMA_ONCE: - if (!s->bs) + if (!s->bs) { goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); ide_sector_read_dma(s); break; @@ -1184,8 +1199,9 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) lba48 = 1; case WIN_WRITEDMA: case WIN_WRITEDMA_ONCE: - if (!s->bs) + if (!s->bs) { goto abort_cmd; + } ide_cmd_lba48_transform(s, lba48); ide_sector_write_dma(s); s->media_changed = 1; -- 1.7.7.6