From: Prasad J Pandit <p...@fedoraproject.org> When processing ATA_CACHE_FLUSH ide controller command, BlockDriverState object could be null. Add check to avoid null pointer dereference.
Reported-by: Kieron Shorrock <kshorr...@paloaltonetworks.com> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- block/block-backend.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/block/block-backend.c b/block/block-backend.c index 0df3457..6a543a4 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -1168,8 +1168,13 @@ static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes, { BlkAioEmAIOCB *acb; Coroutine *co; + BlockDriverState *bs = blk_bs(blk); - bdrv_inc_in_flight(blk_bs(blk)); + if (!bs) { + return NULL; + } + + bdrv_inc_in_flight(bs); acb = blk_aio_get(&blk_aio_em_aiocb_info, blk, cb, opaque); acb->rwco = (BlkRwCo) { .blk = blk, @@ -1182,7 +1187,7 @@ static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes, acb->has_returned = false; co = qemu_coroutine_create(co_entry, acb); - bdrv_coroutine_enter(blk_bs(blk), co); + bdrv_coroutine_enter(bs, co); acb->has_returned = true; if (acb->rwco.ret != NOT_DONE) { -- 2.9.4