« Previous | Next » 

Revision 68bd348a

ID68bd348ade453821fd5378479e6718e69bf181f1

Added by Stefan Weil almost 12 years ago

scsi: Add assertion for use-after-free errors

The QEMU emulation which is currently used with Raspberry PI images
(qemu-system-arm -M versatilepb ...) accesses memory which was freed.

Valgrind output (extract):

17857 Invalid write of size 4
17857 at 0x24EB06: scsi_req_unref (scsi-bus.c:1273)
17857 by 0x24FFAE: scsi_read_complete (scsi-disk.c:277)
17857 by 0x152ACC: bdrv_co_em_bh (block.c:3363)
17857 by 0x13D49C: qemu_bh_poll (async.c:71)
17857 by 0x211A8C: main_loop_wait (main-loop.c:503)
17857 by 0x207954: main_loop (vl.c:1555)
17857 by 0x20E9C9: main (vl.c:3653)
17857 Address 0x1c54383c is 12 bytes inside a block of size 260 free'd
17857 at 0x4824B3A: free (vg_replace_malloc.c:366)
17857 by 0x20ADFA: free_and_trace (vl.c:2250)
17857 by 0x4899FC5: g_free (in /lib/libglib-2.0.so.0.2400.1)
17857 by 0x24EB3B: scsi_req_unref (scsi-bus.c:1277)
17857 by 0x24F003: scsi_req_complete (scsi-bus.c:1383)
17857 by 0x25022A: scsi_read_data (scsi-disk.c:334)
17857 by 0x24EB9F: scsi_req_continue (scsi-bus.c:1289)
17857 by 0x1C7787: lsi_do_dma (lsi53c895a.c:575)
17857 by 0x1C8CDA: lsi_execute_script (lsi53c895a.c:1147)
17857 by 0x1C74EA: lsi_resume_script (lsi53c895a.c:510)
17857 by 0x1C7ECD: lsi_transfer_data (lsi53c895a.c:746)
17857 by 0x24EC90: scsi_req_data (scsi-bus.c:1307)

(There are some more similar messages.)

This patch adds an assertion which also detects those errors:

Calling scsi_req_unref is not allowed when the previous call
of that function has decremented refcount to 0, because in this
case req was freed.

Signed-off-by: Stefan Weil <>
Signed-off-by: Paolo Bonzini <>

Files

  • added
  • modified
  • copied
  • renamed
  • deleted

View differences