@samitouri / QOSamiQemu / commits / a55402d5c3

block: Fix crash after setting latency historygram with single bin

Passing an empty list of boundaries to block-latency-histogram-set sets up a state that leads to a NULL pointer dereference when the next request should be accounted for. This is not a useful configuration, so just error out if the user tries to set it. The crash can easily be reproduced with the following script: qmp() { cat <<EOF {'execute':'qmp_capabilities'} {'execute':'block-latency-histogram-set', 'arguments': {'id':'ide0','boundaries':[]}} {'execute':'cont'} EOF } qmp | ./qemu-system-x86_64 -S -qmp stdio \ -drive if=none,format=raw,file=null-co:// \ -device ide-hd,drive=none0,id=ide0 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20260331102608.60882-1-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Kevin Wolf committed Mar 31, 2026 at 12:26 UTC a55402d5c3a8c63c801de86896f86c9abeda0ca8

1 file changed +9

block/accounting.c

@@ -185,6 +185,15 @@ int block_latency_histogram_set(BlockAcctStats *stats, enum BlockAcctType type,

185 prev = entry->value;

186 }

187

188 + /*

189 + * block_latency_histogram_account() assumes that it can always access

190 + * hist->boundaries[0], so require at least one boundary. A histogram with

191 + * a single bin is useless anyway.

192 + */

193 + if (new_nbins <= 1) {

194 + return -EINVAL;

195 + }

196 +

197 hist->nbins = new_nbins;

198 g_free(hist->boundaries);

199 hist->boundaries = g_new(uint64_t, hist->nbins - 1);