[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [STABLE 0.13][PATCH 12/13] vvfat: Fix double free for openi
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [STABLE 0.13][PATCH 12/13] vvfat: Fix double free for opening the image rw |
Date: |
Mon, 13 Sep 2010 14:42:50 +0200 |
From: Kevin Wolf <address@hidden>
Allocation and deallocation of bs->opaque is not in the control of a
block driver. Therefore it should not set bs->opaque to a data structure
used by another bs, or closing the image will lead to a double free.
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 0af1e52e93bf5da63b15f1f9596dd4c076da07dc)
---
block/vvfat.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/block/vvfat.c b/block/vvfat.c
index 5898d66..0772037 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -2768,12 +2768,12 @@ static int vvfat_is_allocated(BlockDriverState *bs,
static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
const uint8_t* buffer, int nb_sectors) {
- BDRVVVFATState* s = bs->opaque;
+ BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
return try_commit(s);
}
static void write_target_close(BlockDriverState *bs) {
- BDRVVVFATState* s = bs->opaque;
+ BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
bdrv_delete(s->qcow);
free(s->qcow_filename);
}
@@ -2816,7 +2816,8 @@ static int enable_write_target(BDRVVVFATState *s)
s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
s->bs->backing_hd->drv = &vvfat_write_target;
- s->bs->backing_hd->opaque = s;
+ s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
+ *(void**)s->bs->backing_hd->opaque = s;
return 0;
}
--
1.7.2.2
- [Qemu-devel] [STABLE 0.13][PATCH 02/13] scsi-disk: fix the mode data header returned by the MODE SENSE(10) command, (continued)
- [Qemu-devel] [STABLE 0.13][PATCH 02/13] scsi-disk: fix the mode data header returned by the MODE SENSE(10) command, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 03/13] scsi-disk: respect the page control (PC) field in the MODE SENSE command, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 04/13] scsi-disk: fix the block descriptor returned by the MODE SENSE command, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 05/13] scsi-disk: return CHECK CONDITION for unknown page codes in the MODE SENSE command, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 07/13] raw-posix: Don't use file name for host_cdrom detection on Linux, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 06/13] scsi-disk: fix the check of the DBD bit in the MODE SENSE command, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 08/13] qemu-img convert: Use cache=unsafe for output image, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 09/13] block: Fix BDRV_O_CACHE_MASK, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 10/13] qcow2: Remove unnecessary flush after L2 write, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 11/13] vvfat: Fix segfault on write to read-only disk, Kevin Wolf, 2010/09/13
- [Qemu-devel] [STABLE 0.13][PATCH 12/13] vvfat: Fix double free for opening the image rw,
Kevin Wolf <=
- [Qemu-devel] [STABLE 0.13][PATCH 13/13] vvfat: Use cache=unsafe, Kevin Wolf, 2010/09/13