[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [Qemu-block] [PATCH for-2.10?] block: Do not unref bs->
Re: [Qemu-devel] [Qemu-block] [PATCH for-2.10?] block: Do not unref bs->file on error in BD's open
Tue, 18 Apr 2017 18:17:12 +0100
On Thu, Apr 13, 2017 at 05:43:34PM +0200, Max Reitz wrote:
> The block layer takes care of removing the bs->file child if the block
> driver's bdrv_open()/bdrv_file_open() implementation fails. The block
> driver therefore does not need to do so, and indeed should not unless it
> sets bs->file to NULL afterwards -- because if this is not done, the
> bdrv_unref_child() in bdrv_open_inherit() will dereference the freed
> memory block at bs->file afterwards, which is not good.
> We can now decide whether to add a "bs->file = NULL;" after each of the
> offending bdrv_unref_child() invocations, or just drop them altogether.
> The latter is simpler, so let's do that.
> Cc: qemu-stable <address@hidden>
> Signed-off-by: Max Reitz <address@hidden>
> It's an issue only in blkdebug, blkreplace and blkverify, and only when
> an error occurs in their open functions; therefore I think this is fine
> to delay until 2.10.
> However, it *is* a use-after-free newly introduced in 2.9, so that's
> where the question mark comes from...
> block/blkdebug.c | 4 +---
> block/blkreplay.c | 3 ---
> block/blkverify.c | 3 ---
> 3 files changed, 1 insertion(+), 9 deletions(-)
Reviewed-by: Stefan Hajnoczi <address@hidden>
Description: PGP signature