|
From: | Manos Pitsidianakis |
Subject: | Re: [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in block.c |
Date: | Fri, 14 Jul 2017 17:46:49 +0300 |
User-agent: | NeoMutt/20170609-57-1e93be (1.8.3) |
On Fri, Jul 14, 2017 at 09:42:22AM -0500, Eric Blake wrote:
On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by: Manos Pitsidianakis <address@hidden> --- block.c | 2 ++ 1 file changed, 2 insertions(+)Reviewed-by: Eric Blake <address@hidden> Can you pinpoint which commit introduced the bug, in order to decide if this affects 2.9 and should therefore be cc'd to qemu-stable?
I think the particular error path was unreachable in every case since bdrv_open_driver() erroneously sets bs->drv to NULL, so bdrv_close never performs cleanups. I fix this in the next patch. I am not completely sure if it's possible to trigger this otherwise.
signature.asc
Description: PGP signature
[Prev in Thread] | Current Thread | [Next in Thread] |