[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->exp
Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in block.c
Fri, 14 Jul 2017 17:46:49 +0300
On Fri, Jul 14, 2017 at 09:42:22AM -0500, Eric Blake wrote:
On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash. For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.
Signed-off-by: Manos Pitsidianakis <address@hidden>
block.c | 2 ++
1 file changed, 2 insertions(+)
Reviewed-by: Eric Blake <address@hidden>
Can you pinpoint which commit introduced the bug, in order to decide if
this affects 2.9 and should therefore be cc'd to qemu-stable?
I think the particular error path was unreachable in every case since
bdrv_open_driver() erroneously sets bs->drv to NULL, so bdrv_close never
performs cleanups. I fix this in the next patch. I am not completely
sure if it's possible to trigger this otherwise.
Description: PGP signature