[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->exp

From: Manos Pitsidianakis
Subject: Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in block.c
Date: Fri, 14 Jul 2017 17:46:49 +0300
User-agent: NeoMutt/20170609-57-1e93be (1.8.3)

On Fri, Jul 14, 2017 at 09:42:22AM -0500, Eric Blake wrote:
On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash.  For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.

Signed-off-by: Manos Pitsidianakis <address@hidden>
 block.c | 2 ++
 1 file changed, 2 insertions(+)

Reviewed-by: Eric Blake <address@hidden>

Can you pinpoint which commit introduced the bug, in order to decide if
this affects 2.9 and should therefore be cc'd to qemu-stable?

I think the particular error path was unreachable in every case since bdrv_open_driver() erroneously sets bs->drv to NULL, so bdrv_close never performs cleanups. I fix this in the next patch. I am not completely sure if it's possible to trigger this otherwise.

Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]