[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 04/36] block/vvfat: Do not unref qcow on closing backing bdrv
From: |
Kevin Wolf |
Subject: |
[PULL 04/36] block/vvfat: Do not unref qcow on closing backing bdrv |
Date: |
Tue, 18 Feb 2020 15:06:50 +0100 |
From: Hikaru Nishida <address@hidden>
Before this commit, BDRVVVFATState.qcow is unrefed in write_target_close
on closing backing bdrv of vvfat. However, qcow bdrv is opend as a child
of vvfat in enable_write_target() so it will be also unrefed on closing
vvfat itself. This causes use-after-free of qcow on freeing vvfat which
has backing bdrv and qcow bdrv as children in this order because
bdrv_close(vvfat) tries to free qcow bdrv after freeing backing bdrv
as QLIST_FOREACH_SAFE() loop keeps next pointer, but BdrvChild of qcow
is already freed in bdrv_close(backing bdrv).
Signed-off-by: Hikaru Nishida <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
block/vvfat.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/block/vvfat.c b/block/vvfat.c
index 019b8f1341..ab800c4887 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -3124,17 +3124,10 @@ write_target_commit(BlockDriverState *bs, uint64_t
offset, uint64_t bytes,
return ret;
}
-static void write_target_close(BlockDriverState *bs) {
- BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
- bdrv_unref_child(s->bs, s->qcow);
- g_free(s->qcow_filename);
-}
-
static BlockDriver vvfat_write_target = {
.format_name = "vvfat_write_target",
.instance_size = sizeof(void*),
.bdrv_co_pwritev = write_target_commit,
- .bdrv_close = write_target_close,
};
static void vvfat_qcow_options(int *child_flags, QDict *child_options,
--
2.20.1
- [PULL 00/36] Block layer patches, Kevin Wolf, 2020/02/18
- [PULL 04/36] block/vvfat: Do not unref qcow on closing backing bdrv,
Kevin Wolf <=
- [PULL 02/36] mirror: Don't let an operation wait for itself, Kevin Wolf, 2020/02/18
- [PULL 05/36] qcow2: update_refcount(): Reset old_table_index after qcow2_cache_put(), Kevin Wolf, 2020/02/18
- [PULL 06/36] qcow2: Fix qcow2_alloc_cluster_abort() for external data file, Kevin Wolf, 2020/02/18
- [PULL 03/36] qcow2: Fix alignment checks in encrypted images, Kevin Wolf, 2020/02/18
- [PULL 01/36] mirror: Store MirrorOp.co for debuggability, Kevin Wolf, 2020/02/18
- [PULL 08/36] block/qcow2-bitmap: Remove unneeded variable assignment, Kevin Wolf, 2020/02/18
- [PULL 07/36] iotests: Test copy offloading with external data file, Kevin Wolf, 2020/02/18
- [PULL 09/36] qapi: Document meaning of 'ignore' BlockdevOnError for jobs, Kevin Wolf, 2020/02/18
- [PULL 12/36] commit: Inline commit_populate(), Kevin Wolf, 2020/02/18
- [PULL 11/36] commit: Fix argument order for block_job_error_action(), Kevin Wolf, 2020/02/18