[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [Qemu-block] [PATCH for-2.10?] block: Do not unref bs->

From: Stefan Hajnoczi
Subject: Re: [Qemu-devel] [Qemu-block] [PATCH for-2.10?] block: Do not unref bs->file on error in BD's open
Date: Tue, 18 Apr 2017 18:17:12 +0100
User-agent: Mutt/1.8.0 (2017-02-23)

On Thu, Apr 13, 2017 at 05:43:34PM +0200, Max Reitz wrote:
> The block layer takes care of removing the bs->file child if the block
> driver's bdrv_open()/bdrv_file_open() implementation fails. The block
> driver therefore does not need to do so, and indeed should not unless it
> sets bs->file to NULL afterwards -- because if this is not done, the
> bdrv_unref_child() in bdrv_open_inherit() will dereference the freed
> memory block at bs->file afterwards, which is not good.
> We can now decide whether to add a "bs->file = NULL;" after each of the
> offending bdrv_unref_child() invocations, or just drop them altogether.
> The latter is simpler, so let's do that.
> Cc: qemu-stable <address@hidden>
> Signed-off-by: Max Reitz <address@hidden>
> ---
> It's an issue only in blkdebug, blkreplace and blkverify, and only when
> an error occurs in their open functions; therefore I think this is fine
> to delay until 2.10.
> However, it *is* a use-after-free newly introduced in 2.9, so that's
> where the question mark comes from...
> ---
>  block/blkdebug.c  | 4 +---
>  block/blkreplay.c | 3 ---
>  block/blkverify.c | 3 ---
>  3 files changed, 1 insertion(+), 9 deletions(-)

Reviewed-by: Stefan Hajnoczi <address@hidden>

Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]