[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 5/5] block/block-copy: fix use-after-free of task pointer
From: |
Max Reitz |
Subject: |
[PULL 5/5] block/block-copy: fix use-after-free of task pointer |
Date: |
Wed, 13 May 2020 16:15:44 +0200 |
From: Vladimir Sementsov-Ogievskiy <address@hidden>
Obviously, we should g_free the task after trace point and offset
update.
Reported-by: Coverity (CID 1428756)
Fixes: 4ce5dd3e9b5ee0fac18625860eb3727399ee965e
Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Max Reitz <address@hidden>
---
block/block-copy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/block-copy.c b/block/block-copy.c
index 03500680f7..4713c8f2a3 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -591,13 +591,13 @@ static int coroutine_fn
block_copy_dirty_clusters(BlockCopyState *s,
}
if (s->skip_unallocated && !(ret & BDRV_BLOCK_ALLOCATED)) {
block_copy_task_end(task, 0);
- g_free(task);
progress_set_remaining(s->progress,
bdrv_get_dirty_count(s->copy_bitmap) +
s->in_flight_bytes);
trace_block_copy_skip_range(s, task->offset, task->bytes);
offset = task_end(task);
bytes = end - offset;
+ g_free(task);
continue;
}
task->zeroes = ret & BDRV_BLOCK_ZERO;
--
2.26.2
- [PULL 0/5] Block patches, Max Reitz, 2020/05/13
- [PULL 2/5] qcow2: rework the cluster compression routine, Max Reitz, 2020/05/13
- [PULL 1/5] qcow2: introduce compression type feature, Max Reitz, 2020/05/13
- [PULL 4/5] iotests: 287: add qcow2 compression type test, Max Reitz, 2020/05/13
- [PULL 5/5] block/block-copy: fix use-after-free of task pointer,
Max Reitz <=
- [PULL 3/5] qcow2: add zstd cluster compression, Max Reitz, 2020/05/13
- Re: [PULL 0/5] Block patches, Peter Maydell, 2020/05/14