[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 01/11] virtio-blk: fix use-after-free while handling
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PATCH 01/11] virtio-blk: fix use-after-free while handling scsi commands |
Date: |
Fri, 10 Aug 2012 18:47:19 +0200 |
From: Avi Kivity <address@hidden>
The scsi passthrough handler falls through after completing a
request into the failure path, resulting in a use after free.
Reproducible by running a guest with aio=native on a block device.
Reported-by: Stefan Priebe <address@hidden>
Signed-off-by: Avi Kivity <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
hw/virtio-blk.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index f21757e..552b3b6 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -254,6 +254,7 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
virtio_blk_req_complete(req, status);
g_free(req);
+ return;
#else
abort();
#endif
--
1.7.6.5
- [Qemu-devel] [PULL 00/11] Block patches, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 01/11] virtio-blk: fix use-after-free while handling scsi commands,
Kevin Wolf <=
- [Qemu-devel] [PATCH 02/11] ahci: Fix ahci cdrom read corruptions for reads > 128k, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 03/11] ahci: Fix sglist memleak in ahci_dma_rw_buf(), Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 05/11] virtio-blk: support VIRTIO_BLK_F_CONFIG_WCE, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 04/11] qemu-iotests: Save some sed processes, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 06/11] virtio-blk: disable write cache if not negotiated, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 09/11] qcow2: mark image clean after repair succeeds, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 07/11] blockdev: flip default cache mode from writethrough to writeback, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 08/11] qed: mark image clean after repair succeeds, Kevin Wolf, 2012/08/10
- [Qemu-devel] [PATCH 11/11] qemu-iotests: skip 039 with ./check -nocache, Kevin Wolf, 2012/08/10