[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in
From: |
Manos Pitsidianakis |
Subject: |
[Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in block.c |
Date: |
Fri, 14 Jul 2017 17:35:47 +0300 |
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash. For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.
Signed-off-by: Manos Pitsidianakis <address@hidden>
---
block.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/block.c b/block.c
index 98a9209371..96b912d229 100644
--- a/block.c
+++ b/block.c
@@ -2608,6 +2608,7 @@ fail:
QDECREF(bs->options);
QDECREF(options);
bs->options = NULL;
+ bs->explicit_options = NULL;
bdrv_unref(bs);
error_propagate(errp, local_err);
return NULL;
@@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs)
QDECREF(bs->options);
QDECREF(bs->explicit_options);
bs->options = NULL;
+ bs->explicit_options = NULL;
QDECREF(bs->full_open_options);
bs->full_open_options = NULL;
}
--
2.11.0