aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorManos Pitsidianakis <el13635@mail.ntua.gr>2017-07-14 17:35:47 +0300
committerKevin Wolf <kwolf@redhat.com>2017-08-01 18:09:33 +0200
commit998cbd6a44cd96044f56713274bdf6a94cd721c0 (patch)
tree99a0ad9848071b96050e36914d96ac6570ab4958
parentb81b74bfb2ea3d23dc06cb0c84841dbea201b8de (diff)
downloadqemu-arm-998cbd6a44cd96044f56713274bdf6a94cd721c0.tar.gz
block: fix dangling bs->explicit_options in block.c
In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-rw-r--r--block.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/block.c b/block.c
index 37e72b7a96..7a78bc647b 100644
--- a/block.c
+++ b/block.c
@@ -2608,6 +2608,7 @@ fail:
QDECREF(bs->options);
QDECREF(options);
bs->options = NULL;
+ bs->explicit_options = NULL;
bdrv_unref(bs);
error_propagate(errp, local_err);
return NULL;
@@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs)
QDECREF(bs->options);
QDECREF(bs->explicit_options);
bs->options = NULL;
+ bs->explicit_options = NULL;
QDECREF(bs->full_open_options);
bs->full_open_options = NULL;
}