|
 |
383d26 |
From 9fbe06ec1dad1ffc7a2bcc138b7dbd6bf83e36cd Mon Sep 17 00:00:00 2001
|
|
|
383d26 |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
383d26 |
Date: Fri, 15 Mar 2019 18:10:02 +0100
|
|
|
383d26 |
Subject: [PATCH 006/163] block: Fix use after free error in
|
|
|
383d26 |
bdrv_open_inherit()
|
|
|
383d26 |
|
|
|
383d26 |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
383d26 |
Message-id: <20190315181010.14964-7-kwolf@redhat.com>
|
|
|
383d26 |
Patchwork-id: 84883
|
|
|
383d26 |
O-Subject: [RHEL-7.7 qemu-kvm-rhev PATCH 06/14] block: Fix use after free error in bdrv_open_inherit()
|
|
|
383d26 |
Bugzilla: 1685989
|
|
|
383d26 |
RH-Acked-by: John Snow <jsnow@redhat.com>
|
|
|
383d26 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
383d26 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
383d26 |
|
|
|
383d26 |
From: Alberto Garcia <berto@igalia.com>
|
|
|
383d26 |
|
|
|
383d26 |
When a block device is opened with BDRV_O_SNAPSHOT and the
|
|
|
383d26 |
bdrv_append_temp_snapshot() call fails then the error code path tries
|
|
|
383d26 |
to unref the already destroyed 'options' QDict.
|
|
|
383d26 |
|
|
|
383d26 |
This can be reproduced easily by setting TMPDIR to a location where
|
|
|
383d26 |
the QEMU process can't write:
|
|
|
383d26 |
|
|
|
383d26 |
$ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on
|
|
|
383d26 |
|
|
|
383d26 |
Signed-off-by: Alberto Garcia <berto@igalia.com>
|
|
|
383d26 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
383d26 |
(cherry picked from commit 8961be33e8ca7e809c603223803ea66ef7ea5be7)
|
|
|
383d26 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
383d26 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
383d26 |
---
|
|
|
383d26 |
block.c | 1 +
|
|
|
383d26 |
1 file changed, 1 insertion(+)
|
|
|
383d26 |
|
|
|
383d26 |
diff --git a/block.c b/block.c
|
|
|
383d26 |
index b31124c..25b3fe5 100644
|
|
|
383d26 |
--- a/block.c
|
|
|
383d26 |
+++ b/block.c
|
|
|
383d26 |
@@ -2834,6 +2834,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
|
|
|
383d26 |
bdrv_parent_cb_change_media(bs, true);
|
|
|
383d26 |
|
|
|
383d26 |
qobject_unref(options);
|
|
|
383d26 |
+ options = NULL;
|
|
|
383d26 |
|
|
|
383d26 |
/* For snapshot=on, create a temporary qcow2 overlay. bs points to the
|
|
|
383d26 |
* temporary snapshot afterwards. */
|
|
|
383d26 |
--
|
|
|
383d26 |
1.8.3.1
|
|
|
383d26 |
|