Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/2] block: fix dangling bs->explicit_options in block.c

[Manos Pitsidianakis]

On Fri, Jul 14, 2017 at 09:42:22AM -0500, Eric Blake wrote:
> On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:
> > In some error paths it is possible to QDECREF a freed dangling
> > explicit_options, resulting in a heap overflow crash.  For example
> > bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
> > bdrv_close which also unrefs it.
> >
> > Signed-off-by: Manos Pitsidianakis <address@hidden>
> > ---
> >  block.c | 2 ++
> >  1 file changed, 2 insertions(+)
>
> Reviewed-by: Eric Blake <address@hidden>
>
> Can you pinpoint which commit introduced the bug, in order to decide if
> this affects 2.9 and should therefore be cc'd to qemu-stable?

I think the particular error path was unreachable in every case since 
bdrv_open_driver() erroneously sets bs->drv to NULL, so bdrv_close never 
performs cleanups. I fix this in the next patch. I am not completely 
sure if it's possible to trigger this otherwise.

signature.asc
Description: PGP signature