[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] usb-redir: fix use-after-free
|
From: |
Laszlo Ersek |
|
Subject: |
Re: [Qemu-devel] [PATCH] usb-redir: fix use-after-free |
|
Date: |
Wed, 31 Jul 2013 14:25:02 +0200 |
|
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130621 Thunderbird/17.0.7 |
On 07/31/13 11:21, Gerd Hoffmann wrote:
> Reinitialize dev->cs to NULL after deleting it, to make sure it isn't
> used afterwards.
>
> Reported-by: Martin Cerveny <address@hidden>
> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
> hw/usb/redirect.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
> index 8b8c010..e3b9f32 100644
> --- a/hw/usb/redirect.c
> +++ b/hw/usb/redirect.c
> @@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
> USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
>
> qemu_chr_delete(dev->cs);
> + dev->cs = NULL;
> /* Note must be done after qemu_chr_close, as that causes a close event
> */
> qemu_bh_delete(dev->chardev_close_bh);
>
>
Reviewed-by: Laszlo Ersek <address@hidden>