[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL v1] io: fix possible double free of task error object
From: |
Daniel P. Berrange |
Subject: |
[Qemu-devel] [PULL v1] io: fix possible double free of task error object |
Date: |
Thu, 26 Jan 2017 10:27:57 +0000 |
If a QIOTask has an error set and the calling code uses
qio_task_propagate_error() to steal the reference to
that Error object, the task would not clear its own
reference. This would lead to a double-free when
qio_task_free runs, if the caller had (correctly) freed
the Error object they now owned.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
io/task.c | 1 +
tests/test-io-task.c | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/io/task.c b/io/task.c
index 60bf1a9..3ce5560 100644
--- a/io/task.c
+++ b/io/task.c
@@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task,
{
if (task->err) {
error_propagate(errp, task->err);
+ task->err = NULL;
return true;
}
diff --git a/tests/test-io-task.c b/tests/test-io-task.c
index ff62272..141aa2c 100644
--- a/tests/test-io-task.c
+++ b/tests/test-io-task.c
@@ -127,7 +127,7 @@ static void test_task_failure(void)
g_assert(data.source == obj);
g_assert(data.err == err);
g_assert(data.freed == false);
-
+ error_free(data.err);
}
@@ -238,6 +238,8 @@ static void test_task_thread_failure(void)
g_assert(data.source == obj);
g_assert(data.err != NULL);
+ error_free(data.err);
+
self = g_thread_self();
/* Make sure the test_task_thread_worker actually got
--
2.9.3