[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 55/55] qcow2: fix new_blocks double-free in alloc_ref
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL 55/55] qcow2: fix new_blocks double-free in alloc_refcount_block() |
Date: |
Fri, 15 Aug 2014 18:07:02 +0100 |
Commit de82815db1c89da058b7fb941dab137d6d9ab738 ("qcow2: Handle failure
for potentially large allocations") introduced a double-free of
new_blocks in the alloc_refcount_block() error path.
The qemu-iotests qcow2 026 test case was failing because qemu-io
segfaulted.
Make sure new_blocks is NULL after we free it the first time.
Reviewed-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
block/qcow2-refcount.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index d60e2fe..3b77470 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -381,6 +381,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
blocks_clusters * s->cluster_size);
g_free(new_blocks);
+ new_blocks = NULL;
if (ret < 0) {
goto fail_table;
}
--
1.9.3
- [Qemu-devel] [PULL 43/55] libqos: Change free function called in malloc, (continued)
- [Qemu-devel] [PULL 43/55] libqos: Change free function called in malloc, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 44/55] virtio-blk: Correct bug in support for flexible descriptor layout, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 46/55] docs: Specification for the image fuzzer, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 47/55] image-fuzzer: Tool for fuzz tests execution, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 48/55] image-fuzzer: Fuzzing functions for qcow2 images, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 50/55] image-fuzzer: Public API for image-fuzzer/runner/runner.py, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 49/55] image-fuzzer: Generator of fuzzed qcow2 images, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 51/55] docs: Expand the list of supported image elements with L1/L2 tables, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 52/55] image-fuzzer: Add fuzzing functions for L1/L2 table entries, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 53/55] image-fuzzer: Add generators of L1/L2 tables, Stefan Hajnoczi, 2014/08/15
- [Qemu-devel] [PULL 55/55] qcow2: fix new_blocks double-free in alloc_refcount_block(),
Stefan Hajnoczi <=
- [Qemu-devel] [PULL 54/55] image-fuzzer: Reduce number of generator functions in __init__, Stefan Hajnoczi, 2014/08/15
- Re: [Qemu-devel] [PULL 00/55] Block patches, Peter Maydell, 2014/08/18