[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 10/55] pr-manager: Fix invalid g_free() crash bug
From: |
Michael Roth |
Subject: |
[PATCH 10/55] pr-manager: Fix invalid g_free() crash bug |
Date: |
Tue, 5 Nov 2019 14:51:58 -0600 |
From: Markus Armbruster <address@hidden>
pr_manager_worker() passes its @opaque argument to g_free(). Wrong;
it points to pr_manager_worker()'s automatic @data. Broken when
commit 2f3a7ab39be converted @data from heap- to stack-allocated. Fix
by deleting the g_free().
Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
Cc: address@hidden
Signed-off-by: Markus Armbruster <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Acked-by: Paolo Bonzini <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3)
Signed-off-by: Michael Roth <address@hidden>
---
scsi/pr-manager.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
index ee43663576..0c866e8698 100644
--- a/scsi/pr-manager.c
+++ b/scsi/pr-manager.c
@@ -39,7 +39,6 @@ static int pr_manager_worker(void *opaque)
int fd = data->fd;
int r;
- g_free(data);
trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]);
/* The reference was taken in pr_manager_execute. */
--
2.17.1
- [PATCH 06/55] xen-bus: Fix backend state transition on device reset, (continued)
- [PATCH 06/55] xen-bus: Fix backend state transition on device reset, Michael Roth, 2019/11/05
- [PATCH 21/55] qcow2: Fix the calculation of the maximum L2 cache size, Michael Roth, 2019/11/05
- [PATCH 53/55] target/xtensa: regenerate and re-import test_mmuhifi_c3 core, Michael Roth, 2019/11/05
- [PATCH 25/55] curl: Check completion in curl_multi_do(), Michael Roth, 2019/11/05
- [PATCH 13/55] iotests: add testing shim for script-style python tests, Michael Roth, 2019/11/05
- [PATCH 41/55] vhost-user: save features if the char dev is closed, Michael Roth, 2019/11/05
- [PATCH 49/55] COLO-compare: Fix incorrect `if` logic, Michael Roth, 2019/11/05
- [PATCH 37/55] roms/Makefile.edk2: don't pull in submodules when building from tarball, Michael Roth, 2019/11/05
- [PATCH 54/55] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068), Michael Roth, 2019/11/05
- [PATCH 40/55] iotests: Test internal snapshots with -blockdev, Michael Roth, 2019/11/05
- [PATCH 10/55] pr-manager: Fix invalid g_free() crash bug,
Michael Roth <=
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Max Reitz, 2019/11/08
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Cole Robinson, 2019/11/11
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Michael Roth, 2019/11/12
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Bruce Rogers, 2019/11/12