block: Fix use after free error in bdrv_open_inherit()
When a block device is opened with BDRV_O_SNAPSHOT and the bdrv_append_temp_snapshot() call fails then the error code path tries to unref the already destroyed 'options' QDict. This can be reproduced easily by setting TMPDIR to a location where the QEMU process can't write: $ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
parent
e091f0e905
commit
8961be33e8
1
block.c
1
block.c
|
@ -2792,6 +2792,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
|
||||||
bdrv_parent_cb_change_media(bs, true);
|
bdrv_parent_cb_change_media(bs, true);
|
||||||
|
|
||||||
qobject_unref(options);
|
qobject_unref(options);
|
||||||
|
options = NULL;
|
||||||
|
|
||||||
/* For snapshot=on, create a temporary qcow2 overlay. bs points to the
|
/* For snapshot=on, create a temporary qcow2 overlay. bs points to the
|
||||||
* temporary snapshot afterwards. */
|
* temporary snapshot afterwards. */
|
||||||
|
|
Loading…
Reference in New Issue