block: fix dangling bs->explicit_options in block.c
In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
parent
b81b74bfb2
commit
998cbd6a44
2
block.c
2
block.c
|
@ -2608,6 +2608,7 @@ fail:
|
||||||
QDECREF(bs->options);
|
QDECREF(bs->options);
|
||||||
QDECREF(options);
|
QDECREF(options);
|
||||||
bs->options = NULL;
|
bs->options = NULL;
|
||||||
|
bs->explicit_options = NULL;
|
||||||
bdrv_unref(bs);
|
bdrv_unref(bs);
|
||||||
error_propagate(errp, local_err);
|
error_propagate(errp, local_err);
|
||||||
return NULL;
|
return NULL;
|
||||||
|
@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs)
|
||||||
QDECREF(bs->options);
|
QDECREF(bs->options);
|
||||||
QDECREF(bs->explicit_options);
|
QDECREF(bs->explicit_options);
|
||||||
bs->options = NULL;
|
bs->options = NULL;
|
||||||
|
bs->explicit_options = NULL;
|
||||||
QDECREF(bs->full_open_options);
|
QDECREF(bs->full_open_options);
|
||||||
bs->full_open_options = NULL;
|
bs->full_open_options = NULL;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue