Stefan Hajnoczi e4fc8781db qed: fix use-after-free during l2 cache commit ... QED's metadata caching strategy allows two parallel requests to race for metadata lookup. The first one to complete will populate the metadata cache and the second one will drop the data it just read in favor of the cached data. There is a use-after-free in qed_read_l2_table_cb() and qed_commit_l2_update() where l2_table->offset was used after the l2_table may have been freed due to a metadata lookup race. Fix this by keeping the l2_offset in a local variable and not reaching into the possibly freed l2_table. Reported-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>		2011-10-05 10:52:31 -05:00
..
blkdebug.c
blkverify.c
bochs.c
cloop.c
cow.c
curl.c	block/curl: Don't finish AIOCBs too early	2011-09-21 15:16:04 +02:00
dmg.c
nbd.c	nbd: support feature negotiation	2011-09-19 11:34:33 +02:00
parallels.c	Use new macro QEMU_PACKED for packed structures	2011-09-03 10:45:59 +00:00
qcow2-cache.c
qcow2-cluster.c	qcow2: fix range check	2011-09-12 15:17:22 +02:00
qcow2-refcount.c	qcow2: remove unused qcow2_create_refcount_update function	2011-08-25 15:23:10 +02:00
qcow2-snapshot.c	Use new macro QEMU_PACKED for packed structures	2011-09-03 10:45:59 +00:00
qcow2.c	qcow2: align cluster_data to block to improve performance using O_DIRECT	2011-09-12 15:17:22 +02:00
qcow2.h	qcow2: removed unused depends_on field	2011-09-12 15:17:17 +02:00
qcow.c
qed-check.c
qed-cluster.c
qed-gencb.c
qed-l2-cache.c
qed-table.c	qed: fix use-after-free during l2 cache commit	2011-10-05 10:52:31 -05:00
qed.c	qed: fix use-after-free during l2 cache commit	2011-10-05 10:52:31 -05:00
qed.h
raw-posix-aio.h
raw-posix.c	raw-posix: Fix bdrv_flush error return values	2011-09-19 11:34:33 +02:00
raw-win32.c
raw.c	block: Rename bdrv_set_locked() to bdrv_lock_medium()	2011-09-12 15:17:20 +02:00
rbd.c	rbd: allow escaping in config string	2011-09-20 14:34:17 +02:00
sheepdog.c
vdi.c
vmdk.c	VMDK: fix leak of extent_file	2011-09-20 12:27:43 +02:00
vpc.c
vvfat.c	Remove blanks before \n in output strings	2011-09-16 08:25:56 -05:00