OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
212ec7baa2
qemu-e2k/block
History
Stefan Hajnoczi e4fc8781db qed: fix use-after-free during l2 cache commit 
QED's metadata caching strategy allows two parallel requests to race for
metadata lookup.  The first one to complete will populate the metadata
cache and the second one will drop the data it just read in favor of the
cached data.

There is a use-after-free in qed_read_l2_table_cb() and
qed_commit_l2_update() where l2_table->offset was used after the
l2_table may have been freed due to a metadata lookup race.  Fix this by
keeping the l2_offset in a local variable and not reaching into the
possibly freed l2_table.

Reported-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-10-05 10:52:31 -05:00
..
blkdebug.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
blkverify.c block: avoid a warning on 64 bit hosts with long as int64_t 2010-11-04 13:54:37 +01:00
bochs.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
cloop.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
cow.c block: Allow bdrv_flush to return errors 2010-11-04 12:52:16 +01:00
curl.c block/curl: Don't finish AIOCBs too early 2011-09-21 15:16:04 +02:00
dmg.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
nbd.c nbd: support feature negotiation 2011-09-19 11:34:33 +02:00
parallels.c Use new macro QEMU_PACKED for packed structures 2011-09-03 10:45:59 +00:00
qcow2-cache.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
qcow2-cluster.c qcow2: fix range check 2011-09-12 15:17:22 +02:00
qcow2-refcount.c qcow2: remove unused qcow2_create_refcount_update function 2011-08-25 15:23:10 +02:00
qcow2-snapshot.c Use new macro QEMU_PACKED for packed structures 2011-09-03 10:45:59 +00:00
qcow2.c qcow2: align cluster_data to block to improve performance using O_DIRECT 2011-09-12 15:17:22 +02:00
qcow2.h qcow2: removed unused depends_on field 2011-09-12 15:17:17 +02:00
qcow.c qcow: remove old #undefined code 2011-08-23 17:41:14 +02:00
qed-check.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
qed-cluster.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
qed-gencb.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
qed-l2-cache.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
qed-table.c qed: fix use-after-free during l2 cache commit 2011-10-05 10:52:31 -05:00
qed.c qed: fix use-after-free during l2 cache commit 2011-10-05 10:52:31 -05:00
qed.h qed: Periodically flush and clear need check bit 2011-05-18 14:38:46 +02:00
raw-posix-aio.h Remove aio_ctx from paio_* interface 2009-10-30 08:39:34 -05:00
raw-posix.c raw-posix: Fix bdrv_flush error return values 2011-09-19 11:34:33 +02:00
raw-win32.c w32: Fix qemu_ftruncate64 2011-08-22 10:19:00 -05:00
raw.c block: Rename bdrv_set_locked() to bdrv_lock_medium() 2011-09-12 15:17:20 +02:00
rbd.c rbd: allow escaping in config string 2011-09-20 14:34:17 +02:00
sheepdog.c sheepdog: use coroutines 2011-08-24 14:53:51 +02:00
vdi.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
vmdk.c VMDK: fix leak of extent_file 2011-09-20 12:27:43 +02:00
vpc.c Use glib memory allocation and free functions 2011-08-20 23:01:08 -05:00
vvfat.c Remove blanks before \n in output strings 2011-09-16 08:25:56 -05:00