Kevin Wolf bcfd86d6a6 qcow2: Fix dangling pointer after reopen for 'file' ...

Without an external data file, s->data_file is a second pointer with the
same value as bs->file. When changing bs->file to a different BdrvChild
and freeing the old BdrvChild, s->data_file must also be updated,
otherwise it points to freed memory and causes crashes.

This problem was caught by iotests case 245.

Fixes: df2b7086f169239ebad5d150efa29c9bb6d4f820
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210708114709.206487-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2021-07-09 13:19:11 +02:00

..

export

export/fuse: Let permissions be adjustable

2021-07-09 12:26:05 +02:00

monitor

monitor: hmp_qemu_io: acquire aio contex, fix crash

2021-05-14 16:14:10 +02:00

accounting.c

…

aio_task.c

…

amend.c

…

backup-top.c

block/backup-top: drop .active

2021-04-30 12:27:48 +02:00

backup-top.h

…

backup.c

mirror: stop cancelling in-flight requests on non-force cancel in READY

2021-05-14 16:14:10 +02:00

blkdebug.c

…

blklogwrites.c

…

blkreplay.c

…

blkverify.c

…

block-backend.c

block: add max_hw_transfer to BlockLimits

2021-06-25 10:54:13 +02:00

block-copy.c

block-copy: atomic .cancelled and .finished fields in BlockCopyCallState

2021-06-25 14:33:51 +03:00

block-gen.h

…

bochs.c

…

cloop.c

…

commit.c

block/commit: use QEMU_AUTO_VFREE

2021-06-29 16:51:21 +02:00

copy-on-read.c

block/copy-on-read: use bdrv_drop_filter() and drop s->active

2021-05-14 16:14:10 +02:00

copy-on-read.h

…

coroutines.h

block/nbd: reuse nbd_co_do_establish_connection() in nbd_open()

2021-06-18 12:21:22 -05:00

create.c

…

crypto.c

…

crypto.h

…

curl.c

…

dirty-bitmap.c

…

dmg-bz2.c

…

dmg-lzfse.c

…

dmg.c

…

dmg.h

…

file-posix.c

file-posix: handle EINTR during ioctl

2021-06-25 10:54:13 +02:00

file-win32.c

…

filter-compress.c

…

gluster.c

…

io_uring.c

…

io.c

block: Move read-only check during truncation earlier

2021-06-29 16:51:00 +02:00

iscsi-opts.c

…

iscsi.c

…

linux-aio.c

…

meson.build

progressmeter: protect with a mutex

2021-06-25 14:24:24 +03:00

mirror.c

mirror: stop cancelling in-flight requests on non-force cancel in READY

2021-05-14 16:14:10 +02:00

nbd.c

block/nbd: Use qcrypto_tls_creds_check_endpoint()

2021-06-29 18:29:47 +01:00

nfs.c

util/uri: do not check argument of uri_free()

2021-07-09 12:26:05 +02:00

null.c

…

nvme.c

…

parallels-ext.c

…

parallels.c

…

parallels.h

…

preallocate.c

…

progress_meter.c

progressmeter: protect with a mutex

2021-06-25 14:24:24 +03:00

qapi-sysemu.c

…

qapi.c

block: use GDateTime for formatting timestamp when dumping snapshot info

2021-06-14 13:28:50 +01:00

qcow2-bitmap.c

…

qcow2-cache.c

…

qcow2-cluster.c

…

qcow2-refcount.c

…

qcow2-snapshot.c

block: consistently use bdrv_is_read_only()

2021-06-02 14:23:20 +02:00

qcow2-threads.c

…

qcow2.c

qcow2: Fix dangling pointer after reopen for 'file'

2021-07-09 13:19:11 +02:00

qcow2.h

…

qcow.c

…

qed-check.c

…

qed-cluster.c

…

qed-l2-cache.c

…

qed-table.c

…

qed.c

…

qed.h

…

quorum.c

block/quorum: Provide .bdrv_co_flush instead of .bdrv_co_flush_to_disk

2021-06-02 14:23:20 +02:00

raw-format.c

…

rbd.c

block/rbd: fix type of task->complete

2021-07-09 12:26:05 +02:00

replication.c

replication: move include out of root directory

2021-05-26 14:49:46 +02:00

snapshot.c

block/snapshot: Clarify goto fallback behavior

2021-06-24 09:49:04 +02:00

ssh.c

util/uri: do not check argument of uri_free()

2021-07-09 12:26:05 +02:00

stream.c

…

throttle-groups.c

…

throttle.c

…

trace-events

block: add trace point when fdatasync fails

2021-06-14 13:28:50 +01:00

trace.h

…

vdi.c

block/vdi: Don't assume that blocks are larger than VdiHeader

2021-03-31 10:44:21 +01:00

vhdx-endian.c

…

vhdx-log.c

block: consistently use bdrv_is_read_only()

2021-06-02 14:23:20 +02:00

vhdx.c

…

vhdx.h

…

vmdk.c

…

vpc.c

…

vvfat.c

block/vvfat: inherit child_vvfat_qcow from child_of_bds

2021-06-02 14:23:20 +02:00

win32-aio.c

…

write-threshold.c

write-threshold: deal with includes

2021-05-14 16:14:10 +02:00