4ab0359a8a
When processing NCQ commands, AHCI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left as 'used'. This leads to a use after free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'. Reset NCQ transfer object to 'unused' to avoid it. [Maintainer edit: s/ACHI/AHCI/ in the commit message. --js] Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com Signed-off-by: John Snow <jsnow@redhat.com> |
||
---|---|---|
.. | ||
9pfs | ||
acpi | ||
alpha | ||
arm | ||
audio | ||
block | ||
bt | ||
char | ||
core | ||
cpu | ||
cris | ||
display | ||
dma | ||
gpio | ||
i2c | ||
i386 | ||
ide | ||
input | ||
intc | ||
ipack | ||
ipmi | ||
isa | ||
lm32 | ||
m68k | ||
mem | ||
microblaze | ||
mips | ||
misc | ||
moxie | ||
net | ||
nvram | ||
openrisc | ||
pci | ||
pci-bridge | ||
pci-host | ||
pcmcia | ||
ppc | ||
s390x | ||
scsi | ||
sd | ||
sh4 | ||
smbios | ||
sparc | ||
sparc64 | ||
ssi | ||
timer | ||
tpm | ||
tricore | ||
unicore32 | ||
usb | ||
vfio | ||
virtio | ||
watchdog | ||
xen | ||
xenpv | ||
xtensa | ||
Makefile.objs |