diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2021-04-13 21:05:17 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2021-04-13 21:05:17 +0100 |
| commit | db55d2c9239d445cb7f1fa8ede8e42bd339058f4 (patch) | |
| tree | 32717514deb361ad95053a03f438abb3c67959b9 | |
| parent | 1b665153341613bd2a6074f26d705237eb497d79 (diff) | |
| parent | 0267101af64292c9a84fd9319a763ddfbce9ddc7 (diff) | |
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' into staging
Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c
# gpg: Signature made Tue 13 Apr 2021 14:35:48 BST
# gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg: issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40
* remotes/maxreitz/tags/pull-block-2021-04-13:
block/nbd: fix possible use after free of s->connect_thread
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | block/nbd.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/block/nbd.c b/block/nbd.c index c26dc5a54f..1d4668d42d 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -443,6 +443,11 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp) BDRVNBDState *s = bs->opaque; NBDConnectThread *thr = s->connect_thread; + if (!thr) { + /* detached */ + return -1; + } + qemu_mutex_lock(&thr->mutex); switch (thr->state) { @@ -486,6 +491,12 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp) s->wait_connect = true; qemu_coroutine_yield(); + if (!s->connect_thread) { + /* detached */ + return -1; + } + assert(thr == s->connect_thread); + qemu_mutex_lock(&thr->mutex); switch (thr->state) { |