diff options
| author | Hikaru Nishida <hikarupsp@gmail.com> | 2020-02-10 02:51:56 +0900 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2020-02-18 10:53:56 +0100 |
| commit | 8475ea48544b313cf533312846a4899ddecb799c (patch) | |
| tree | 9f7398065c697fc3118db709ce6df189a7cdcb2c /block/qcow2-refcount.c | |
| parent | 2d4b5256cf6a091bb6c3516661be11b9ec690f95 (diff) | |
block/vvfat: Do not unref qcow on closing backing bdrv
Before this commit, BDRVVVFATState.qcow is unrefed in write_target_close
on closing backing bdrv of vvfat. However, qcow bdrv is opend as a child
of vvfat in enable_write_target() so it will be also unrefed on closing
vvfat itself. This causes use-after-free of qcow on freeing vvfat which
has backing bdrv and qcow bdrv as children in this order because
bdrv_close(vvfat) tries to free qcow bdrv after freeing backing bdrv
as QLIST_FOREACH_SAFE() loop keeps next pointer, but BdrvChild of qcow
is already freed in bdrv_close(backing bdrv).
Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com>
Message-Id: <20200209175156.85748-1-hikarupsp@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block/qcow2-refcount.c')
0 files changed, 0 insertions, 0 deletions