aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorGreg Kurz <groug@kaod.org>2017-06-29 15:11:50 +0200
committerGreg Kurz <groug@kaod.org>2017-06-29 15:11:50 +0200
commit3a21fb2af07ca6d22e39a766363befbf833f86bb (patch)
tree2757c2acaa55d1cc90671b3ea8f7151c4698ab41 /hw
parent453a1b234fc11570e332e91d58e4dbfeec7cb824 (diff)
virtio-9p: record element after sanity checks
If the guest sends a malformed request, we end up with a dangling pointer in V9fsVirtioState. This doesn't seem to cause any bug, but let's remove this side effect anyway. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/9pfs/virtio-9p-device.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 245abd8aae..3380bfc0c5 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -61,7 +61,6 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq)
}
QEMU_BUILD_BUG_ON(sizeof(out) != 7);
- v->elems[pdu->idx] = elem;
len = iov_to_buf(elem->out_sg, elem->out_num, 0,
&out, sizeof(out));
if (len != sizeof(out)) {
@@ -70,6 +69,8 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq)
goto out_free_req;
}
+ v->elems[pdu->idx] = elem;
+
pdu_submit(pdu, &out);
}