From 35e4e96c4d5bfcf8a22930d8e99f7c8c44420062 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 8 Oct 2014 01:19:00 +0200 Subject: virtio-scsi: fix use-after-free of VirtIOSCSIReq scsi_req_continue can complete the request and cause the VirtIOSCSIReq to be freed. Fetch req->sreq just once to avoid the bug. Reported-by: Richard Jones Tested-by: Richard Jones Reviewed-by: Fam Zheng Signed-off-by: Paolo Bonzini --- hw/scsi/virtio-scsi.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 203e62449a..6c02fe2b9a 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -545,11 +545,12 @@ bool virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req) void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req) { - if (scsi_req_enqueue(req->sreq)) { - scsi_req_continue(req->sreq); + SCSIRequest *sreq = req->sreq; + if (scsi_req_enqueue(sreq)) { + scsi_req_continue(sreq); } - bdrv_io_unplug(req->sreq->dev->conf.bs); - scsi_req_unref(req->sreq); + bdrv_io_unplug(sreq->dev->conf.bs); + scsi_req_unref(sreq); } static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq) -- cgit v1.2.3