projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e091f0e) | patch
block: Fix use after free error in bdrv_open_inherit()
authorAlberto Garcia <berto@igalia.com>
Thu, 6 Sep 2018 14:25:41 +0000 (17:25 +0300)
committerKevin Wolf <kwolf@redhat.com>
Tue, 25 Sep 2018 13:50:15 +0000 (15:50 +0200)
commit8961be33e8ca7e809c603223803ea66ef7ea5be7
treec665ac454c2a88464e16d06c67976636fbdc983ctree | snapshot
parente091f0e905a4481f347913420f327d427f18d9d4commit | diff
block: Fix use after free error in bdrv_open_inherit()

When a block device is opened with BDRV_O_SNAPSHOT and the
bdrv_append_temp_snapshot() call fails then the error code path tries
to unref the already destroyed 'options' QDict.

This can be reproduced easily by setting TMPDIR to a location where
the QEMU process can't write:

   $ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.