From: Michael Roth <mdroth@linux.vnet.ibm.com>
To: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>,
qemu-stable@nongnu.org, Markus Armbruster <armbru@redhat.com>
Subject: [PATCH 10/55] pr-manager: Fix invalid g_free() crash bug
Date: Tue, 5 Nov 2019 14:51:58 -0600 [thread overview]
Message-ID: <20191105205243.3766-11-mdroth@linux.vnet.ibm.com> (raw)
In-Reply-To: <20191105205243.3766-1-mdroth@linux.vnet.ibm.com>
From: Markus Armbruster <armbru@redhat.com>
pr_manager_worker() passes its @opaque argument to g_free(). Wrong;
it points to pr_manager_worker()'s automatic @data. Broken when
commit 2f3a7ab39be converted @data from heap- to stack-allocated. Fix
by deleting the g_free().
Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
scsi/pr-manager.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
index ee43663576..0c866e8698 100644
--- a/scsi/pr-manager.c
+++ b/scsi/pr-manager.c
@@ -39,7 +39,6 @@ static int pr_manager_worker(void *opaque)
int fd = data->fd;
int r;
- g_free(data);
trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]);
/* The reference was taken in pr_manager_execute. */
--
2.17.1
next prev parent reply other threads:[~2019-11-05 21:40 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-05 20:51 [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12 Michael Roth
2019-11-05 20:51 ` [PATCH 01/55] dma-helpers: ensure AIO callback is invoked after cancellation Michael Roth
2019-11-05 20:51 ` [PATCH 02/55] Revert "ide/ahci: Check for -ECANCELED in aio callbacks" Michael Roth
2019-11-05 20:51 ` [PATCH 03/55] s390x/tcg: Fix VERIM with 32/64 bit elements Michael Roth
2019-11-05 20:51 ` [PATCH 04/55] target/alpha: fix tlb_fill trap_arg2 value for instruction fetch Michael Roth
2019-11-05 20:51 ` [PATCH 05/55] pc: Don't make die-id mandatory unless necessary Michael Roth
2019-11-05 20:51 ` [PATCH 06/55] xen-bus: Fix backend state transition on device reset Michael Roth
2019-11-05 20:51 ` [PATCH 07/55] xen-bus: check whether the frontend is active during " Michael Roth
2019-11-05 20:51 ` [PATCH 08/55] block/file-posix: Reduce xfsctl() use Michael Roth
2019-11-05 20:51 ` [PATCH 09/55] iotests: Test reverse sub-cluster qcow2 writes Michael Roth
2019-11-05 20:51 ` Michael Roth [this message]
2019-11-05 20:51 ` [PATCH 11/55] x86: do not advertise die-id in query-hotpluggbale-cpus if '-smp dies' is not set Michael Roth
2019-11-05 20:52 ` [PATCH 12/55] vpc: Return 0 from vpc_co_create() on success Michael Roth
2019-11-05 20:52 ` [PATCH 13/55] iotests: add testing shim for script-style python tests Michael Roth
2019-11-05 20:52 ` [PATCH 14/55] iotests: Add supported protocols to execute_test() Michael Roth
2019-11-05 20:52 ` [PATCH 15/55] iotests: Restrict file Python tests to file Michael Roth
2019-11-05 20:52 ` [PATCH 16/55] iotests: Restrict nbd Python tests to nbd Michael Roth
2019-11-05 20:52 ` [PATCH 17/55] iotests: Test blockdev-create for vpc Michael Roth
2019-11-05 20:52 ` [PATCH 18/55] target/arm: Free TCG temps in trans_VMOV_64_sp() Michael Roth
2019-11-05 20:52 ` [PATCH 19/55] target/arm: Don't abort on M-profile exception return in linux-user mode Michael Roth
2019-11-05 20:52 ` [PATCH 20/55] libvhost-user: fix SLAVE_SEND_FD handling Michael Roth
2019-11-05 20:52 ` [PATCH 21/55] qcow2: Fix the calculation of the maximum L2 cache size Michael Roth
2019-11-05 20:52 ` [PATCH 22/55] block/nfs: tear down aio before nfs_close Michael Roth
2019-11-05 20:52 ` [PATCH 23/55] curl: Keep pointer to the CURLState in CURLSocket Michael Roth
2019-11-05 20:52 ` [PATCH 24/55] curl: Keep *socket until the end of curl_sock_cb() Michael Roth
2019-11-05 20:52 ` [PATCH 25/55] curl: Check completion in curl_multi_do() Michael Roth
2019-11-05 20:52 ` [PATCH 26/55] curl: Pass CURLSocket to curl_multi_do() Michael Roth
2019-11-05 20:52 ` [PATCH 27/55] curl: Report only ready sockets Michael Roth
2019-11-05 20:52 ` [PATCH 28/55] curl: Handle success in multi_check_completion Michael Roth
2019-11-05 20:52 ` [PATCH 29/55] blockjob: update nodes head while removing all bdrv Michael Roth
2019-11-05 20:52 ` [PATCH 30/55] block/qcow2: Fix corruption introduced by commit 8ac0f15f335 Michael Roth
2019-11-05 20:52 ` [PATCH 31/55] coroutine: Add qemu_co_mutex_assert_locked() Michael Roth
2019-11-05 20:52 ` [PATCH 32/55] qcow2: Fix corruption bug in qcow2_detect_metadata_preallocation() Michael Roth
2019-11-05 20:52 ` [PATCH 33/55] block/backup: fix max_transfer handling for copy_range Michael Roth
2019-11-05 20:52 ` [PATCH 34/55] block/backup: fix backup_cow_with_offload for last cluster Michael Roth
2019-11-05 20:52 ` [PATCH 35/55] hw/arm/boot.c: Set NSACR.{CP11, CP10} for NS kernel boots Michael Roth
2019-11-05 20:52 ` [PATCH 36/55] make-release: pull in edk2 submodules so we can build it from tarballs Michael Roth
2019-11-05 20:52 ` [PATCH 37/55] roms/Makefile.edk2: don't pull in submodules when building from tarball Michael Roth
2019-11-05 20:52 ` [PATCH 38/55] s390: PCI: fix IOMMU region init Michael Roth
2019-11-05 20:52 ` [PATCH 39/55] block/snapshot: Restrict set of snapshot nodes Michael Roth
2019-11-05 20:52 ` [PATCH 40/55] iotests: Test internal snapshots with -blockdev Michael Roth
2019-11-05 20:52 ` [PATCH 41/55] vhost-user: save features if the char dev is closed Michael Roth
2019-11-05 20:52 ` [PATCH 42/55] hw/core/loader: Fix possible crash in rom_copy() Michael Roth
2019-11-05 20:52 ` [PATCH 43/55] qcow2: Limit total allocation range to INT_MAX Michael Roth
2019-11-05 20:52 ` [PATCH 44/55] iotests: Test large write request to qcow2 file Michael Roth
2019-11-05 20:52 ` [PATCH 45/55] mirror: Do not dereference invalid pointers Michael Roth
2019-11-05 20:52 ` [PATCH 46/55] ui: Fix hanging up Cocoa display on macOS 10.15 (Catalina) Michael Roth
2019-11-05 20:52 ` [PATCH 47/55] virtio: new post_load hook Michael Roth
2019-11-05 20:52 ` [PATCH 48/55] virtio-net: prevent offloads reset on migration Michael Roth
2019-11-05 20:52 ` [PATCH 49/55] COLO-compare: Fix incorrect `if` logic Michael Roth
2019-11-05 20:52 ` [PATCH 50/55] util/hbitmap: strict hbitmap_reset Michael Roth
2019-11-05 20:52 ` [PATCH 51/55] hbitmap: handle set/reset with zero length Michael Roth
2019-11-05 20:52 ` [PATCH 52/55] target/arm: Allow reading flags from FPSCR for M-profile Michael Roth
2019-11-05 20:52 ` [PATCH 53/55] target/xtensa: regenerate and re-import test_mmuhifi_c3 core Michael Roth
2019-11-05 20:52 ` [PATCH 54/55] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) Michael Roth
2019-11-05 20:52 ` [PATCH 55/55] virtio-blk: Cancel the pending BH when the dataplane is reset Michael Roth
2019-11-08 9:46 ` [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12 Max Reitz
2019-11-11 14:03 ` Cole Robinson
2019-11-11 14:06 ` Cole Robinson
2019-11-12 18:05 ` Michael Roth
2019-11-12 23:12 ` Michael Roth
2019-11-12 21:52 ` Bruce Rogers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191105205243.3766-11-mdroth@linux.vnet.ibm.com \
--to=mdroth@linux.vnet.ibm.com \
--cc=armbru@redhat.com \
--cc=kwolf@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).