* [PATCH] block/vvfat: Do not unref qcow on closing backing bdrv
@ 2020-02-09 17:51 Hikaru Nishida
2020-02-14 13:12 ` Kevin Wolf
0 siblings, 1 reply; 2+ messages in thread
From: Hikaru Nishida @ 2020-02-09 17:51 UTC (permalink / raw)
To: qemu-devel; +Cc: Kevin Wolf, Hikaru Nishida, open list:vvfat, Max Reitz
Before this commit, BDRVVVFATState.qcow is unrefed in write_target_close
on closing backing bdrv of vvfat. However, qcow bdrv is opend as a child
of vvfat in enable_write_target() so it will be also unrefed on closing
vvfat itself. This causes use-after-free of qcow on freeing vvfat which
has backing bdrv and qcow bdrv as children in this order because
bdrv_close(vvfat) tries to free qcow bdrv after freeing backing bdrv
as QLIST_FOREACH_SAFE() loop keeps next pointer, but BdrvChild of qcow
is already freed in bdrv_close(backing bdrv).
Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com>
---
block/vvfat.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/block/vvfat.c b/block/vvfat.c
index 019b8f1341..ab800c4887 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -3124,17 +3124,10 @@ write_target_commit(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
return ret;
}
-static void write_target_close(BlockDriverState *bs) {
- BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
- bdrv_unref_child(s->bs, s->qcow);
- g_free(s->qcow_filename);
-}
-
static BlockDriver vvfat_write_target = {
.format_name = "vvfat_write_target",
.instance_size = sizeof(void*),
.bdrv_co_pwritev = write_target_commit,
- .bdrv_close = write_target_close,
};
static void vvfat_qcow_options(int *child_flags, QDict *child_options,
--
2.21.0 (Apple Git-122.2)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] block/vvfat: Do not unref qcow on closing backing bdrv
2020-02-09 17:51 [PATCH] block/vvfat: Do not unref qcow on closing backing bdrv Hikaru Nishida
@ 2020-02-14 13:12 ` Kevin Wolf
0 siblings, 0 replies; 2+ messages in thread
From: Kevin Wolf @ 2020-02-14 13:12 UTC (permalink / raw)
To: Hikaru Nishida; +Cc: qemu-devel, open list:vvfat, Max Reitz
Am 09.02.2020 um 18:51 hat Hikaru Nishida geschrieben:
> Before this commit, BDRVVVFATState.qcow is unrefed in write_target_close
> on closing backing bdrv of vvfat. However, qcow bdrv is opend as a child
> of vvfat in enable_write_target() so it will be also unrefed on closing
> vvfat itself. This causes use-after-free of qcow on freeing vvfat which
> has backing bdrv and qcow bdrv as children in this order because
> bdrv_close(vvfat) tries to free qcow bdrv after freeing backing bdrv
> as QLIST_FOREACH_SAFE() loop keeps next pointer, but BdrvChild of qcow
> is already freed in bdrv_close(backing bdrv).
>
> Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com>
Thanks, applied to the block branch.
Kevin
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-02-14 13:13 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-09 17:51 [PATCH] block/vvfat: Do not unref qcow on closing backing bdrv Hikaru Nishida
2020-02-14 13:12 ` Kevin Wolf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).