diff mbox

[PATCHv2] vhost: fix double free on device stop

Message ID 20110621173417.GA17272@redhat.com
State New
Headers show

Commit Message

Michael S. Tsirkin June 21, 2011, 5:34 p.m. UTC
vhost dev stop failed to clear the log field.
Typically not an issue as dev start overwrites this field,
but if logging gets disabled before the following start,
it doesn't so this causes a double free.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/vhost.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Comments

Chris Wright June 21, 2011, 5:49 p.m. UTC | #1
* Michael S. Tsirkin (mst@redhat.com) wrote:
> vhost dev stop failed to clear the log field.
> Typically not an issue as dev start overwrites this field,
> but if logging gets disabled before the following start,
> it doesn't so this causes a double free.
> 
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Acked-by: Chris Wright <chrisw@redhat.com>

thanks,
-chris
Jason Wang June 22, 2011, 3:04 a.m. UTC | #2
On 06/22/2011 01:34 AM, Michael S. Tsirkin wrote:
> vhost dev stop failed to clear the log field.
> Typically not an issue as dev start overwrites this field,
> but if logging gets disabled before the following start,
> it doesn't so this causes a double free.
>
> Signed-off-by: Michael S. Tsirkin<mst@redhat.com>
> ---
Acked-by: Jason Wang <jasowang@redhat.com>
>   hw/vhost.c |    1 +
>   1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/hw/vhost.c b/hw/vhost.c
> index 80f771e..c3d8821 100644
> --- a/hw/vhost.c
> +++ b/hw/vhost.c
> @@ -784,5 +784,6 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev)
>
>       hdev->started = false;
>       qemu_free(hdev->log);
> +    hdev->log = NULL;
>       hdev->log_size = 0;
>   }
diff mbox

Patch

diff --git a/hw/vhost.c b/hw/vhost.c
index 80f771e..c3d8821 100644
--- a/hw/vhost.c
+++ b/hw/vhost.c
@@ -784,5 +784,6 @@  void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev)
 
     hdev->started = false;
     qemu_free(hdev->log);
+    hdev->log = NULL;
     hdev->log_size = 0;
 }