[01/11] virtio-blk: fix use-after-free while handling scsi commands

Submitted by Kevin Wolf on Aug. 10, 2012, 4:47 p.m.


Message ID 1344617249-6620-2-git-send-email-kwolf@redhat.com
State New
Headers show

Commit Message

Kevin Wolf Aug. 10, 2012, 4:47 p.m.
From: Avi Kivity <avi@redhat.com>

The scsi passthrough handler falls through after completing a
request into the failure path, resulting in a use after free.

Reproducible by running a guest with aio=native on a block device.

Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 hw/virtio-blk.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Patch hide | download patch | download mbox

diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index f21757e..552b3b6 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -254,6 +254,7 @@  static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
     virtio_blk_req_complete(req, status);
+    return;