From patchwork Mon Apr 5 20:34:00 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [19/21] virtio-blk: Fix use after free in error case Date: Mon, 05 Apr 2010 10:34:00 -0000 From: Luiz Capitulino X-Patchwork-Id: 49451 Message-Id: <1270499642-31543-20-git-send-email-lcapitulino@redhat.com> To: aliguori@us.ibm.com Cc: Kevin Wolf , qemu-devel@nongnu.org, Luiz Capitulino From: Kevin Wolf virtio_blk_req_complete frees the request, so we can't access it any more when calling bdrv_mon_event. Use the pointer that was copied earlier. Signed-off-by: Kevin Wolf Signed-off-by: Luiz Capitulino --- hw/virtio-blk.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c index 9915840..01d77b8 100644 --- a/hw/virtio-blk.c +++ b/hw/virtio-blk.c @@ -65,7 +65,7 @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error, VirtIOBlock *s = req->dev; if (action == BLOCK_ERR_IGNORE) { - bdrv_mon_event(req->dev->bs, BDRV_ACTION_IGNORE, is_read); + bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read); return 0; } @@ -73,11 +73,11 @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error, || action == BLOCK_ERR_STOP_ANY) { req->next = s->rq; s->rq = req; - bdrv_mon_event(req->dev->bs, BDRV_ACTION_STOP, is_read); + bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read); vm_stop(0); } else { virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR); - bdrv_mon_event(req->dev->bs, BDRV_ACTION_REPORT, is_read); + bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read); } return 1;