diff mbox series

[35/97] block: Fix use after free error in bdrv_open_inherit()

Message ID 20190401210011.16009-36-mdroth@linux.vnet.ibm.com
State New
Headers show
Series Patch Round-up for stable 3.0.1, freeze on 2019-04-08 | expand

Commit Message

Michael Roth April 1, 2019, 8:59 p.m. UTC 
From: Alberto Garcia <berto@igalia.com>

When a block device is opened with BDRV_O_SNAPSHOT and the
bdrv_append_temp_snapshot() call fails then the error code path tries
to unref the already destroyed 'options' QDict.

This can be reproduced easily by setting TMPDIR to a location where
the QEMU process can't write:

   $ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8961be33e8ca7e809c603223803ea66ef7ea5be7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
 block.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/block.c b/block.c
index 39f373e035..a7f6a13a74 100644
--- a/block.c
+++ b/block.c
@@ -2787,6 +2787,7 @@  static BlockDriverState *bdrv_open_inherit(const char *filename,
     bdrv_parent_cb_change_media(bs, true);
 
     qobject_unref(options);
+    options = NULL;
 
     /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
      * temporary snapshot afterwards. */