diff mbox series

[4/5] block/amend: Keep strong reference to BDS

Message ID 20220304153729.711387-5-hreitz@redhat.com
State New
Headers show
Series block/amend: Fix failures seen in iotest 296 | expand

Commit Message

Hanna Czenczek March 4, 2022, 3:37 p.m. UTC 
Otherwise, the BDS might be freed while the job is running, which would
cause a use-after-free.

Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 block/amend.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/block/amend.c b/block/amend.c
index 553890ded9..f696a006e3 100644
--- a/block/amend.c
+++ b/block/amend.c
@@ -69,6 +69,8 @@  static void blockdev_amend_free(Job *job)
     if (s->bs->drv->bdrv_amend_clean) {
         s->bs->drv->bdrv_amend_clean(s->bs);
     }
+
+    bdrv_unref(s->bs);
 }
 
 static const JobDriver blockdev_amend_job_driver = {
@@ -129,6 +131,7 @@  void qmp_x_blockdev_amend(const char *job_id,
         return;
     }
 
+    bdrv_ref(bs);
     s->bs = bs,
     s->opts = QAPI_CLONE(BlockdevAmendOptions, options),
     s->force = has_force ? force : false;