Re: [Qemu-stable] [Qemu-block] [PATCH for-2.10?] block: Do not unref bs->file on error in BD's open

[Stefan Hajnoczi]

On Thu, Apr 13, 2017 at 05:43:34PM +0200, Max Reitz wrote:
> The block layer takes care of removing the bs->file child if the block
> driver's bdrv_open()/bdrv_file_open() implementation fails. The block
> driver therefore does not need to do so, and indeed should not unless it
> sets bs->file to NULL afterwards -- because if this is not done, the
> bdrv_unref_child() in bdrv_open_inherit() will dereference the freed
> memory block at bs->file afterwards, which is not good.
> 
> We can now decide whether to add a "bs->file = NULL;" after each of the
> offending bdrv_unref_child() invocations, or just drop them altogether.
> The latter is simpler, so let's do that.
> 
> Cc: qemu-stable <address@hidden>
> Signed-off-by: Max Reitz <address@hidden>
> ---
> It's an issue only in blkdebug, blkreplace and blkverify, and only when
> an error occurs in their open functions; therefore I think this is fine
> to delay until 2.10.
> 
> However, it *is* a use-after-free newly introduced in 2.9, so that's
> where the question mark comes from...
> ---
>  block/blkdebug.c  | 4 +---
>  block/blkreplay.c | 3 ---
>  block/blkverify.c | 3 ---
>  3 files changed, 1 insertion(+), 9 deletions(-)

Reviewed-by: Stefan Hajnoczi <address@hidden>

signature.asc
Description: PGP signature