diff options
| author | Alberto Garcia | 2018-09-06 16:25:41 +0200 |
|---|---|---|
| committer | Kevin Wolf | 2018-09-25 15:50:15 +0200 |
| commit | 8961be33e8ca7e809c603223803ea66ef7ea5be7 (patch) | |
| tree | c665ac454c2a88464e16d06c67976636fbdc983c /include/exec/user | |
| parent | block/linux-aio: acquire AioContext before qemu_laio_process_completions (diff) | |
| download | qemu-8961be33e8ca7e809c603223803ea66ef7ea5be7.tar.gz qemu-8961be33e8ca7e809c603223803ea66ef7ea5be7.tar.xz qemu-8961be33e8ca7e809c603223803ea66ef7ea5be7.zip | |
block: Fix use after free error in bdrv_open_inherit()
When a block device is opened with BDRV_O_SNAPSHOT and the
bdrv_append_temp_snapshot() call fails then the error code path tries
to unref the already destroyed 'options' QDict.
This can be reproduced easily by setting TMPDIR to a location where
the QEMU process can't write:
$ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on
Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'include/exec/user')
0 files changed, 0 insertions, 0 deletions