diff options
| author | Wei Wang | 2019-03-12 10:34:40 +0100 |
|---|---|---|
| committer | Michael S. Tsirkin | 2019-03-13 02:22:31 +0100 |
| commit | ae440bd14c002f3a5528bd38e8a285ea625c04ca (patch) | |
| tree | f6103c72615030eea6d112800c775f9fda24a516 /scripts/modules/module_block.py | |
| parent | Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request'... (diff) | |
| download | qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.tar.gz qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.tar.xz qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.zip | |
virtio-balloon: fix a use-after-free case
The elem could theorically contain both outbuf and inbufs. We move the
free operation to the end of this function to avoid using elem->in_sg
while elem has been freed.
Fixes: c13c4153f7
("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Wei Wang <wei.w.wang@intel.com>
CC: Michael S. Tsirkin <mst@redhat.com>
CC: Dr. David Alan Gilbert <dgilbert@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Peter Xu <peterx@redhat.com>
Message-Id: <1552383280-4122-1-git-send-email-wei.w.wang@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'scripts/modules/module_block.py')
0 files changed, 0 insertions, 0 deletions