virtio-9p: record element after sanity checks
If the guest sends a malformed request, we end up with a dangling pointer in V9fsVirtioState. This doesn't seem to cause any bug, but let's remove this side effect anyway. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
parent
453a1b234f
commit
3a21fb2af0
|
@ -61,7 +61,6 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq)
|
||||||
}
|
}
|
||||||
QEMU_BUILD_BUG_ON(sizeof(out) != 7);
|
QEMU_BUILD_BUG_ON(sizeof(out) != 7);
|
||||||
|
|
||||||
v->elems[pdu->idx] = elem;
|
|
||||||
len = iov_to_buf(elem->out_sg, elem->out_num, 0,
|
len = iov_to_buf(elem->out_sg, elem->out_num, 0,
|
||||||
&out, sizeof(out));
|
&out, sizeof(out));
|
||||||
if (len != sizeof(out)) {
|
if (len != sizeof(out)) {
|
||||||
|
@ -70,6 +69,8 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq)
|
||||||
goto out_free_req;
|
goto out_free_req;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
v->elems[pdu->idx] = elem;
|
||||||
|
|
||||||
pdu_submit(pdu, &out);
|
pdu_submit(pdu, &out);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue