haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Block patches for 6.0-rc3:

Browse source 
- Use-after-free fix for block/nbd.c
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEkb62CjDbPohX0Rgp9AfbAGHVz0AFAmB1njQSHG1yZWl0ekBy
 ZWRoYXQuY29tAAoJEPQH2wBh1c9AMQUH/1JDtN+Sax5exC6RUbrraoo3akWHM7kj
 cU/setlBtFV7ovyhhQ74GCOy9uu23/uCluJIaCMriZgDkWo+stV6EM6KHND4hOiV
 mOW16+h5WkVOp521igMaXLrZ+MyXvTbOXtRKWEITZV49qAP0Qwyfg0T++VjMTSPB
 TYhM+tkC2wcIcE3Qwj2YFy9KCIWXOBVREvJycBHN2j7+OB+ngD5NW+qfh/bmzG8M
 0pD1qG+ye17rbXOSC60HrgPkVZr+NymROTVSjmEol59BowyIFlw3+ZChN/ti/A05
 irpogp6/nZWrceVJfbISDi7SBRZbYfCI7gNCPJRY3Hx031krkD3ox1w=
 =7zEh
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' into staging

Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c

# gpg: Signature made Tue 13 Apr 2021 14:35:48 BST
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2021-04-13:
  block/nbd: fix possible use after free of s->connect_thread

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2021-04-13 21:05:17 +01:00
parent 1b66515334 0267101af6
commit db55d2c923
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
block/nbd.c
View file

@ -443,6 +443,11 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
BDRVNBDState *s = bs->opaque;
NBDConnectThread *thr = s->connect_thread;
if (!thr) {
/* detached */
return -1;
}
qemu_mutex_lock(&thr->mutex);
switch (thr->state) {
@ -486,6 +491,12 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
s->wait_connect = true;
qemu_coroutine_yield();
if (!s->connect_thread) {
/* detached */
return -1;
}
assert(thr == s->connect_thread);
qemu_mutex_lock(&thr->mutex);
switch (thr->state) {