haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
qemu-patch-raspberry4/hw
History
Prasad J Pandit 4ab0359a8a ide: ahci: reset ncq object to unused on error 
When processing NCQ commands, AHCI device emulation prepares a
NCQ transfer object; To which an aio control block(aiocb) object
is assigned in 'execute_ncq_command'. In case, when the NCQ
command is invalid, the 'aiocb' object is not assigned, and NCQ
transfer object is left as 'used'. This leads to a use after
free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'.
Reset NCQ transfer object to 'unused' to avoid it.

[Maintainer edit: s/ACHI/AHCI/ in the commit message. --js]

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
2016-01-11 14:10:42 -05:00
..
9pfs virtio-9p: use accessor to get thread_pool 2015-12-23 10:56:58 +01:00
acpi trivial patches for 2016-01-11 2016-01-11 12:56:58 +00:00
alpha alpha: convert "naked" qemu_log to tracepoint 2015-12-17 17:33:47 +01:00
arm hw/arm/virt: Support legacy -nic command line syntax 2016-01-11 16:04:50 +00:00
audio Remove macros IO_READ_PROTO and IO_WRITE_PROTO 2015-10-19 09:03:53 +02:00
block block: Rename BLOCK_OP_TYPE_MIRROR to BLOCK_OP_TYPE_MIRROR_SOURCE 2016-01-07 21:30:17 +01:00
bt bt: avoid unintended sign extension 2015-12-04 09:39:55 +03:00
char cris: avoid "naked" qemu_log 2015-12-17 17:33:47 +01:00
core hw/core/qdev: Remove superfluous return statement 2016-01-11 11:39:28 +03:00
cpu icc_bus: drop the unused files 2015-10-02 16:22:02 -03:00
cris cris: Remove ELF_MACHINE from cpu.h 2015-09-25 12:04:43 +02:00
display ui/curses: Fix color attribute of monitor for curses 2016-01-08 12:20:07 +01:00
dma hw/dma/xilinx_axidma: remove dead code 2016-01-11 15:52:18 +00:00
gpio i.MX: add support for lower and upper interrupt in GPIO. 2015-12-17 13:37:13 +00:00
i2c i.MX: Standardize i.MX I2C debug 2015-10-27 15:59:46 +00:00
i386 i386/pc: expose identifying the floppy controller 2016-01-09 23:20:20 +02:00
ide ide: ahci: reset ncq object to unused on error 2016-01-11 14:10:42 -05:00
input qapi: Change munging of CamelCase enum values 2015-12-17 08:21:28 +01:00
intc kvm: x86: add support for KVM_CAP_SPLIT_IRQCHIP 2015-12-17 17:33:47 +01:00
ipack pci: Trivial device model conversions to realize 2015-02-26 12:42:16 +01:00
ipmi ipmi: Add a force off function 2015-12-22 18:39:19 +02:00
isa hw/isa/lpc_ich9: inject the SMI on the VCPU that is writing to APM_CNT 2015-10-22 14:39:09 +03:00
lm32 ui/opengl: Reduce build required libraries for opengl 2015-11-03 10:13:42 +01:00
m68k m68k: Remove ELF_MACHINE from cpu.h 2015-09-25 12:04:43 +02:00
mem nvdimm: implement NVDIMM device abstract 2015-12-22 18:39:20 +02:00
microblaze petalogix-ml605: Set the MicroBlaze CPU version to 8.10.a 2016-01-07 14:57:26 +01:00
mips gt64120: convert to realize() 2016-01-11 11:39:28 +03:00
misc i.MX: move i.MX31 CCM object to register array 2016-01-11 15:52:18 +00:00
moxie moxie: Remove ELF_MACHINE from cpu.h 2015-09-25 12:04:43 +02:00
net ether/slirp: Avoid redefinition of the same constants 2016-01-11 11:01:35 +08:00
nvram fw_cfg: replace ioport data read with generic method 2015-12-15 11:46:13 +01:00
openrisc * First batch of MAINTAINERS updates 2015-09-25 21:52:30 +01:00
pci fix bad indentation in pcie_cap_slot_write_config() 2015-11-06 15:42:38 +03:00
pci-bridge hw/pxb: introduce pxb-pcie expander for PCIe machines 2015-12-22 17:45:13 +02:00
pci-host trivial patches for 2016-01-11 2016-01-11 12:56:58 +00:00
pcmcia hw: do not pass NULL to memory_region_init from instance_init 2015-10-09 15:25:56 +02:00
ppc hw/ppc/spapr: fix spapr->kvm_type leak 2016-01-11 15:29:05 +11:00
s390x hw/s390x: Remove superfluous return statements 2016-01-11 11:39:28 +03:00
scsi scsi: always call notifier on async cancellation 2015-12-17 17:33:49 +01:00
sd sdhci: add optional quirk property to disable card insertion/removal interrupts 2015-12-22 16:34:26 +08:00
sh4 SH PCI Host: convert to realize() 2016-01-11 11:39:28 +03:00
smbios smbios: add smbios 3.0 support 2015-09-07 10:39:28 +01:00
sparc sparc: Remove ELF_MACHINE from cpu.h 2015-09-25 12:04:44 +02:00
sparc64 sun4u: split NPT and INT_DIS accesses between timer and compare registers 2016-01-07 12:21:02 +00:00
ssi arm: Use g_new() & friends where that makes obvious sense 2015-09-07 10:39:27 +01:00
timer pc: acpi: move HPET from DSDT to SSDT 2016-01-09 23:20:18 +02:00
tpm tpm: avoid clang shifting negative signed warning 2015-11-17 18:35:56 +08:00
tricore tricore: Remove ELF_MACHINE from cpu.h 2015-09-25 12:04:44 +02:00
unicore32 Use DEFINE_MACHINE() to register all machines 2015-09-19 16:40:15 +02:00
usb ohci: clear pending SOF on suspend 2016-01-08 09:29:24 +01:00
vfio vfio: Use g_new() & friends where that makes obvious sense 2015-11-10 12:11:08 -07:00
virtio virtio: fix error message for number of queues 2016-01-09 23:20:20 +02:00
watchdog i6300esb: remove muldiv64() 2015-09-25 14:52:17 +02:00
xen xen/Makefile.objs: simplify 2016-01-11 11:39:28 +03:00
xenpv xen: fix usage of xc_domain_create in domain builder 2015-11-13 17:38:06 +00:00
xtensa target-xtensa: xtfpga: attach FLASH to system IO 2015-10-21 21:28:33 +03:00
Makefile.objs Add a base IPMI interface 2015-12-22 18:39:19 +02:00