From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:46341) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UVMi3-00048u-R2 for qemu-devel@nongnu.org; Thu, 25 Apr 2013 09:59:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UVMhz-0002TA-2p for qemu-devel@nongnu.org; Thu, 25 Apr 2013 09:59:39 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15742) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UVMhy-0002Sy-Pt for qemu-devel@nongnu.org; Thu, 25 Apr 2013 09:59:34 -0400 From: Kevin Wolf Date: Thu, 25 Apr 2013 15:59:27 +0200 Message-Id: <1366898367-22166-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] rbd: Fix use after free in rbd_open() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, josh.durgin@inktank.com, Oliver.Francke@filoo.de, stefanha@redhat.com Commit 56d1b4d2 frees the QemuOpts for the driver-specific options immediately, even though it still needs the filename string that is contained there. This doesn't work. Move the deletion of the QemuOpts to the end of the function where its content isn't needed any more. Signed-off-by: Kevin Wolf --- block/rbd.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/block/rbd.c b/block/rbd.c index 1826411..0f2608b 100644 --- a/block/rbd.c +++ b/block/rbd.c @@ -478,20 +478,20 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags) } filename = qemu_opt_get(opts, "filename"); - qemu_opts_del(opts); if (qemu_rbd_parsename(filename, pool, sizeof(pool), snap_buf, sizeof(snap_buf), s->name, sizeof(s->name), conf, sizeof(conf)) < 0) { - return -EINVAL; + r = -EINVAL; + goto failed_opts; } clientname = qemu_rbd_parse_clientname(conf, clientname_buf); r = rados_create(&s->cluster, clientname); if (r < 0) { error_report("error initializing"); - return r; + goto failed_opts; } s->snap = NULL; @@ -557,6 +557,7 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags) NULL, qemu_rbd_aio_flush_cb, s); + qemu_opts_del(opts); return 0; failed: @@ -566,6 +567,8 @@ failed_open: failed_shutdown: rados_shutdown(s->cluster); g_free(s->snap); +failed_opts: + qemu_opts_del(opts); return r; } -- 1.8.1.4