From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=49434 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Oy4fG-0008L4-9V for qemu-devel@nongnu.org; Tue, 21 Sep 2010 11:21:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1Oy4f8-0005o6-7O for qemu-devel@nongnu.org; Tue, 21 Sep 2010 11:21:43 -0400 Received: from mx1.redhat.com ([209.132.183.28]:30843) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Oy4f7-0005nv-Vx for qemu-devel@nongnu.org; Tue, 21 Sep 2010 11:21:42 -0400 From: Kevin Wolf Date: Tue, 21 Sep 2010 17:21:44 +0200 Message-Id: <1285082522-24407-3-git-send-email-kwolf@redhat.com> In-Reply-To: <1285082522-24407-1-git-send-email-kwolf@redhat.com> References: <1285082522-24407-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 02/20] vvfat: Fix double free for opening the image rw List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: anthony@codemonkey.ws Cc: kwolf@redhat.com, qemu-devel@nongnu.org From: Kevin Wolf Allocation and deallocation of bs->opaque is not in the control of a block driver. Therefore it should not set bs->opaque to a data structure used by another bs, or closing the image will lead to a double free. Signed-off-by: Kevin Wolf --- block/vvfat.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/block/vvfat.c b/block/vvfat.c index 5898d66..0772037 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -2768,12 +2768,12 @@ static int vvfat_is_allocated(BlockDriverState *bs, static int write_target_commit(BlockDriverState *bs, int64_t sector_num, const uint8_t* buffer, int nb_sectors) { - BDRVVVFATState* s = bs->opaque; + BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque); return try_commit(s); } static void write_target_close(BlockDriverState *bs) { - BDRVVVFATState* s = bs->opaque; + BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque); bdrv_delete(s->qcow); free(s->qcow_filename); } @@ -2816,7 +2816,8 @@ static int enable_write_target(BDRVVVFATState *s) s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1); s->bs->backing_hd->drv = &vvfat_write_target; - s->bs->backing_hd->opaque = s; + s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*)); + *(void**)s->bs->backing_hd->opaque = s; return 0; } -- 1.7.2.2