From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:41048) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RTtcf-0003xj-0s for qemu-devel@nongnu.org; Fri, 25 Nov 2011 06:07:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RTtce-0002NF-43 for qemu-devel@nongnu.org; Fri, 25 Nov 2011 06:07:12 -0500 Received: from mail-gy0-f173.google.com ([209.85.160.173]:52801) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RTtcd-0002NA-Tx for qemu-devel@nongnu.org; Fri, 25 Nov 2011 06:07:12 -0500 Received: by ghbg19 with SMTP id g19so3890171ghb.4 for ; Fri, 25 Nov 2011 03:07:11 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 25 Nov 2011 12:06:22 +0100 Message-Id: <1322219182-18502-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 1.0] qiov: prevent double free or use-after-free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data could thus be used after free or freed again. While I do not know any example in the tree, I observed this using virtio-scsi (and SCSI scatter/gather) when canceling DMA requests. Signed-off-by: Paolo Bonzini --- cutils.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/cutils.c b/cutils.c index 5d995bc..731a27e 100644 --- a/cutils.c +++ b/cutils.c @@ -217,7 +217,10 @@ void qemu_iovec_destroy(QEMUIOVector *qiov) { assert(qiov->nalloc != -1); + qemu_iovec_reset(qiov); g_free(qiov->iov); + qiov->nalloc = 0; + qiov->iov = NULL; } void qemu_iovec_reset(QEMUIOVector *qiov) -- 1.7.7.1