From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36559) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyeH9-0005Ib-Tf for qemu-devel@nongnu.org; Tue, 17 Nov 2015 06:18:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZyeH3-0003Td-UX for qemu-devel@nongnu.org; Tue, 17 Nov 2015 06:18:15 -0500 Received: from mx1.redhat.com ([209.132.183.28]:53086) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyeH3-0003TZ-In for qemu-devel@nongnu.org; Tue, 17 Nov 2015 06:18:09 -0500 From: Stefan Hajnoczi Date: Tue, 17 Nov 2015 19:17:26 +0800 Message-Id: <1447759048-25772-6-git-send-email-stefanha@redhat.com> In-Reply-To: <1447759048-25772-1-git-send-email-stefanha@redhat.com> References: <1447759048-25772-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL for-2.5 5/7] aio-epoll: Fix use-after-free of node List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Fam Zheng , Stefan Hajnoczi From: Fam Zheng aio_epoll_update needs the fields in node, so delay the free. Reported-by: Paolo Bonzini Signed-off-by: Fam Zheng Message-id: 1447655534-13974-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi --- aio-posix.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/aio-posix.c b/aio-posix.c index 06148a9..482b316 100644 --- a/aio-posix.c +++ b/aio-posix.c @@ -210,6 +210,7 @@ void aio_set_fd_handler(AioContext *ctx, { AioHandler *node; bool is_new = false; + bool deleted = false; node = find_aio_handler(ctx, fd); @@ -228,7 +229,7 @@ void aio_set_fd_handler(AioContext *ctx, * releasing the walking_handlers lock. */ QLIST_REMOVE(node, node); - g_free(node); + deleted = true; } } } else { @@ -253,6 +254,9 @@ void aio_set_fd_handler(AioContext *ctx, aio_epoll_update(ctx, node, is_new); aio_notify(ctx); + if (deleted) { + g_free(node); + } } void aio_set_event_notifier(AioContext *ctx, -- 2.5.0