[Qemu-devel] [PULL v1] Merge io/ 2017/01/26

[Qemu-devel] [PULL v1] Merge io/ 2017/01/26

[Daniel P. Berrange]

The following changes since commit c7f1cf01b8245762ca5864e835d84f6677ae8b1f:

  Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging (2017-01-25 17:54:14 +0000)

are available in the git repository at:

  git://github.com/berrange/qemu tags/pull-qio-2017-01-26-1

for you to fetch changes up to 80fb34eda099e7cc519a91e9701ab3c0262717b3:

  io: fix possible double free of task error object (2017-01-26 10:26:18 +0000)

----------------------------------------------------------------
Merge io/ 2017/01/26

----------------------------------------------------------------
Daniel P. Berrange (1):
  io: fix possible double free of task error object

 io/task.c            | 1 +
 tests/test-io-task.c | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

-- 
2.9.3

[Qemu-devel] [PULL v1] io: fix possible double free of task error object

[Daniel P. Berrange]

If a QIOTask has an error set and the calling code uses
qio_task_propagate_error() to steal the reference to
that Error object, the task would not clear its own
reference. This would lead to a double-free when
qio_task_free runs, if the caller had (correctly) freed
the Error object they now owned.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 io/task.c            | 1 +
 tests/test-io-task.c | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/io/task.c b/io/task.c
index 60bf1a9..3ce5560 100644
--- a/io/task.c
+++ b/io/task.c
@@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task,
 {
     if (task->err) {
         error_propagate(errp, task->err);
+        task->err = NULL;
         return true;
     }
 
diff --git a/tests/test-io-task.c b/tests/test-io-task.c
index ff62272..141aa2c 100644
--- a/tests/test-io-task.c
+++ b/tests/test-io-task.c
@@ -127,7 +127,7 @@ static void test_task_failure(void)
     g_assert(data.source == obj);
     g_assert(data.err == err);
     g_assert(data.freed == false);
-
+    error_free(data.err);
 }
 
 
@@ -238,6 +238,8 @@ static void test_task_thread_failure(void)
     g_assert(data.source == obj);
     g_assert(data.err != NULL);
 
+    error_free(data.err);
+
     self = g_thread_self();
 
     /* Make sure the test_task_thread_worker actually got
-- 
2.9.3

Re: [Qemu-devel] [PULL v1] Merge io/ 2017/01/26

[Peter Maydell]

On 26 January 2017 at 10:27, Daniel P. Berrange <berrange@redhat.com> wrote:
> The following changes since commit c7f1cf01b8245762ca5864e835d84f6677ae8b1f:
>
>   Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging (2017-01-25 17:54:14 +0000)
>
> are available in the git repository at:
>
>   git://github.com/berrange/qemu tags/pull-qio-2017-01-26-1
>
> for you to fetch changes up to 80fb34eda099e7cc519a91e9701ab3c0262717b3:
>
>   io: fix possible double free of task error object (2017-01-26 10:26:18 +0000)
>
> ----------------------------------------------------------------
> Merge io/ 2017/01/26
>
> ----------------------------------------------------------------
> Daniel P. Berrange (1):
>   io: fix possible double free of task error object

Applied, thanks.

-- PMM