diff mbox series

[10/55] pr-manager: Fix invalid g_free() crash bug

Message ID	20191105205243.3766-11-mdroth@linux.vnet.ibm.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=pXLP=Y5=nongnu.org=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C4DBF21882 From: Michael Roth <mdroth@linux.vnet.ibm.com> To: qemu-devel@nongnu.org Subject: [PATCH 10/55] pr-manager: Fix invalid g_free() crash bug Date: Tue, 5 Nov 2019 14:51:58 -0600 Message-Id: <20191105205243.3766-11-mdroth@linux.vnet.ibm.com> In-Reply-To: <20191105205243.3766-1-mdroth@linux.vnet.ibm.com> References: <20191105205243.3766-1-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Precedence: list Cc: Kevin Wolf <kwolf@redhat.com>, qemu-stable@nongnu.org, Markus Armbruster <armbru@redhat.com> Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" <qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org>
Series	Patch Round-up for stable 4.1.1, freeze on 2019-11-12 \| expand [00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12 [01/55] dma-helpers: ensure AIO callback is invoked after cancellation [02/55] Revert "ide/ahci: Check for -ECANCELED in aio callbacks" [03/55] s390x/tcg: Fix VERIM with 32/64 bit elements [04/55] target/alpha: fix tlb_fill trap_arg2 value for instruction fetch [05/55] pc: Don't make die-id mandatory unless necessary [06/55] xen-bus: Fix backend state transition on device reset [07/55] xen-bus: check whether the frontend is active during device reset... [08/55] block/file-posix: Reduce xfsctl() use [09/55] iotests: Test reverse sub-cluster qcow2 writes [10/55] pr-manager: Fix invalid g_free() crash bug [11/55] x86: do not advertise die-id in query-hotpluggbale-cpus if '-smp dies' is not set [12/55] vpc: Return 0 from vpc_co_create() on success [13/55] iotests: add testing shim for script-style python tests [14/55] iotests: Add supported protocols to execute_test() [15/55] iotests: Restrict file Python tests to file [16/55] iotests: Restrict nbd Python tests to nbd [17/55] iotests: Test blockdev-create for vpc [18/55] target/arm: Free TCG temps in trans_VMOV_64_sp() [19/55] target/arm: Don't abort on M-profile exception return in linux-user mode [20/55] libvhost-user: fix SLAVE_SEND_FD handling [21/55] qcow2: Fix the calculation of the maximum L2 cache size [22/55] block/nfs: tear down aio before nfs_close [23/55] curl: Keep pointer to the CURLState in CURLSocket [24/55] curl: Keep *socket until the end of curl_sock_cb() [25/55] curl: Check completion in curl_multi_do() [26/55] curl: Pass CURLSocket to curl_multi_do() [27/55] curl: Report only ready sockets [28/55] curl: Handle success in multi_check_completion [29/55] blockjob: update nodes head while removing all bdrv [30/55] block/qcow2: Fix corruption introduced by commit 8ac0f15f335 [31/55] coroutine: Add qemu_co_mutex_assert_locked() [32/55] qcow2: Fix corruption bug in qcow2_detect_metadata_preallocation() [33/55] block/backup: fix max_transfer handling for copy_range [34/55] block/backup: fix backup_cow_with_offload for last cluster [35/55] hw/arm/boot.c: Set NSACR.{CP11, CP10} for NS kernel boots [36/55] make-release: pull in edk2 submodules so we can build it from tarballs [37/55] roms/Makefile.edk2: don't pull in submodules when building from tarball [38/55] s390: PCI: fix IOMMU region init [39/55] block/snapshot: Restrict set of snapshot nodes [40/55] iotests: Test internal snapshots with -blockdev [41/55] vhost-user: save features if the char dev is closed [42/55] hw/core/loader: Fix possible crash in rom_copy() [43/55] qcow2: Limit total allocation range to INT_MAX [44/55] iotests: Test large write request to qcow2 file [45/55] mirror: Do not dereference invalid pointers [46/55] ui: Fix hanging up Cocoa display on macOS 10.15 (Catalina) [47/55] virtio: new post_load hook [48/55] virtio-net: prevent offloads reset on migration [49/55] COLO-compare: Fix incorrect `if` logic [50/55] util/hbitmap: strict hbitmap_reset [51/55] hbitmap: handle set/reset with zero length [52/55] target/arm: Allow reading flags from FPSCR for M-profile [53/55] target/xtensa: regenerate and re-import test_mmuhifi_c3 core [54/55] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) [55/55] virtio-blk: Cancel the pending BH when the dataplane is reset

Commit Message

Michael Roth Nov. 5, 2019, 8:51 p.m. UTC

From: Markus Armbruster <armbru@redhat.com>

pr_manager_worker() passes its @opaque argument to g_free().  Wrong;
it points to pr_manager_worker()'s automatic @data.  Broken when
commit 2f3a7ab39be converted @data from heap- to stack-allocated.  Fix
by deleting the g_free().

Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
 scsi/pr-manager.c | 1 -
 1 file changed, 1 deletion(-)

diff mbox series

Patch

diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
index ee43663576..0c866e8698 100644
--- a/scsi/pr-manager.c
+++ b/scsi/pr-manager.c
@@ -39,7 +39,6 @@  static int pr_manager_worker(void *opaque)
     int fd = data->fd;
     int r;
 
-    g_free(data);
     trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]);
 
     /* The reference was taken in pr_manager_execute.  */