[v2,01/20] parallels: Set s->used_bmap to NULL in parallels_free_used_bitmap()

Commit Message

Alexander Ivanov Oct. 19, 2023, 12:58 p.m. UTC

After used bitmap freeng s->used_bmap points to the freed memory. If we try
to free used bitmap one more time it leads to double free error.

Set s->used_bmap to NULL to exclude double free error.

Signed-off-by: Alexander Ivanov <[e-mail]>
---
 block/parallels.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Mike Maslenkin Oct. 21, 2023, 10:40 a.m. UTC | #1

On Thu, Oct 19, 2023 at 4:06 PM Alexander Ivanov
<[e-mail]> wrote:
>
> After used bitmap freeng s->used_bmap points to the freed memory. If we try
> to free used bitmap one more time it leads to double free error.
>
> Set s->used_bmap to NULL to exclude double free error.
>
> Signed-off-by: Alexander Ivanov <[e-mail]>
> ---
>  block/parallels.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/block/parallels.c b/block/parallels.c
> index 6b46623241..ba1fdde259 100644
> --- a/block/parallels.c
> +++ b/block/parallels.c
> @@ -244,6 +244,7 @@ static void parallels_free_used_bitmap(BlockDriverState *bs)
>  {
>      BDRVParallelsState *s = bs->opaque;
>      s->used_bmap_size = 0;
> +    s->used_bmap = NULL;
>      g_free(s->used_bmap);
>  }

Shouldn't it be added after g_free() call?

Regards,
Mike.

Alexander Ivanov Oct. 24, 2023, 10:29 a.m. UTC | #2

On 10/21/23 12:40, Mike Maslenkin wrote:
> On Thu, Oct 19, 2023 at 4:06 PM Alexander Ivanov
> <[e-mail]> wrote:
>> After used bitmap freeng s->used_bmap points to the freed memory. If we try
>> to free used bitmap one more time it leads to double free error.
>>
>> Set s->used_bmap to NULL to exclude double free error.
>>
>> Signed-off-by: Alexander Ivanov <[e-mail]>
>> ---
>>   block/parallels.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/block/parallels.c b/block/parallels.c
>> index 6b46623241..ba1fdde259 100644
>> --- a/block/parallels.c
>> +++ b/block/parallels.c
>> @@ -244,6 +244,7 @@ static void parallels_free_used_bitmap(BlockDriverState *bs)
>>   {
>>       BDRVParallelsState *s = bs->opaque;
>>       s->used_bmap_size = 0;
>> +    s->used_bmap = NULL;
>>       g_free(s->used_bmap);
>>   }
> Shouldn't it be added after g_free() call?
OMG, of course.
>
> Regards,
> Mike.

Patch

diff --git a/block/parallels.c b/block/parallels.c
index 6b46623241..ba1fdde259 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -244,6 +244,7 @@  static void parallels_free_used_bitmap(BlockDriverState *bs)
 {
     BDRVParallelsState *s = bs->opaque;
     s->used_bmap_size = 0;
+    s->used_bmap = NULL;
     g_free(s->used_bmap);
 }