Re: [Qemu-devel] [PATCH] block: Fix use after free error in bdrv_open_inherit()

2018-09-10 Thread Alberto Garcia
On Mon 10 Sep 2018 10:34:20 AM CEST, Kevin Wolf wrote: > Am 06.09.2018 um 16:25 hat Alberto Garcia geschrieben: >> When a block device is opened with BDRV_O_SNAPSHOT and the >> bdrv_append_temp_snapshot() call fails then the error code path tries >> to unref the already destroyed 'options' QDict.

Re: [Qemu-devel] [PATCH] block: Fix use after free error in bdrv_open_inherit()

2018-09-10 Thread Kevin Wolf
Am 06.09.2018 um 16:25 hat Alberto Garcia geschrieben: > When a block device is opened with BDRV_O_SNAPSHOT and the > bdrv_append_temp_snapshot() call fails then the error code path tries > to unref the already destroyed 'options' QDict. > > This can be reproduced easily by setting TMPDIR to a loc

[Qemu-devel] [PATCH] block: Fix use after free error in bdrv_open_inherit()

2018-09-06 Thread Alberto Garcia
When a block device is opened with BDRV_O_SNAPSHOT and the bdrv_append_temp_snapshot() call fails then the error code path tries to unref the already destroyed 'options' QDict. This can be reproduced easily by setting TMPDIR to a location where the QEMU process can't write: $ TMPDIR=/nonexiste