Re: [Qemu-devel] [PATCH 1/2] commit: Fix use after free in completion

2017-06-09 Thread Kevin Wolf
Am 02.06.2017 um 23:12 hat Kevin Wolf geschrieben: > The final bdrv_set_backing_hd() could be working on already freed nodes > because the commit job drops its references (through BlockBackends) to > both overlay_bs and top already a bit earlier. > > One way to trigger the bug is hot unplugging a

[Qemu-devel] [PATCH 1/2] commit: Fix use after free in completion

2017-06-02 Thread Kevin Wolf
The final bdrv_set_backing_hd() could be working on already freed nodes because the commit job drops its references (through BlockBackends) to both overlay_bs and top already a bit earlier. One way to trigger the bug is hot unplugging a disk for which blockdev_mark_auto_del() cancels the block job