diff options
| author | Greg Kurz <groug@kaod.org> | 2017-06-29 15:11:50 +0200 |
|---|---|---|
| committer | Greg Kurz <groug@kaod.org> | 2017-06-29 15:11:50 +0200 |
| commit | 3a21fb2af07ca6d22e39a766363befbf833f86bb (patch) | |
| tree | 2757c2acaa55d1cc90671b3ea8f7151c4698ab41 | |
| parent | 453a1b234fc11570e332e91d58e4dbfeec7cb824 (diff) | |
| download | qemu-3a21fb2af07ca6d22e39a766363befbf833f86bb.zip qemu-3a21fb2af07ca6d22e39a766363befbf833f86bb.tar.gz qemu-3a21fb2af07ca6d22e39a766363befbf833f86bb.tar.bz2 | |
virtio-9p: record element after sanity checks
If the guest sends a malformed request, we end up with a dangling pointer
in V9fsVirtioState. This doesn't seem to cause any bug, but let's remove
this side effect anyway.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
| -rw-r--r-- | hw/9pfs/virtio-9p-device.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index 245abd8..3380bfc 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -61,7 +61,6 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) } QEMU_BUILD_BUG_ON(sizeof(out) != 7); - v->elems[pdu->idx] = elem; len = iov_to_buf(elem->out_sg, elem->out_num, 0, &out, sizeof(out)); if (len != sizeof(out)) { @@ -70,6 +69,8 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) goto out_free_req; } + v->elems[pdu->idx] = elem; + pdu_submit(pdu, &out); } |