diff options
| author | Wei Wang <wei.w.wang@intel.com> | 2019-03-12 17:34:40 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2019-03-12 21:22:31 -0400 |
| commit | ae440bd14c002f3a5528bd38e8a285ea625c04ca (patch) | |
| tree | f6103c72615030eea6d112800c775f9fda24a516 /include/hw/intc | |
| parent | 9d867123659ac32edd2a0b64cabe2dca544f1d0e (diff) | |
| download | qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.zip qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.tar.gz qemu-ae440bd14c002f3a5528bd38e8a285ea625c04ca.tar.bz2 | |
virtio-balloon: fix a use-after-free case
The elem could theorically contain both outbuf and inbufs. We move the
free operation to the end of this function to avoid using elem->in_sg
while elem has been freed.
Fixes: c13c4153f7
("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Wei Wang <wei.w.wang@intel.com>
CC: Michael S. Tsirkin <mst@redhat.com>
CC: Dr. David Alan Gilbert <dgilbert@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Peter Xu <peterx@redhat.com>
Message-Id: <1552383280-4122-1-git-send-email-wei.w.wang@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'include/hw/intc')
0 files changed, 0 insertions, 0 deletions