mirror of
https://github.com/qemu/qemu.git
synced 2024-12-06 02:03:38 +08:00
4ab0359a8a
When processing NCQ commands, AHCI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left as 'used'. This leads to a use after free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'. Reset NCQ transfer object to 'unused' to avoid it. [Maintainer edit: s/ACHI/AHCI/ in the commit message. --js] Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com Signed-off-by: John Snow <jsnow@redhat.com> |
||
---|---|---|
.. | ||
ahci.c | ||
ahci.h | ||
atapi.c | ||
cmd646.c | ||
core.c | ||
ich.c | ||
internal.h | ||
isa.c | ||
macio.c | ||
Makefile.objs | ||
microdrive.c | ||
mmio.c | ||
pci.c | ||
pci.h | ||
piix.c | ||
qdev.c | ||
via.c |