mirror of
https://github.com/qemu/qemu.git
synced 2025-10-27 05:04:40 +00:00
4ab0359a8a
When processing NCQ commands, AHCI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left as 'used'. This leads to a use after free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'. Reset NCQ transfer object to 'unused' to avoid it. [Maintainer edit: s/ACHI/AHCI/ in the commit message. --js] Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com Signed-off-by: John Snow <jsnow@redhat.com> |
||
|---|---|---|
| .. | ||
| ahci.c | ||
| ahci.h | ||
| atapi.c | ||
| cmd646.c | ||
| core.c | ||
| ich.c | ||
| internal.h | ||
| isa.c | ||
| macio.c | ||
| Makefile.objs | ||
| microdrive.c | ||
| mmio.c | ||
| pci.c | ||
| pci.h | ||
| piix.c | ||
| qdev.c | ||
| via.c | ||