Re: [Qemu-devel] [PATCH for-2.9 1/2] block/mirror: Fix use-after-free

2017-04-03 Thread Philippe Mathieu-Daudé
nice analysis/catch On 04/03/2017 02:51 PM, Max Reitz wrote: If @bs does not have any parents, the only reference to @mirror_top_bs will be held by the BlockJob object after the bdrv_unref() following block_job_create(). However, if block_job_create() fails, this reference will not exist and @mi

[Qemu-devel] [PATCH for-2.9 1/2] block/mirror: Fix use-after-free

2017-04-03 Thread Max Reitz
If @bs does not have any parents, the only reference to @mirror_top_bs will be held by the BlockJob object after the bdrv_unref() following block_job_create(). However, if block_job_create() fails, this reference will not exist and @mirror_top_bs will have been deleted when we goto fail. The issue