From: Avi Kivity <avi@redhat.com>
Date: Mon, 6 Aug 2012 12:49:03 +0000 (+0300)
Subject: virtio-blk: fix use-after-free while handling scsi commands
X-Git-Tag: v1.1.2~67
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3b38972743856fbfcee88fc15eb0753977103313;p=thirdparty%2Fqemu.git

virtio-blk: fix use-after-free while handling scsi commands

The scsi passthrough handler falls through after completing a
request into the failure path, resulting in a use after free.

Reproducible by running a guest with aio=native on a block device.

Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 730a9c53b4e52681fcfe31cf38854cbf91e132c7)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index fe0774617b5..f44d24420dd 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -253,6 +253,7 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
 
     virtio_blk_req_complete(req, status);
     g_free(req);
+    return;
 #else
     abort();
 #endif