diff options
| author | zhanghailiang <zhang.zhanghailiang@huawei.com> | 2014-08-18 15:42:50 +0800 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-09-08 11:23:04 -0500 |
| commit | 2a575c450e1f1e82fb040632e3608e376c4212c2 (patch) | |
| tree | 89b5a976211d08d11d834ac59a3c6912c07f3faf | |
| parent | 1ad9dcec4777790b3a567888916c5aef55b512bf (diff) | |
| download | qemu-2a575c450e1f1e82fb040632e3608e376c4212c2.tar.gz | |
virtio-blk: fix reference a pointer which might be freed
In function virtio_blk_handle_request, it may freed memory pointed by req,
So do not access member of req after calling this function.
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 1bdb176ac5add5dc9d54a230da7511b66851f1e7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/block/virtio-blk.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index c241c5002b..0e3925b629 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque) s->rq = NULL; while (req) { + VirtIOBlockReq *next = req->next; virtio_blk_handle_request(req, &mrb); - req = req->next; + req = next; } virtio_submit_multiwrite(s->bs, &mrb); |