From: Prasad J Pandit <p...@fedoraproject.org> When IDE AHCI emulation uses Frame Information Structures(FIS) engine for data transfer, the mapped FIS buffer address is stored in a static 'bounce.buffer'. This is freed when FIS entry is unmapped. If multiple FIS entries are created, it leads to an use after free error. Check 'bounce.in_use' flag to avoid it.
Reported-by: Zuozhi fzz <zuozhi....@alibaba-inc.com> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exec.c b/exec.c index 8718a75..ccc5715 100644 --- a/exec.c +++ b/exec.c @@ -2922,7 +2922,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, memory_region_unref(mr); return; } - if (is_write) { + if (bounce.in_use && is_write) { address_space_write(as, bounce.addr, MEMTXATTRS_UNSPECIFIED, bounce.buffer, access_len); } -- 2.5.0