Re: [PATCH 0/2] zero pointer after bdrv_unref_child

2020-03-23 Thread Max Reitz
On 16.03.20 07:06, Vladimir Sementsov-Ogievskiy wrote: > Hi all! > > I faced use-after-free of bs->backing pointer after bdrv_unref_child in > bdrv_set_backing_hd. > > Fix it, and do similar thing for s->data_file in qcow2.c. > > I'm not sure that this is the full fix. Is it safe to keep bs->bac

[PATCH 0/2] zero pointer after bdrv_unref_child

2020-03-15 Thread Vladimir Sementsov-Ogievskiy
Hi all! I faced use-after-free of bs->backing pointer after bdrv_unref_child in bdrv_set_backing_hd. Fix it, and do similar thing for s->data_file in qcow2.c. I'm not sure that this is the full fix. Is it safe to keep bs->backing during bdrv_unref_child itself? Is it safe to keep bs->backing dur