diff options
| author | Markus Armbruster <armbru@redhat.com> | 2019-08-22 15:38:46 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2019-09-10 08:58:43 +0200 |
| commit | 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3 (patch) | |
| tree | 0ed8ac0c70c3d7e4fc354dcb344ee8984c025f10 /scsi/pr-manager.c | |
| parent | ae6ef0190981a21f2d4bc8dcee7253688f14fae7 (diff) | |
| download | qemu-6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3.zip | |
pr-manager: Fix invalid g_free() crash bug
pr_manager_worker() passes its @opaque argument to g_free(). Wrong;
it points to pr_manager_worker()'s automatic @data. Broken when
commit 2f3a7ab39be converted @data from heap- to stack-allocated. Fix
by deleting the g_free().
Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'scsi/pr-manager.c')
| -rw-r--r-- | scsi/pr-manager.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c index ee43663576..0c866e8698 100644 --- a/scsi/pr-manager.c +++ b/scsi/pr-manager.c @@ -39,7 +39,6 @@ static int pr_manager_worker(void *opaque) int fd = data->fd; int r; - g_free(data); trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]); /* The reference was taken in pr_manager_execute. */ |