Commit 3a21fb2a authored by Greg Kurz's avatar Greg Kurz
Browse files

virtio-9p: record element after sanity checks 



If the guest sends a malformed request, we end up with a dangling pointer
in V9fsVirtioState. This doesn't seem to cause any bug, but let's remove
this side effect anyway.

Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
Reviewed-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 453a1b23

hw/9pfs/virtio-9p-device.c

+2 −1
Original line number Diff line number Diff line
@@ -61,7 +61,6 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) 
        }

        QEMU_BUILD_BUG_ON(sizeof(out) != 7);



        v->elems[pdu->idx] = elem;

        len = iov_to_buf(elem->out_sg, elem->out_num, 0,

                         &out, sizeof(out));

        if (len != sizeof(out)) {
@@ -70,6 +69,8 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) 
            goto out_free_req;

        }



        v->elems[pdu->idx] = elem;



        pdu_submit(pdu, &out);

    }