Skip to content

block: fix dangling bs->explicit_options in block.c

谌翔 requested to merge stable-2.10 into main

In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it.

Signed-off-by: Manos Pitsidianakis el13635@mail.ntua.gr Signed-off-by: Kevin Wolf kwolf@redhat.com

Merge request reports