vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

cve-2015-5166 

-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJVv3pgAAoJEIlPj0hw4a6QGKUP/2za5f0iiPUERQuCW1ollKSe
 p1JdyHAJrzuHYiubHj4Zo878IhYzG2tvG1UNm2reaYV+gDAML/suUwH2Uh4FSRdp
 vjg/qIZJ+UPwVS220En/XRoyXHv6J9AC2oVDhFSUm7QBK6QJ9Pzr0qVLIyNj0UPi
 Ec9V+/pQn+mTveJ/ytu8/YxSmFZP8xyDtJb7jsUpcSQAcGPOLObIYamNdT+0ArVg
 ex+5VoZdOGjVuG18c9IAO6O0Ymy4Ll/MB2pe0KRfbpBMJtO8t7EH1honuQHR1w+z
 g4j34bTiNMT6U48Gh7gUcU8HgJxpLyN6GB63RkspuGyiJar5106n21sC1DtpfeKf
 CC34qb4cw+32GE7QqCAbx4yLD/w+MrtD99FYfpCtcxNGqkgxIaE+hT6/o/Qt+8TS
 8itcTvw1YCk0JSwb4P4nf6jOQtetAl3pMYRPh2TEsmCyuMqxPr6seMIJ3pK+zMd6
 CtT5jvNGSaYNPPonJ+AOlCShuWPPIfjMSOgOiUbrEBLN4A0JmZx5i3bYFgPXK3Ad
 v/Ny83rygmzqmtxKMnzHC0KdBlmmbhmeH7b8Iubfpl0amefqA1DZOEDc8PZJcz+2
 iErFILfJHmQDXhut3+LEUzxOX18GstKoLYdM3kOutae41Rga+cKQSUszkRaRWq5k
 lVT2zlk9TsAu5ccU5Y6l
 =rvso
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging

cve-2015-5166

# gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

* remotes/sstabellini/tags/cve-2015-5166-tag:
  Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
master
Peter Maydell 2015-08-03 18:52:55 +01:00
parent e95edefbd0 6cd387833d
commit 260425ab40
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hw/ide/piix.c
View File

@ -169,6 +169,7 @@ int pci_piix3_xen_ide_unplug(DeviceState *dev)
PCIIDEState *pci_ide;
DriveInfo *di;
int i;
IDEDevice *idedev;
pci_ide = PCI_IDE(dev);
@ -181,6 +182,12 @@ int pci_piix3_xen_ide_unplug(DeviceState *dev)
blk_detach_dev(blk, ds);
}
pci_ide->bus[di->bus].ifs[di->unit].blk = NULL;
if (!(i % 2)) {
idedev = pci_ide->bus[di->bus].master;
} else {
idedev = pci_ide->bus[di->bus].slave;
}
idedev->conf.blk = NULL;
blk_unref(blk);
}
}