Re: [Qemu-devel] [PATCH] ide: ahci: reset ncq object to unused on error

2016-01-08 Thread P J P
+-- On Fri, 8 Jan 2016, John Snow wrote --+ | In both of these error pathways, AIOCB is actually never assigned to | begin with. True, it's mentioned in the commit message. | So it's not necessarily a use-after-free. Yes, right. | I think it should be safe to put ncq_tfs->used = 0 directl

Re: [Qemu-devel] [PATCH] ide: ahci: reset ncq object to unused on error

2016-01-08 Thread John Snow
On 01/08/2016 07:08 AM, P J P wrote: > From: Prasad J Pandit > > When processing NCQ commands, ACHI device emulation prepares a > NCQ transfer object; To which an aio control block(aiocb) object > is assigned in 'execute_ncq_command'. In case, when the NCQ > command is invalid, the 'aiocb' obje

[Qemu-devel] [PATCH] ide: ahci: reset ncq object to unused on error

2016-01-08 Thread P J P
From: Prasad J Pandit When processing NCQ commands, ACHI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left