From e1cd92d95cd4f97b3464c4e08cd5b22bf5ca05cb Mon Sep 17 00:00:00 2001 From: =?utf8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sat, 21 Mar 2020 13:06:54 +0100 Subject: [PATCH] tools/virtiofsd/passthrough_ll: Fix double close() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit On success, the fdopendir() call closes fd. Later on the error path we try to close an already-closed fd. This can lead to use-after-free. Fix by only closing the fd if the fdopendir() call failed. Cc: qemu-stable@nongnu.org Fixes: b39bce121b (add dirp_map to hide lo_dirp pointers) Reported-by: Coverity (CID 1421933 USE_AFTER_FREE) Suggested-by: Peter Maydell Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20200321120654.7985-1-philmd@redhat.com> Reviewed-by: Stefan Hajnoczi Signed-off-by: Dr. David Alan Gilbert --- tools/virtiofsd/passthrough_ll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c index 4f259aac70..4c35c95b25 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -1520,8 +1520,7 @@ out_err: if (d) { if (d->dp) { closedir(d->dp); - } - if (fd != -1) { + } else if (fd != -1) { close(fd); } free(d); -- 2.11.4.GIT