qemu: agent: clear stale pointer in qemuAgentGetDisks

[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks

Ján Tomko via Devel posted 1 patch 3 days, 15 hours ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/be2bce18a8a1b35b14087e49bcf675874f3786a3.1787307755.git.jtomko@redhat.com

src/hypervisor/qemu_agent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks

Posted by Ján Tomko via Devel 3 days, 15 hours ago

From: Ján Tomko <jtomko@redhat.com>

CVE-2026-77158

In case of hitting the cleanup label, the disks array
was freed but the pointer was not cleared, leading
to a possible double free.

Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d)
Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910
Reported-by: David Korczynski (Ada Logics)
Found-by: Claude
Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/hypervisor/qemu_agent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c
index f5f50e3c92..431407b68e 100644
--- a/src/hypervisor/qemu_agent.c
+++ b/src/hypervisor/qemu_agent.c
@@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent,
     for (i = 0; i < ndata; i++) {
         qemuAgentDiskInfoFree((*disks)[i]);
     }
-    g_free(*disks);
+    g_clear_pointer(disks, g_free);
     return -1;
 }
 
-- 
2.55.0

Re: [libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks

Posted by Peter Krempa via Devel 18 hours ago

On Fri, Aug 21, 2026 at 12:22:35 +0200, Ján Tomko via Devel wrote:
> From: Ján Tomko <jtomko@redhat.com>
> 
> CVE-2026-77158
> 
> In case of hitting the cleanup label, the disks array
> was freed but the pointer was not cleared, leading
> to a possible double free.
> 
> Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d)
> Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910
> Reported-by: David Korczynski (Ada Logics)
> Found-by: Claude
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/hypervisor/qemu_agent.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c
> index f5f50e3c92..431407b68e 100644
> --- a/src/hypervisor/qemu_agent.c
> +++ b/src/hypervisor/qemu_agent.c
> @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent,
>      for (i = 0; i < ndata; i++) {
>          qemuAgentDiskInfoFree((*disks)[i]);
>      }
> -    g_free(*disks);
> +    g_clear_pointer(disks, g_free);
>      return -1;
>  }
>  
> -- 
> 2.55.0
> 

Reviewed-by: Peter Krempa <pkrempa@redhat.com>