qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit


From: Stefan Hajnoczi
Subject: Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit
Date: Fri, 30 Sep 2011 16:23:30 +0100

On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah <address@hidden> wrote:
> On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote:
>> QED's metadata caching strategy allows two parallel requests to race for
>> metadata lookup.  The first one to complete will populate the metadata
>> cache and the second one will drop the data it just read in favor of the
>> cached data.
>>
>> There is a use-after-free in qed_read_l2_table_cb() and
>> qed_commit_l2_update() where l2_table->offset was used after the
>> l2_table may have been freed due to a metadata lookup race.  Fix this by
>> keeping the l2_offset in a local variable and not reaching into the
>> possibly freed l2_table.
>>
>> Reported-by: Amit Shah <address@hidden>
>> Signed-off-by: Stefan Hajnoczi <address@hidden>
>> ---
>> Hi Amit,
>> Thanks for reporting the assertion failure you saw at 
>> http://fpaste.org/CDuv/.
>> Does this patch fix the problem?
>
> Yes, this fixes it.

Were you able to reliably reproduce the assertion failure before?

I wonder because this only happens when two metadata lookups race
(which is rare enough on my setup that I've never seen this failure).
It might be worth trying a few times.

Stefan



reply via email to

[Prev in Thread] Current Thread [Next in Thread]