[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put()
From: |
Jia-Shiun Li |
Subject: |
[Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put() |
Date: |
Fri, 30 Jun 2017 20:03:04 +0800 |
In commit 9e0bc24f dev->log_size was reset to zero too early before
syncing vhost log. It causes syncing to be skipped.
Use local variable to keep its value before resetting.
Signed-off-by: Jia-Shiun Li <address@hidden>
---
v1 -> v2:
* Use local variable to keep value of dev->log_size.
---
hw/virtio/vhost.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 6eddb09..c1c5714 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -371,6 +371,7 @@ static struct vhost_log *vhost_log_get(uint64_t size, bool
share)
static void vhost_log_put(struct vhost_dev *dev, bool sync)
{
struct vhost_log *log = dev->log;
+ uint64_t log_size = dev->log_size;
if (!log) {
return;
@@ -381,8 +382,8 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync)
--log->refcnt;
if (log->refcnt == 0) {
/* Sync only the range covered by the old log */
- if (dev->log_size && sync) {
- vhost_log_sync_range(dev, 0, dev->log_size * VHOST_LOG_CHUNK - 1);
+ if (log_size && sync) {
+ vhost_log_sync_range(dev, 0, log_size * VHOST_LOG_CHUNK - 1);
}
if (vhost_log == log) {
--
2.7.4
- [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put(),
Jia-Shiun Li <=