All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefan Hajnoczi <stefanha@redhat.com>
To: "Eugenio Pérez" <eperezma@redhat.com>
Cc: Rob Miller <rob.miller@broadcom.com>,
	Parav Pandit <parav@mellanox.com>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	Jason Wang <jasowang@redhat.com>,
	Juan Quintela <quintela@redhat.com>,
	qemu-devel@nongnu.org, Markus Armbruster <armbru@redhat.com>,
	Harpreet Singh Anand <hanand@xilinx.com>,
	Xiao W Wang <xiao.w.wang@intel.com>, Eli Cohen <eli@mellanox.com>,
	virtualization@lists.linux-foundation.org,
	Michael Lilja <ml@napatech.com>,
	Jim Harford <jim.harford@broadcom.com>,
	Stefano Garzarella <sgarzare@redhat.com>
Subject: Re: [RFC v2 4/7] vhost: Add VhostShadowVirtqueue
Date: Wed, 17 Feb 2021 13:01:08 +0000	[thread overview]
Message-ID: <20210217130108.GF269203@stefanha-x1.localdomain> (raw)
In-Reply-To: <20210209153757.1653598-5-eperezma@redhat.com>

[-- Attachment #1: Type: text/plain, Size: 1077 bytes --]

On Tue, Feb 09, 2021 at 04:37:54PM +0100, Eugenio Pérez wrote:
> +/*
> + * Creates vhost shadow virtqueue, and instruct vhost device to use the shadow
> + * methods and file descriptors.
> + */
> +VhostShadowVirtqueue *vhost_shadow_vq_new(struct vhost_dev *dev, int idx)
> +{
> +    g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
> +    int r;
> +
> +    r = event_notifier_init(&svq->kick_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create kick event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_kick_notifier;
> +    }
> +
> +    r = event_notifier_init(&svq->call_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create call event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_call_notifier;
> +    }
> +
> +    return svq;

Use-after-free due to g_autofree. I think this should be:

  return g_steal_pointer(&svq)

https://developer.gnome.org/glib/stable/glib-Memory-Allocation.html#g-steal-pointer

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Stefan Hajnoczi <stefanha@redhat.com>
To: "Eugenio Pérez" <eperezma@redhat.com>
Cc: Rob Miller <rob.miller@broadcom.com>,
	Parav Pandit <parav@mellanox.com>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	qemu-devel@nongnu.org, Harpreet Singh Anand <hanand@xilinx.com>,
	Xiao W Wang <xiao.w.wang@intel.com>, Eli Cohen <eli@mellanox.com>,
	virtualization@lists.linux-foundation.org,
	Eric Blake <eblake@redhat.com>, Michael Lilja <ml@napatech.com>,
	Jim Harford <jim.harford@broadcom.com>
Subject: Re: [RFC v2 4/7] vhost: Add VhostShadowVirtqueue
Date: Wed, 17 Feb 2021 13:01:08 +0000	[thread overview]
Message-ID: <20210217130108.GF269203@stefanha-x1.localdomain> (raw)
In-Reply-To: <20210209153757.1653598-5-eperezma@redhat.com>


[-- Attachment #1.1: Type: text/plain, Size: 1077 bytes --]

On Tue, Feb 09, 2021 at 04:37:54PM +0100, Eugenio Pérez wrote:
> +/*
> + * Creates vhost shadow virtqueue, and instruct vhost device to use the shadow
> + * methods and file descriptors.
> + */
> +VhostShadowVirtqueue *vhost_shadow_vq_new(struct vhost_dev *dev, int idx)
> +{
> +    g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
> +    int r;
> +
> +    r = event_notifier_init(&svq->kick_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create kick event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_kick_notifier;
> +    }
> +
> +    r = event_notifier_init(&svq->call_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create call event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_call_notifier;
> +    }
> +
> +    return svq;

Use-after-free due to g_autofree. I think this should be:

  return g_steal_pointer(&svq)

https://developer.gnome.org/glib/stable/glib-Memory-Allocation.html#g-steal-pointer

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 183 bytes --]

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization

  reply	other threads:[~2021-02-17 13:03 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-09 15:37 [RFC v2 0/7] vDPA shadow virtqueue - notifications forwarding Eugenio Pérez
2021-02-09 15:37 ` [RFC v2 1/7] vhost: Delete trailing dot in errpr_setg argument Eugenio Pérez
2021-02-09 16:24   ` Eric Blake
2021-02-09 18:11     ` Eugenio Perez Martin
2021-02-11 16:40       ` Stefano Garzarella
2021-02-11 16:40         ` Stefano Garzarella
2021-02-09 15:37 ` [RFC v2 2/7] virtio: Add virtio_queue_host_notifier_status Eugenio Pérez
2021-02-17 12:41   ` Stefan Hajnoczi
2021-02-17 12:41     ` Stefan Hajnoczi
2021-02-17 18:38     ` Eugenio Perez Martin
2021-02-09 15:37 ` [RFC v2 3/7] vhost: Save masked_notifier state Eugenio Pérez
2021-02-17 12:44   ` Stefan Hajnoczi
2021-02-17 12:44     ` Stefan Hajnoczi
2021-02-09 15:37 ` [RFC v2 4/7] vhost: Add VhostShadowVirtqueue Eugenio Pérez
2021-02-17 13:01   ` Stefan Hajnoczi [this message]
2021-02-17 13:01     ` Stefan Hajnoczi
2021-02-17 18:40     ` Eugenio Perez Martin
2021-02-09 15:37 ` [RFC v2 5/7] vhost: Add x-vhost-enable-shadow-vq qmp Eugenio Pérez
2021-02-17 15:26   ` Stefan Hajnoczi
2021-02-17 15:26     ` Stefan Hajnoczi
2021-02-17 18:47     ` Eugenio Perez Martin
2021-02-18 18:35       ` Eugenio Perez Martin
2021-02-09 15:37 ` [RFC v2 6/7] vhost: Route guest->host notification through shadow virtqueue Eugenio Pérez
2021-02-17 16:56   ` Stefan Hajnoczi
2021-02-17 16:56     ` Stefan Hajnoczi
2021-02-17 20:11     ` Eugenio Perez Martin
2021-02-09 15:37 ` [RFC v2 7/7] vhost: Route host->guest " Eugenio Pérez
2021-02-17 17:24   ` Stefan Hajnoczi
2021-02-17 17:24     ` Stefan Hajnoczi
2021-02-17 19:13     ` Eugenio Perez Martin
2021-03-01  6:24   ` Jason Wang
2021-03-01  6:24     ` Jason Wang
2021-03-02 16:30     ` Eugenio Perez Martin
2021-02-09 15:54 ` [RFC v2 0/7] vDPA shadow virtqueue - notifications forwarding Eugenio Perez Martin
2021-02-11 11:12 ` no-reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210217130108.GF269203@stefanha-x1.localdomain \
    --to=stefanha@redhat.com \
    --cc=armbru@redhat.com \
    --cc=eli@mellanox.com \
    --cc=eperezma@redhat.com \
    --cc=hanand@xilinx.com \
    --cc=jasowang@redhat.com \
    --cc=jim.harford@broadcom.com \
    --cc=ml@napatech.com \
    --cc=mst@redhat.com \
    --cc=parav@mellanox.com \
    --cc=qemu-devel@nongnu.org \
    --cc=quintela@redhat.com \
    --cc=rob.miller@broadcom.com \
    --cc=sgarzare@redhat.com \
    --cc=virtualization@lists.linux-foundation.org \
    --cc=xiao.w.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.