All of lore.kernel.org
 help / color / mirror / Atom feed
From: Anthony Liguori <aliguori@us.ibm.com>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Amit Shah <amit.shah@redhat.com>, Kevin Wolf <kwolf@redhat.com>,
	Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>,
	"Justin M. Forbes" <jforbes@redhat.com>,
	qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit
Date: Mon, 03 Oct 2011 14:53:14 -0500	[thread overview]
Message-ID: <4E8A12AA.1030109@us.ibm.com> (raw)
In-Reply-To: <CAJSP0QWePpJ75LB0KF6Tf7t=Sue5myBQz+zQqcMivU+3aqXCdg@mail.gmail.com>

On 09/30/2011 10:26 AM, Stefan Hajnoczi wrote:
> On Fri, Sep 30, 2011 at 11:39 AM, Stefan Hajnoczi
> <stefanha@linux.vnet.ibm.com>  wrote:
>> QED's metadata caching strategy allows two parallel requests to race for
>> metadata lookup.  The first one to complete will populate the metadata
>> cache and the second one will drop the data it just read in favor of the
>> cached data.
>>
>> There is a use-after-free in qed_read_l2_table_cb() and
>> qed_commit_l2_update() where l2_table->offset was used after the
>> l2_table may have been freed due to a metadata lookup race.  Fix this by
>> keeping the l2_offset in a local variable and not reaching into the
>> possibly freed l2_table.
>>
>> Reported-by: Amit Shah<amit.shah@redhat.com>
>> Signed-off-by: Stefan Hajnoczi<stefanha@linux.vnet.ibm.com>
>
> Please consider this for -stable.  It's a pretty small/simple fix and
> can prevent an assertion failure.

Justin is looking to cut a stable release this week.  Since Kevin is out on 
holiday, unless anyone objects, I'll commit this so that it can make the next 
stable release.

Regards,

Anthony Liguori

>
> Stefan
>
>

  reply	other threads:[~2011-10-03 19:53 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-09-30 10:39 [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit Stefan Hajnoczi
2011-09-30 11:27 ` Amit Shah
2011-09-30 15:23   ` Stefan Hajnoczi
2011-09-30 15:49     ` Amit Shah
2011-10-11 14:22       ` Kevin Wolf
2011-10-12  7:53         ` Stefan Hajnoczi
2011-09-30 15:26 ` Stefan Hajnoczi
2011-10-03 19:53   ` Anthony Liguori [this message]
2011-10-05 16:17 ` Anthony Liguori

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4E8A12AA.1030109@us.ibm.com \
    --to=aliguori@us.ibm.com \
    --cc=amit.shah@redhat.com \
    --cc=jforbes@redhat.com \
    --cc=kwolf@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@gmail.com \
    --cc=stefanha@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.