From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:54341) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RAoa5-0002l3-Gg for qemu-devel@nongnu.org; Mon, 03 Oct 2011 15:53:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RAoa4-0002HJ-Ft for qemu-devel@nongnu.org; Mon, 03 Oct 2011 15:53:41 -0400 Received: from e7.ny.us.ibm.com ([32.97.182.137]:58323) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RAoa4-0002HC-DM for qemu-devel@nongnu.org; Mon, 03 Oct 2011 15:53:40 -0400 Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e7.ny.us.ibm.com (8.14.4/8.13.1) with ESMTP id p93IWLol032708 for ; Mon, 3 Oct 2011 14:32:21 -0400 Received: from d03av05.boulder.ibm.com (d03av05.boulder.ibm.com [9.17.195.85]) by d01relay04.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id p93JrXUw180542 for ; Mon, 3 Oct 2011 15:53:34 -0400 Received: from d03av05.boulder.ibm.com (loopback [127.0.0.1]) by d03av05.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id p93JrWUH030790 for ; Mon, 3 Oct 2011 13:53:33 -0600 Message-ID: <4E8A12AA.1030109@us.ibm.com> Date: Mon, 03 Oct 2011 14:53:14 -0500 From: Anthony Liguori MIME-Version: 1.0 References: <1317379151-11557-1-git-send-email-stefanha@linux.vnet.ibm.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Amit Shah , Kevin Wolf , Stefan Hajnoczi , "Justin M. Forbes" , qemu-devel@nongnu.org On 09/30/2011 10:26 AM, Stefan Hajnoczi wrote: > On Fri, Sep 30, 2011 at 11:39 AM, Stefan Hajnoczi > wrote: >> QED's metadata caching strategy allows two parallel requests to race for >> metadata lookup. The first one to complete will populate the metadata >> cache and the second one will drop the data it just read in favor of the >> cached data. >> >> There is a use-after-free in qed_read_l2_table_cb() and >> qed_commit_l2_update() where l2_table->offset was used after the >> l2_table may have been freed due to a metadata lookup race. Fix this by >> keeping the l2_offset in a local variable and not reaching into the >> possibly freed l2_table. >> >> Reported-by: Amit Shah >> Signed-off-by: Stefan Hajnoczi > > Please consider this for -stable. It's a pretty small/simple fix and > can prevent an assertion failure. Justin is looking to cut a stable release this week. Since Kevin is out on holiday, unless anyone objects, I'll commit this so that it can make the next stable release. Regards, Anthony Liguori > > Stefan > >