Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit

[Kevin Wolf <kwolf@redhat.com>]

Am 30.09.2011 17:49, schrieb Amit Shah:
> On (Fri) 30 Sep 2011 [16:23:30], Stefan Hajnoczi wrote:
>> On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah <amit.shah@redhat.com> wrote:
>>> On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote:
>>>> QED's metadata caching strategy allows two parallel requests to race for
>>>> metadata lookup.  The first one to complete will populate the metadata
>>>> cache and the second one will drop the data it just read in favor of the
>>>> cached data.
>>>>
>>>> There is a use-after-free in qed_read_l2_table_cb() and
>>>> qed_commit_l2_update() where l2_table->offset was used after the
>>>> l2_table may have been freed due to a metadata lookup race.  Fix this by
>>>> keeping the l2_offset in a local variable and not reaching into the
>>>> possibly freed l2_table.
>>>>
>>>> Reported-by: Amit Shah <amit.shah@redhat.com>
>>>> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
>>>> ---
>>>> Hi Amit,
>>>> Thanks for reporting the assertion failure you saw at http://fpaste.org/CDuv/.
>>>> Does this patch fix the problem?
>>>
>>> Yes, this fixes it.
>>
>> Were you able to reliably reproduce the assertion failure before?
> 
> Absolutely.
> 
> I even reverted the patch and tried the same image; same segfault
> again.
> 
>> I wonder because this only happens when two metadata lookups race
>> (which is rare enough on my setup that I've never seen this failure).
>> It might be worth trying a few times.
> 
> Get the F16 beta-rc LXE live iso, install guest.  It doesn't cleanly
> reboot, you have to kill the VM.  Next start of the VM produces this
> segfault.
> 
> https://alt.fedoraproject.org/pub/alt/stage/16-Beta.RC2/Live/x86_64/Fedora-16-Beta-x86_64-Live-LXDE.iso

Can we try to artificially produce it in a qemu-iotests case?

Kevin