* [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put()
@ 2017-06-30 12:03 Jia-Shiun Li
2017-06-30 12:07 ` Marc-André Lureau
0 siblings, 1 reply; 2+ messages in thread
From: Jia-Shiun Li @ 2017-06-30 12:03 UTC (permalink / raw)
To: marcandre.lureau, mst; +Cc: qemu-devel, Jia-Shiun Li
In commit 9e0bc24f dev->log_size was reset to zero too early before
syncing vhost log. It causes syncing to be skipped.
Use local variable to keep its value before resetting.
Signed-off-by: Jia-Shiun Li <jsli@synology.com>
---
v1 -> v2:
* Use local variable to keep value of dev->log_size.
---
hw/virtio/vhost.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 6eddb09..c1c5714 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -371,6 +371,7 @@ static struct vhost_log *vhost_log_get(uint64_t size, bool share)
static void vhost_log_put(struct vhost_dev *dev, bool sync)
{
struct vhost_log *log = dev->log;
+ uint64_t log_size = dev->log_size;
if (!log) {
return;
@@ -381,8 +382,8 @@ static void vhost_log_put(struct vhost_dev *dev, bool sync)
--log->refcnt;
if (log->refcnt == 0) {
/* Sync only the range covered by the old log */
- if (dev->log_size && sync) {
- vhost_log_sync_range(dev, 0, dev->log_size * VHOST_LOG_CHUNK - 1);
+ if (log_size && sync) {
+ vhost_log_sync_range(dev, 0, log_size * VHOST_LOG_CHUNK - 1);
}
if (vhost_log == log) {
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put()
2017-06-30 12:03 [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put() Jia-Shiun Li
@ 2017-06-30 12:07 ` Marc-André Lureau
0 siblings, 0 replies; 2+ messages in thread
From: Marc-André Lureau @ 2017-06-30 12:07 UTC (permalink / raw)
To: Jia-Shiun Li, mst; +Cc: qemu-devel
On Fri, Jun 30, 2017 at 2:03 PM Jia-Shiun Li <jsli@synology.com> wrote:
> In commit 9e0bc24f dev->log_size was reset to zero too early before
> syncing vhost log. It causes syncing to be skipped.
>
> Use local variable to keep its value before resetting.
>
> Signed-off-by: Jia-Shiun Li <jsli@synology.com>
>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
>
> v1 -> v2:
> * Use local variable to keep value of dev->log_size.
>
> ---
> hw/virtio/vhost.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> index 6eddb09..c1c5714 100644
> --- a/hw/virtio/vhost.c
> +++ b/hw/virtio/vhost.c
> @@ -371,6 +371,7 @@ static struct vhost_log *vhost_log_get(uint64_t size,
> bool share)
> static void vhost_log_put(struct vhost_dev *dev, bool sync)
> {
> struct vhost_log *log = dev->log;
> + uint64_t log_size = dev->log_size;
>
> if (!log) {
> return;
> @@ -381,8 +382,8 @@ static void vhost_log_put(struct vhost_dev *dev, bool
> sync)
> --log->refcnt;
> if (log->refcnt == 0) {
> /* Sync only the range covered by the old log */
> - if (dev->log_size && sync) {
> - vhost_log_sync_range(dev, 0, dev->log_size * VHOST_LOG_CHUNK
> - 1);
> + if (log_size && sync) {
> + vhost_log_sync_range(dev, 0, log_size * VHOST_LOG_CHUNK - 1);
> }
>
> if (vhost_log == log) {
> --
> 2.7.4
>
> --
Marc-André Lureau
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-06-30 12:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-30 12:03 [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put() Jia-Shiun Li
2017-06-30 12:07 ` Marc-André Lureau
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.