* [PATCH] hw/vfio/pci: fix double free in vfio_msi_disable
@ 2019-09-26 11:29 Evgeny Yakovlev
2019-09-26 17:16 ` Alex Williamson
0 siblings, 1 reply; 2+ messages in thread
From: Evgeny Yakovlev @ 2019-09-26 11:29 UTC (permalink / raw)
To: alex.williamson; +Cc: qemu-devel, yc-core
The following guest behaviour patter leads to double free in VFIO PCI:
1. Guest enables MSI interrupts
vfio_msi_enable is called, but fails in vfio_enable_vectors.
In our case this was because VFIO GPU device was in D3 state.
Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not
set this pointer to NULL
2. Guest still sees MSI an enabled after that because emulated config
write is done in vfio_pci_write_config unconditionally before calling
vfio_msi_enable
3. Guest disables MSI interrupts
vfio_msi_disable is called and tries to g_free(vdev->msi_vectors)
in vfio_msi_disable_common => double free
Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
---
hw/vfio/pci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c5e6fe6..12fac39 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -651,6 +651,7 @@ retry:
}
g_free(vdev->msi_vectors);
+ vdev->msi_vectors = NULL;
if (ret > 0 && ret != vdev->nr_vectors) {
vdev->nr_vectors = ret;
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] hw/vfio/pci: fix double free in vfio_msi_disable
2019-09-26 11:29 [PATCH] hw/vfio/pci: fix double free in vfio_msi_disable Evgeny Yakovlev
@ 2019-09-26 17:16 ` Alex Williamson
0 siblings, 0 replies; 2+ messages in thread
From: Alex Williamson @ 2019-09-26 17:16 UTC (permalink / raw)
To: Evgeny Yakovlev; +Cc: qemu-devel, yc-core
On Thu, 26 Sep 2019 14:29:35 +0300
Evgeny Yakovlev <wrfsh@yandex-team.ru> wrote:
> The following guest behaviour patter leads to double free in VFIO PCI:
>
> 1. Guest enables MSI interrupts
> vfio_msi_enable is called, but fails in vfio_enable_vectors.
> In our case this was because VFIO GPU device was in D3 state.
> Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not
> set this pointer to NULL
>
> 2. Guest still sees MSI an enabled after that because emulated config
> write is done in vfio_pci_write_config unconditionally before calling
> vfio_msi_enable
>
> 3. Guest disables MSI interrupts
> vfio_msi_disable is called and tries to g_free(vdev->msi_vectors)
> in vfio_msi_disable_common => double free
>
> Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
> ---
> hw/vfio/pci.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
> index c5e6fe6..12fac39 100644
> --- a/hw/vfio/pci.c
> +++ b/hw/vfio/pci.c
> @@ -651,6 +651,7 @@ retry:
> }
>
> g_free(vdev->msi_vectors);
> + vdev->msi_vectors = NULL;
>
> if (ret > 0 && ret != vdev->nr_vectors) {
> vdev->nr_vectors = ret;
Looks correct to me, I'll queue it. Thanks,
Alex
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-26 17:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-26 11:29 [PATCH] hw/vfio/pci: fix double free in vfio_msi_disable Evgeny Yakovlev
2019-09-26 17:16 ` Alex Williamson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).