Re: [PATCH] vfio: fix use-after-free in display

[Alex Williamson <alex.williamson@redhat.com>]

On Mon, 13 Jul 2020 14:45:20 +0200
Gerd Hoffmann <kraxel@redhat.com> wrote:

> Calling ramfb_display_update() might replace the DisplaySurface with the
> boot display, which in turn will free the currently active
> DisplaySurface.
> 
> So clear our DisplaySurface pinter (dpy->region.surface pointer) to (a)
                               ^o

> avoid use-after-free and (b) force replacing the boot display with the
> real display when switching back.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/vfio/display.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/vfio/display.c b/hw/vfio/display.c
> index a57a22674d62..342054193b3c 100644
> --- a/hw/vfio/display.c
> +++ b/hw/vfio/display.c
> @@ -405,6 +405,7 @@ static void vfio_display_region_update(void *opaque)
>      if (!plane.drm_format || !plane.size) {
>          if (dpy->ramfb) {
>              ramfb_display_update(dpy->con, dpy->ramfb);
> +            dpy->region.surface = NULL;
>          }
>          return;
>      }

Tricky, but I think I follow that dpy->region.surface is only ever
allocated to replace dpy->con->surface, so when ramfb_display_update()
then replaces and frees dpy->con->surface with dpy->ramfb->ds, that's
where the object point to by dpy->region.surface was freed.  Right?

If so, looks ok to me.  If you're constructing a pull request, I'll
give you an:

Acked-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

If you need me to send a pull, let me know.  Thanks,

Alex